A node installation period temporary isolation network closed-loop method based on linkage of DPU and BMC

Abstract

The application discloses a kind of node installation period temporary isolation network closed loop method based on DPU and BMC linkage, it is related to computer system safety management technical field, including, DPU creates installation isolation environment according to node installation task sheet, and node vNIC is accessed installation isolation environment, then start node installation process and block unauthorized access request, form temporary isolation state record;DPU obtains installation running state according to temporary isolation state record and carries out node marking and time sequence collection, forms installation running side state record;BMC obtains platform management side state according to node installation task sheet and carries out node marking and time sequence collection, forms platform management side state record;DPU carries out node corresponding association to installation running side state record and platform management side state record, obtains two-side installation evidence chain.The application realizes that DPU side installation running state and BMC side platform management state are under the joint representation of same to-be-installed node.

Description

Technical Field

[0001] This invention relates to the field of computer system security management technology, and in particular to a method for temporary isolation of a network during node installation based on the linkage of DPU and BMC. Background Technology

[0002] With the development of cloud computing data centers, automated deployment of bare metal servers, DPU forwarding and offloading, and BMC out-of-band management technologies, access control during node installation has gradually evolved from relying on manual network activation and static isolation strategies to an automated installation control method based on virtual interface orchestration, installation isolation environment establishment, and out-of-band status collection. Existing technologies typically utilize the BMC to collect the power-on status, firmware startup status, installation media mounting status, and installation completion reporting status of the node to be installed. The DPU then controls access to the node vNIC, installation isolation environment, and target service VLAN, placing the node in a temporary isolated state during installation and switching it back to the target service VLAN upon completion.

[0003] However, existing technologies still have shortcomings: First, they focus on single-sided installation completion reports or single management status confirmations, making it difficult to correlate the installation and operation status on the DPU side with the platform management status on the BMC side through node correspondence, timing pairing, and evidence classification, resulting in insufficient reliability of installation completion determination. Second, existing technologies typically handle installation isolation, node vNIC back-switching, and service connectivity verification separately, making it difficult to transform installation completion criteria, back-switching transactions, service connectivity verification markers, and evidence status markers into a unified and traceable closed-loop processing process. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a closed-loop method for temporary isolation of the network during node installation based on the linkage of DPU and BMC, which solves the problems of insufficient reliability in determining the completion of installation and lack of closed-loop records in the handling of back-switch anomalies in the prior art.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] This invention provides a closed-loop method for temporary network isolation during node installation based on the linkage of DPU and BMC. The method includes: extracting the node to be installed, node vNIC, target service VLAN, and installation completion criteria from the system installation request through the BMC, and arranging them according to the node installation process to generate a node installation task sheet; the DPU creating an installation isolation environment based on the node installation task sheet, connecting the node vNIC to the installation isolation environment, starting the node installation process, and blocking unauthorized access requests to form a temporary isolation status record; the DPU obtaining the installation and operation status based on the temporary isolation status record and performing node marking and time series aggregation to form an installation and operation side status record; and the BMC obtaining the platform management side status based on the node installation task sheet and performing node marking and time series aggregation. The system first collects and aggregates the data to form a platform management-side status record. The DPU then associates the installation and operation-side status records with the platform management-side status records to obtain a dual-side installation evidence chain. The DPU then performs a consistency check on the dual-side installