File system access method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a file system access method and device, equipment and a storage medium, and the method comprises the steps: obtaining a shared name and an Internet protocol address of a file system, the file system comprising a target file system; registering a local domain name for the file system according to the shared name; determining a mapping relation between a local domain name of the file system and an internet protocol address; and controlling the terminal node to access the target file system based on the local domain name according to the target internet protocol address corresponding to the target file system and the mapping relation. According to the embodiment of the invention, under the constraint condition that the terminal node is only allowed to access the file system through the domain name and the file system only supports the access mode based on the IP address, the terminal node can still effectively access the file system by using the access mechanism based on the Internet protocol address, so that the convenience and experience of user use are improved, and the user experience is improved. And the function application range of the file system is expanded.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and apparatus for accessing a file system, an electronic device, and a storage medium. Background Technology

[0002] Public cloud service providers typically offer two file systems for users to choose from: NFS (Network File System) and CIFS (Common Internet File System). Given their respective historical development and compatibility considerations, it is generally recommended that Windows users use the CIFS file system. In a Windows environment, accessing shared directories via CIFS primarily involves two methods: access via IP address (Internet Protocol address) or access via domain name. Specifically, when accessing via IP address, the path in the format "\IP address\share name" must be entered in the File Explorer address bar; while when accessing via domain name, the path in the format "\domain name\share name" must be entered.

[0003] However, in certain applications and scenarios, such as IIS (Internet Information Services) or AD (Active Directory) domain environments, the system only allows end nodes to access the file system via domain names. If the file system product provided by the cloud service provider only supports IP address-based access and does not offer a domain name-based access mechanism, the functionality in the above scenarios will not be possible.

[0004] Therefore, how to enable terminal nodes to effectively access the file system using IP address-based access methods, under the restriction that only terminal nodes are allowed to access the file system via domain name and the file system only supports IP address-based access, is a problem that urgently needs to be solved in this field. Summary of the Invention

[0005] This application provides a method for accessing a file system to address the problem of how to enable terminal nodes to effectively access the file system using IP address-based access methods, even under the limitations of only allowing terminal nodes to access the file system via domain names and the file system only supporting IP address-based access.

[0006] Accordingly, embodiments of this application also provide a file system access device, an electronic device, and a storage medium to ensure the implementation and application of the above methods.

[0007] To address the aforementioned issues, this application discloses a file system access method applied to an authentication cloud host, wherein the authentication cloud host is communicatively connected to a terminal node, and the method includes: Obtain the shared name and Internet Protocol address of the file system, including the target file system; Register a local domain name for the file system based on the shared name; Determine the mapping relationship between the local domain name and the Internet Protocol address in the file system; Based on the target Internet Protocol address corresponding to the target file system and the mapping relationship, the terminal node is controlled to access the target file system based on the local domain name.

[0008] Optionally, obtaining the shared name of the file system includes: Obtain the universally unique identifier and tenant identifier of the file system; The shared name of the file system is obtained by concatenating the universally unique identifier and the tenant identifier; Registering a local domain name for the file system based on the shared name includes: Obtain the domain name of the certified cloud host corresponding to the certified cloud host; The local domain name of the file system is obtained by concatenating the shared name as a prefix and the certified cloud host domain name as a suffix.

[0009] Optionally, controlling the terminal node to access the target file system based on the local domain name according to the target Internet Protocol address corresponding to the target file system and the mapping relationship includes: Receive the access request containing the target Internet Protocol address sent by the terminal node; The target local domain name corresponding to the target Internet Protocol address is determined according to the mapping relationship, and the target local domain name corresponds to the target file system; The target local domain name is returned to the terminal node so that the terminal node can access the target file system based on the target local domain name.

[0010] Optionally, the certified cloud host has a domain name resolution service, and determining the target local domain name corresponding to the target Internet Protocol address according to the mapping relationship includes: Using the domain name resolution service, based on the target Internet Protocol address and the mapping relationship, it is determined whether a corresponding local domain name exists for the target Internet Protocol address; If the target Internet Protocol address has a corresponding local domain name, then the local domain name corresponding to the target Internet Protocol address shall be used as the target local domain name.

[0011] Optionally, the access request has a corresponding request tenant identifier, the authenticated cloud host has a domain name resolution service, and after determining the target local domain name corresponding to the target Internet Protocol address according to the mapping relationship, the method further includes: Based on the request tenant identifier and the target local domain name, determine whether the tenant corresponding to the request tenant identifier has access rights; If the tenant corresponding to the requested tenant identifier has access rights, the target local domain name is returned to the terminal node so that the terminal node can access the target file system based on the target local domain name.

[0012] Optionally, the terminal node is communicatively connected to a file server, and the file system is deployed on the file server. After returning the target local domain name to the terminal node, the method further includes: Control the terminal node to send a mount request containing the target local domain name to the file server; If the file server verifies the target local domain name, it controls the terminal node to mount the target file system.

[0013] Optionally, the file server stores a key table, which includes local domain names corresponding to the file systems that are allowed to be accessed. After the terminal node is controlled to send a mount request containing the target local domain name to the file server, the method further includes: The file server is controlled to verify the target local domain name based on the local domain name corresponding to the allowed file system. If the local domain name corresponding to the allowed file system contains the target local domain name, then the file server is deemed to have passed the verification of the target local domain name.

[0014] This application also discloses a file system access device applied to an authentication cloud host, wherein the authentication cloud host is communicatively connected to a terminal node, and the device includes: The information acquisition module is used to acquire the shared name and Internet Protocol address of the file system, wherein the file system includes the target file system; The domain name registration module is used to register a local domain name for the file system based on the shared name; A relationship determination module is used to determine the mapping relationship between the local domain name and the Internet Protocol address of the file system; The node access module is used to control the terminal node to access the target file system based on the local domain name, according to the target Internet Protocol address corresponding to the target file system and the mapping relationship.

[0015] This application also discloses an electronic device, including: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform one or more file system access methods as described in the embodiments of this application.

[0016] This application also discloses a machine-readable medium storing executable code thereon, which, when executed, causes a processor to perform one or more file system access methods as described in the embodiments of this application.

[0017] Compared with the prior art, the embodiments of this application have the following advantages: In this embodiment, the shared name and Internet Protocol (IP) address of the file system are obtained through an authenticated cloud host. The file system includes a target file system. A local domain name is registered for the file system based on the shared name. The mapping relationship between the local domain name and the IP address of the file system is determined. Based on the target IP address and mapping relationship corresponding to the target file system, the terminal node is controlled to access the target file system based on the local domain name. This embodiment does not require the file system service provider to provide domain name access functionality, nor does it rely on an external DNS server. By registering a local domain name for the file system based on the shared name on the authenticated cloud host and deploying the DNS server role in the authenticated cloud host, the mapping relationship between the local domain name and the IP address of the file system is established. Based on the target IP address corresponding to the target file system and this mapping relationship, the terminal node can access the target file system using the local domain name corresponding to the target file system even if it does not use the domain name-based access method. Therefore, even under the constraints that the terminal node is only allowed to access the file system via domain name and the file system itself only supports IP address-based access, the terminal node can still effectively access the file system using the IP address-based access mechanism. This not only improves the convenience and experience of the user but also expands the functional applicability of the file system. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the steps of an embodiment of a file system access method according to this application; Figure 2 This is a system architecture diagram of an embodiment of a file system access method according to this application; Figure 3 This is a structural block diagram of an embodiment of a file system access device according to this application; Figure 4This is a schematic diagram of the structure of a device provided in an embodiment of this application. Detailed Implementation

[0019] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0020] Reference Figure 1 This is a flowchart illustrating the steps of an embodiment of a file system access method according to this application, including the following steps: Step 101: Obtain the shared name and Internet Protocol address of the file system, wherein the file system includes the target file system.

[0021] The file system access method shown in this application embodiment is applied to an authentication cloud host, which is communicatively connected to at least one terminal node.

[0022] Specifically, in this application embodiment, at least one cloud host is used as at least one terminal node for mounting and accessing the file system, and another cloud host in the same network as the terminal node is used as the authentication cloud host. In some embodiments of this application, the authentication cloud host acts as a KDC (Key Distribution Center) node and authentication server, used to provide keys and authentication tickets when tenants access the file system. In some embodiments of this application, the authentication cloud host also acts as a domain controller, managing the permissions of all tenants to access the file system.

[0023] The file system can be deployed on a file server, which can be located in a public cloud. The file server creates a container service for each file system, and each container provides an IP address-based CIFS share service. The file server supports IP address-based access, providing end nodes with a mount point in the format / / [fs_server_ip] / [share_name], which contains the IP address and the corresponding share name of the file system. The file system includes the target file system that the tenant needs to access.

[0024] In one embodiment, the file server is configured to communicate with terminal nodes using the Kerberos protocol. Samba is used on the file server as the server component of the CIFS sharing service. Case sensitivity is not enforced on Samba to avoid access errors caused by case insensitivity on Windows terminal nodes. Kerberos is a network authentication protocol designed to provide authentication services for user identity information in insecure networks. Its core objective is to provide strong authentication services for client / server applications through a key system. The Kerberos protocol does not rely on the host operating system for authentication and does not require physical security of the network environment. Samba, on the other hand, is free software used to implement the SMB (Server Message Block) / CIFS network protocol. Its core function is to allow non-Windows computers to seamlessly integrate into and participate in Windows network environments.

[0025] In step 101 of this application embodiment, the shared name (i.e., share_name) and Internet Protocol address (i.e., IP address) corresponding to the file system are obtained. The shared name corresponding to the file system is unique and can be used to distinguish different file systems.

[0026] Step 102: Register a local domain name for the file system according to the shared name.

[0027] In order to allow terminal nodes to effectively access the file system using the Internet Protocol address-based access mechanism, under the constraints that terminal nodes are only allowed to access the file system via domain name and the file system itself only supports IP address-based access, local domain names are registered for each file system on the certified cloud host based on the shared name.

[0028] Step 103: Determine the mapping relationship between the local domain name and the Internet Protocol address of the file system.

[0029] After determining the local domain name of the file system, the Internet Protocol address of the file system is mapped to the local domain name to obtain the mapping relationship between the local domain name and the Internet Protocol address of the file system. The mapping format is [fs_server_ip]:[share_name.example.com] (that is, the Internet Protocol address of the file system: the local domain name of the file system).

[0030] In one embodiment, this mapping entry can be added to the C:\Windows\System32\drivers\etc\hosts file of the terminal node's Windows before the file system is mounted on the terminal node.

[0031] Step 104: Based on the target Internet Protocol address corresponding to the target file system and the mapping relationship, control the terminal node to access the target file system based on the local domain name.

[0032] Specifically, the DNS (Domain Name System) service is enabled on the certified cloud host to provide domain name resolution functionality for the end nodes. The end nodes are then configured to use the certified cloud host as the DNS server, thus pointing the DNS server to the certified cloud host. In other words, the file server does not provide DNS services; the role of the DNS server is placed locally on the certified cloud host client.

[0033] Therefore, end nodes can access the target file system based on the target Internet Protocol address (IPA address), using DNS services provided by the authenticated cloud host based on the mapping relationship between the file system's local domain name and the IPA address. This allows end nodes to access the file system using the local domain name corresponding to the target IPA address. In other words, end nodes only need to provide the target IPA address, not the corresponding domain name, to access the file system even under the constraints that end nodes are only allowed to access the file system via domain name and that the file system itself only supports IPA address-based access. In one embodiment, during the process of a terminal node accessing the target file system, the file server does not need to provide a domain name mount point to the terminal node, but only an Internet Protocol address mount point. This reduces the complexity of modification for existing cloud vendor products. Registering the file system's local domain name on the user side makes the file system more flexible to use. For scenarios where domain name access to the file system is mandatory, this provides a feasible method for accessing the file system based on Internet Protocol addresses, thus improving the product functionality of the file system.

[0034] In this embodiment, the shared name and Internet Protocol (IP) address of the file system are obtained through an authenticated cloud host. The file system includes a target file system. A local domain name is registered for the file system based on the shared name. The mapping relationship between the local domain name and the IP address of the file system is determined. Based on the target IP address and mapping relationship corresponding to the target file system, the terminal node is controlled to access the target file system based on the local domain name. This embodiment does not require the file system service provider to provide domain name access functionality, nor does it rely on an external DNS server. By registering a local domain name for the file system based on the shared name on the authenticated cloud host and deploying the DNS server role in the authenticated cloud host, the mapping relationship between the local domain name and the IP address of the file system is established. Based on the target IP address corresponding to the target file system and this mapping relationship, the terminal node can access the target file system using the local domain name corresponding to the target file system even if it does not use the domain name-based access method. Therefore, even under the constraints that the terminal node is only allowed to access the file system via domain name and the file system itself only supports IP address-based access, the terminal node can still effectively access the file system using the IP address-based access mechanism. This not only improves the convenience and experience of the user but also expands the functional applicability of the file system.

[0035] Optionally, step 101 includes: Obtain the universally unique identifier and tenant identifier of the file system; The shared name of the file system is obtained by concatenating the universally unique identifier and the tenant identifier; Step 102 includes: Obtain the domain name of the certified cloud host corresponding to the certified cloud host; The local domain name of the file system is obtained by concatenating the shared name as a prefix and the certified cloud host domain name as a suffix.

[0036] In this embodiment, the shared name of the file system, share_name, can be formed by concatenating the universally unique identifier (UUID) of the file system and the tenant identifier, thus ensuring the uniqueness of the shared name of the file system. Here, the tenant is the user's account on the public cloud.

[0037] When registering a local domain name for a file system on an authenticated cloud host, you can use the file system's shared name (share_name) as a prefix and the authenticated cloud host's domain name as a suffix to form a network domain name address. This local domain name is unique. For example, if the authenticated cloud host's domain name is example.com, then the local domain name for this file system is share_name.example.com.

[0038] This application embodiment determines a unique shared name for the file system through the file system's universal unique identifier and tenant identifier. Based on the file system's unique shared name and the domain name of the certified cloud host corresponding to the certified cloud host, the local domain name of the file system is further determined, thereby enabling the registration of a local domain name for the file system on the certified cloud host. The local domain name can be used by the terminal node to access the file system using the Internet Protocol address-based access mechanism, under the constraint that the terminal node is only allowed to access the file system through the domain name and the file system itself only supports access based on the IP address.

[0039] Optionally, step 104 includes: Receive the access request containing the target Internet Protocol address sent by the terminal node; The target local domain name corresponding to the target Internet Protocol address is determined according to the mapping relationship, and the target local domain name corresponds to the target file system; The target local domain name is returned to the terminal node so that the terminal node can access the target file system based on the target local domain name.

[0040] In this embodiment of the application, since the terminal node is only allowed to access the file system through the domain name, but the file system itself only supports access based on the IP address, and the terminal node only holds the target Internet Protocol address of the target file system, the terminal node needs to communicate with the certified cloud host to obtain the target local domain name of the target file system before it can access the file system.

[0041] Specifically, since the user's cloud host is configured to use the certified cloud host as the DNS server, when a tenant needs to access the target file system, the certified cloud host receives the access request containing the target Internet Protocol address sent by the terminal node, and determines the target local domain name corresponding to the target Internet Protocol address according to the mapping relationship. The target local domain name corresponds to the target file system, thereby determining the target local domain name of the access request sent by the terminal node for the target file system.

[0042] The certified cloud host returns an authorization certificate to the end node, which contains the target local domain name. The end node sends a mount request to the file server, carrying the local domain name of the target file system. After the mount request is responded to, the end node can access the target file system of CIFS by mounting it using the domain name. The mount format can be [share_name.example.com / share_name] (i.e., [target file system local domain name / target file system share name]).

[0043] In this embodiment of the application, when the terminal node is only allowed to access the file system via a domain name, but the file system itself only supports access based on IP address, and the terminal node only holds the target Internet Protocol address of the target file system, the terminal node can communicate with the certified cloud host to obtain the target local domain name of the target file system, and then use the target local domain name to mount and access the target file system. This not only improves the convenience and experience of users, but also expands the functional scope of the file system.

[0044] Optionally, the certified cloud host has a domain name resolution service, and determining the target local domain name corresponding to the target Internet Protocol address according to the mapping relationship includes: Using the domain name resolution service, based on the target Internet Protocol address and the mapping relationship, it is determined whether a corresponding local domain name exists for the target Internet Protocol address; If the target Internet Protocol address has a corresponding local domain name, then the local domain name corresponding to the target Internet Protocol address shall be used as the target local domain name.

[0045] In this embodiment, the role of the DNS server is placed within the authentication cloud host. In one embodiment, the DNS server IP address can be set to the IP address of the authentication cloud host in the Windows network adapter of the terminal node, thereby placing the DNS server role within the authentication cloud host.

[0046] Authorization is a standard procedure in the Kerberos protocol. It requires authorization from an authentication cloud host for the end node to obtain the target local domain name. After the end node sends an access request containing the target Internet Protocol address to the authentication cloud host, the authentication cloud host uses a domain name resolution service to determine whether a corresponding local domain name exists for the target Internet Protocol address, i.e., whether the target file system corresponding to the target Internet Protocol address has registered a local domain name. Only if the target file system has registered a local domain name is the target file system considered a valid member, and the corresponding target local domain name can be provided for the end node to access the target file system.

[0047] If a corresponding local domain name exists for the target Internet Protocol address, then the local domain name corresponding to the target Internet Protocol address is used as the target local domain name. The authentication cloud host returns an authorization certificate including the target local domain name to the terminal node, thus completing the authorization of the terminal node.

[0048] In this embodiment, the authentication cloud platform determines whether the target file system corresponding to the target Internet Protocol address provided by the terminal node has a registered local domain name. Only when the target Internet Protocol address has a corresponding local domain name is the terminal node authorized, so that the terminal node can access the target file system based on the target local domain name.

[0049] Optionally, the access request has a corresponding request tenant identifier, the authenticated cloud host has a domain name resolution service, and after determining the target local domain name corresponding to the target Internet Protocol address according to the mapping relationship, the method further includes: Based on the request tenant identifier and the target local domain name, determine whether the tenant corresponding to the request tenant identifier has access rights; If the tenant corresponding to the requested tenant identifier has access rights, the target local domain name is returned to the terminal node so that the terminal node can access the target file system based on the target local domain name.

[0050] The authentication cloud host in this application embodiment can not only determine whether the target Internet Protocol address has a corresponding local domain name, but also authenticate the tenant to prevent the tenant from accidentally accessing the file system of other tenants, and determine whether the user corresponding to the tenant has the right to access the file system.

[0051] Specifically, after the endpoint sends an access request with a corresponding tenant identifier to the authentication cloud host, the authentication cloud host determines whether the tenant corresponding to the tenant identifier has permission to access the target file system based on the tenant identifier and the target local domain name of the target file system corresponding to the access request. Only when the tenant has permission to access the target file system does the authentication cloud host return an authorization certificate including the target local domain name to the endpoint, thus completing the authorization of the endpoint.

[0052] This application embodiment uses an authenticated cloud host to differentiate access permissions for different tenants to the file system, thereby denying access to unauthorized tenants, preventing tenants from accidentally accessing other tenants' file systems, and ensuring the security of the file system.

[0053] Optionally, the terminal node is communicatively connected to a file server, and the file system is deployed on the file server. After returning the target local domain name to the terminal node, the method further includes: Control the terminal node to send a mount request containing the target local domain name to the file server; If the file server verifies the target local domain name, it controls the terminal node to mount the target file system.

[0054] In some embodiments of this application, Samba and Kerberos components are started on the file server to monitor mount requests from terminal nodes.

[0055] After obtaining the target local domain name from the certified cloud host, the terminal node can send a mount request containing the target local domain name of the target file system to the file server. The file server then verifies the target local domain name, specifically determining whether the target local domain name in the mount request matches the local domain name corresponding to the target file system pre-stored on the file server. If the file server verifies the target local domain name, it allows the terminal node to mount the target file system, thus enabling the terminal node to mount the target file system.

[0056] In this embodiment of the application, when a terminal node requests to mount a target file system, the file server verifies the target local domain name in the mount request, thereby further ensuring the security of the file system.

[0057] Optionally, the file server stores a key table, which includes local domain names corresponding to the file systems that are allowed to be accessed. After the terminal node is controlled to send a mount request containing the target local domain name to the file server, the method further includes: The file server is controlled to verify the target local domain name based on the local domain name corresponding to the allowed file system. If the local domain name corresponding to the allowed file system contains the target local domain name, then the file server is deemed to have passed the verification of the target local domain name.

[0058] In this embodiment of the application, after registering a local domain name for the file system on the authentication cloud host, the local domain name of the file system [share_name.example.com] can also be used as the key (principal) on the authentication cloud host to create a key table for the file server, which is used for authentication when tenants mount the file.

[0059] In one embodiment, the encryption type of the key table is enforced to be AES-128 or AES-256. The purpose of using AES (Advanced Encryption Standard) is to ensure the uniqueness of the key in all cases. The function of the key table is to determine whether the target local domain name in the mount request sent by the terminal node matches the local domain name corresponding to the target file system pre-stored in the file server, thereby allowing only authorized tenants to access the target file system.

[0060] In one embodiment, after the key table is created on the authenticated cloud host, it can be uploaded to the file server for storage via the OpenAPI interface provided on the file server.

[0061] When the file server verifies the target local domain name, it compares the target local domain name in the mount request sent by the terminal node with the file domain names registered in the key table to determine whether the target local domain name in the mount request has a corresponding local domain name for an allowed file system in the key table. If the local domain name for an allowed file system contains the target local domain name, the file server determines that the verification of the target local domain name has passed.

[0062] In this embodiment of the application, the target local domain name in the mount request is verified based on the local domain name corresponding to the file system that is allowed to be accessed as recorded in the key table, thereby further ensuring the security of the file system.

[0063] To enable those skilled in the art to more clearly understand the file system access method shown in the embodiments of this application, the following describes... Figure 2 The system architecture of a file system access method shown in the embodiments of this application will be explained.

[0064] Reference Figure 2 This is a system architecture diagram of an embodiment of a file system access method according to this application.

[0065] like Figure 2 As shown, the system architecture of a file system access method according to an embodiment of this application includes a client KDC (i.e., an authentication cloud host), at least one cloud host (i.e., a terminal node), and a filesystem server (i.e., a file server).

[0066] In this context, the terminal node acts as a client for accessing the file system. It is configured to use an authenticated cloud host as the DNS server, thereby pointing the DNS server to the authenticated cloud host.

[0067] The certified cloud host can create a Principal (the local domain name of the file system) based on the certified cloud host domain name and the shared name of the file system, completing the registration of the local domain name. The certified cloud host can further create a key table for the Principal, using AES encryption. The key table is uploaded to the file server for storage and used for file server verification and authentication. DNS service is enabled on the certified cloud host to provide domain name resolution functionality for end nodes. To prevent tenants from accidentally accessing other tenants' file systems, the certified cloud host can also authenticate tenants upon receiving access requests, determining whether the user corresponding to the tenant has the necessary access permissions.

[0068] After creating a key table on the authenticated cloud host, it can be uploaded to the file server for storage via the OpenAPI interface provided on the file server. At least one Filesystem (FS) is deployed on the file server, and Samba and Kerberos components are started on the file server to monitor mount requests from endpoints. When an endpoint requests to mount a target file system, the file server authenticates the target local domain name in the mount request (i.e., authenticates the Principal) based on the key table. Only after successful verification is the mount request allowed to be mounted by the endpoint corresponding to the mount request.

[0069] In this embodiment, the shared name and Internet Protocol (IP) address of the file system are obtained through an authenticated cloud host. The file system includes a target file system. A local domain name is registered for the file system based on the shared name. The mapping relationship between the local domain name and the IP address of the file system is determined. Based on the target IP address and mapping relationship corresponding to the target file system, the terminal node is controlled to access the target file system based on the local domain name. This embodiment does not require the file system service provider to provide domain name access functionality, nor does it rely on an external DNS server. By registering a local domain name for the file system based on the shared name on the authenticated cloud host and deploying the DNS server role in the authenticated cloud host, the mapping relationship between the local domain name and the IP address of the file system is established. Based on the target IP address corresponding to the target file system and this mapping relationship, the terminal node can access the target file system using the local domain name corresponding to the target file system even if it does not use the domain name-based access method. Therefore, even under the constraints that the terminal node is only allowed to access the file system via domain name and the file system itself only supports IP address-based access, the terminal node can still effectively access the file system using the IP address-based access mechanism. This not only improves the convenience and experience of the user but also expands the functional applicability of the file system.

[0070] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of this application.

[0071] Based on the above embodiments, this embodiment also provides a file system access device, which is applied in electronic devices such as terminal devices and servers.

[0072] Reference Figure 3 This diagram illustrates a structural block diagram of an embodiment of a file system access device according to this application, applied to an authentication cloud host. The authentication cloud host is communicatively connected to a terminal node and may specifically include the following modules: The information acquisition module 301 is used to acquire the shared name and Internet Protocol address of the file system, wherein the file system includes the target file system; Domain name registration module 302 is used to register a local domain name for the file system based on the shared name; The relationship determination module 303 is used to determine the mapping relationship between the local domain name and the Internet Protocol address of the file system; The node access module 304 is used to control the terminal node to access the target file system based on the local domain name according to the target Internet Protocol address corresponding to the target file system and the mapping relationship.

[0073] Optionally, the information acquisition module 301 includes: The system information acquisition submodule is used to acquire the universally unique identifier and tenant identifier of the file system; The system information splicing submodule is used to splice the universally unique identifier and the tenant identifier to obtain the shared name of the file system; The domain name registration module 302 includes: The host domain name acquisition submodule is used to obtain the domain name of the certified cloud host corresponding to the certified cloud host; The local domain name registration submodule is used to concatenate the shared name as a prefix and the certified cloud host domain name as a suffix to obtain the local domain name of the file system.

[0074] Optionally, the node access module 304 includes: The access request receiving submodule is used to receive the access request containing the target Internet Protocol address sent by the terminal node; The local domain name determination submodule is used to determine the target local domain name corresponding to the target Internet Protocol address according to the mapping relationship, wherein the target local domain name corresponds to the target file system; The first local domain name response submodule is used to return the target local domain name to the terminal node, so that the terminal node can access the target file system based on the target local domain name.

[0075] Optionally, the certified cloud host has a domain name resolution service, and the local domain name determination submodule includes: The domain name resolution unit is used to determine, using the domain name resolution service, whether there is a corresponding local domain name for the target Internet Protocol address based on the target Internet Protocol address and the mapping relationship; The domain name determination unit is used to determine the target local domain name if the target Internet Protocol address has a corresponding local domain name.

[0076] Optionally, the access request has a corresponding tenant identifier, the authenticated cloud host has a domain name resolution service, and the node access module 304 further includes: The first verification submodule is used to determine whether the tenant corresponding to the request tenant identifier has access rights based on the request tenant identifier and the target local domain name; The second local domain name response submodule is used to return the target local domain name to the terminal node if the tenant corresponding to the requesting tenant identifier has access rights, so that the terminal node can access the target file system based on the target local domain name.

[0077] Optionally, the terminal node is communicatively connected to the file server, the file system is deployed on the file server, and the node access module 304 further includes: The mount request submodule is used to control the terminal node to send a mount request containing the target local domain name to the file server; The node mounting submodule is used to control the terminal node to mount the target file system if the file server verifies the target local domain name.

[0078] Optionally, the file server stores a key table, which includes local domain names corresponding to the file systems that are allowed to be accessed, and the node access module 304 further includes: The second verification submodule is used to control the file server to verify the target local domain name based on the local domain name corresponding to the allowed access file system; The domain name verification submodule is used to determine that the file server has passed the verification of the target local domain name if the local domain name corresponding to the allowed access file system contains the target local domain name.

[0079] In this embodiment, the shared name and Internet Protocol (IP) address of the file system are obtained through an authenticated cloud host. The file system includes a target file system. A local domain name is registered for the file system based on the shared name. The mapping relationship between the local domain name and the IP address of the file system is determined. Based on the target IP address and mapping relationship corresponding to the target file system, the terminal node is controlled to access the target file system based on the local domain name. This embodiment does not require the file system service provider to provide domain name access functionality, nor does it rely on an external DNS server. By registering a local domain name for the file system based on the shared name on the authenticated cloud host and deploying the DNS server role in the authenticated cloud host, the mapping relationship between the local domain name and the IP address of the file system is established. Based on the target IP address corresponding to the target file system and this mapping relationship, the terminal node can access the target file system using the local domain name corresponding to the target file system even if it does not use the domain name-based access method. Therefore, even under the constraints that the terminal node is only allowed to access the file system via domain name and the file system itself only supports IP address-based access, the terminal node can still effectively access the file system using the IP address-based access mechanism. This not only improves the convenience and experience of the user but also expands the functional applicability of the file system.

[0080] This application also provides a non-volatile readable storage medium storing one or more modules (programs). When these modules are applied to a device, they enable the device to execute the instructions for the method steps in this application.

[0081] This application provides one or more machine-readable media storing instructions that, when executed by one or more processors, cause an electronic device to perform one or more of the methods described in the above embodiments. In this application, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0082] The embodiments of this disclosure can be implemented as an apparatus configured as desired using any suitable hardware, firmware, software, or any combination thereof, including electronic devices such as terminal devices, servers (clusters), etc. Figure 4 An exemplary apparatus 400 is schematically shown that can be used to implement the various embodiments described in this application.

[0083] In one embodiment, Figure 4An exemplary device 400 is shown, which includes one or more processors 402, a control module (chipset) 404 coupled to at least one of the processors 402, a memory 406 coupled to the control module 404, a non-volatile memory (NVM) / storage device 408 coupled to the control module 404, one or more input / output devices 410 coupled to the control module 404, and a network interface 412 coupled to the control module 404.

[0084] Processor 402 may include one or more single-core or multi-core processors, and processor 402 may include any combination of general-purpose processors or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, device 400 can serve as a terminal device, server (cluster), or other device as described in the embodiments of this application.

[0085] In some embodiments, apparatus 400 may include one or more computer-readable media (e.g., memory 406 or NVM / storage device 408) having instructions 414 and one or more processors 402 that are combined with the one or more computer-readable media and configured to execute instructions 414 to implement a module thereby performing the actions described in this disclosure.

[0086] In one embodiment, the control module 404 may include any suitable interface controller to provide any suitable interface to at least one of the processors 402 and / or any suitable device or component communicating with the control module 404.

[0087] The control module 404 may include a memory controller module to provide an interface to the memory 406. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0088] Memory 406 may be used, for example, to load and store data and / or instructions 414 for device 400. In one embodiment, memory 406 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, memory 406 may include double data rate type quad synchronous dynamic random access memory (DDR4 SDRAM).

[0089] In one embodiment, the control module 404 may include one or more input / output controllers to provide an interface to the NVM / storage device 408 and (one or more) input / output devices 410.

[0090] For example, NVM / storage device 408 may be used to store data and / or instructions 414. NVM / storage device 408 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drive (HDD), one or more optical disc (CD) drives, and / or one or more digital universal optical disc (DVD) drives).

[0091] NVM / storage device 408 may include storage resources that are physically part of a device on which device 400 is mounted, or that are accessible to the device but do not necessarily have to be part of the device. For example, NVM / storage device 408 may be accessed via a network via one or more input / output devices 410.

[0092] One or more input / output devices 410 may provide an interface for device 400 to communicate with any other suitable device. Input / output devices 410 may include communication components, audio components, sensor components, etc. A network interface 412 may provide an interface for device 400 to communicate via one or more networks. Device 400 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, such as accessing wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G, 5G, etc., or combinations thereof.

[0093] In one embodiment, at least one of the processors 402 may be logically packaged with one or more controllers (e.g., memory controller modules) of the control module 404. In one embodiment, at least one of the processors 402 may be logically packaged with one or more controllers of the control module 404 to form a system-in-package (SiP). In one embodiment, at least one of the processors 402 may be integrated with the logic of one or more controllers of the control module 404 on the same die. In one embodiment, at least one of the processors 402 may be integrated with the logic of one or more controllers of the control module 404 on the same die to form a system-on-a-chip (SoC).

[0094] In various embodiments, device 400 may be, but is not limited to, a server, desktop computing device, or mobile computing device (e.g., laptop computing device, handheld computing device, tablet computer, netbook, etc.). In various embodiments, device 400 may have more or fewer components and / or different architectures. For example, in some embodiments, device 400 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0095] The detection device can use a main control chip as a processor or control module, and sensor data, position information, etc. can be stored in a memory or NVM / storage device. The sensor group can be used as an input / output device, and the communication interface can include a network interface.

[0096] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0097] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0098] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable file system access terminal device to produce a machine, such that the instructions, which execute through the processor of the computer or other programmable file system access terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0099] These computer program instructions may also be stored in a computer-readable storage medium that can guide a computer or other programmable file system access terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable file system access terminal device, causing a series of operational steps to be performed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0101] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0102] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0103] The foregoing has provided a detailed description of a file system access method and apparatus, an electronic device, and a storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for accessing a file system, characterized in that, Applied to an authentication cloud host, wherein the authentication cloud host is communicatively connected to a terminal node, the method includes: Obtain the shared name and Internet Protocol address of the file system, including the target file system; Register a local domain name for the file system based on the shared name; Determine the mapping relationship between the local domain name and the Internet Protocol address in the file system; Based on the target Internet Protocol address corresponding to the target file system and the mapping relationship, the terminal node is controlled to access the target file system based on the local domain name.

2. The method according to claim 1, characterized in that, The process of obtaining the shared name of the file system includes: Obtain the universally unique identifier and tenant identifier of the file system; The shared name of the file system is obtained by concatenating the universally unique identifier and the tenant identifier; Registering a local domain name for the file system based on the shared name includes: Obtain the domain name of the certified cloud host corresponding to the certified cloud host; The local domain name of the file system is obtained by concatenating the shared name as a prefix and the certified cloud host domain name as a suffix.

3. The method according to claim 1, characterized in that, The step of controlling the terminal node to access the target file system based on the local domain name according to the target Internet Protocol address corresponding to the target file system and the mapping relationship includes: Receive the access request containing the target Internet Protocol address sent by the terminal node; The target local domain name corresponding to the target Internet Protocol address is determined according to the mapping relationship, and the target local domain name corresponds to the target file system; The target local domain name is returned to the terminal node so that the terminal node can access the target file system based on the target local domain name.

4. The method according to claim 3, characterized in that, The certified cloud host has a domain name resolution service. Determining the target local domain name corresponding to the target Internet Protocol address based on the mapping relationship includes: Using the domain name resolution service, based on the target Internet Protocol address and the mapping relationship, it is determined whether a corresponding local domain name exists for the target Internet Protocol address; If the target Internet Protocol address has a corresponding local domain name, then the local domain name corresponding to the target Internet Protocol address shall be used as the target local domain name.

5. The method according to claim 3, characterized in that, The access request has a corresponding request tenant identifier. The authenticated cloud host has a domain name resolution service. After determining the target local domain name corresponding to the target Internet Protocol address based on the mapping relationship, the method further includes: Based on the request tenant identifier and the target local domain name, determine whether the tenant corresponding to the request tenant identifier has access rights; If the tenant corresponding to the requested tenant identifier has access rights, the target local domain name is returned to the terminal node so that the terminal node can access the target file system based on the target local domain name.

6. The method according to claim 3, characterized in that, The terminal node is communicatively connected to the file server, and the file system is deployed on the file server. After returning the target local domain name to the terminal node, the method further includes: Control the terminal node to send a mount request containing the target local domain name to the file server; If the file server verifies the target local domain name, it controls the terminal node to mount the target file system.

7. The method according to claim 6, characterized in that, The file server stores a key table, which includes local domain names corresponding to the file systems that are allowed to be accessed. After the terminal node sends a mount request containing the target local domain name to the file server, the method further includes: The file server is controlled to verify the target local domain name based on the local domain name corresponding to the allowed file system. If the local domain name corresponding to the allowed file system contains the target local domain name, then the file server is deemed to have passed the verification of the target local domain name.

8. A file system access device, characterized in that, The device is applied to an authentication cloud host, which is communicatively connected to a terminal node, and includes: The information acquisition module is used to acquire the shared name and Internet Protocol address of the file system, wherein the file system includes the target file system; The domain name registration module is used to register a local domain name for the file system based on the shared name; A relationship determination module is used to determine the mapping relationship between the local domain name and the Internet Protocol address of the file system; The node access module is used to control the terminal node to access the target file system based on the local domain name, according to the target Internet Protocol address corresponding to the target file system and the mapping relationship.

9. An electronic device, characterized in that, include: processor; and A memory having executable code stored thereon, which, when executed, causes the processor to perform the file system access method as described in any one of claims 1-7.

10. A machine-readable medium having executable code stored thereon, which, when executed, causes a processor to perform a file system access method as described in any one of claims 1-7.

Images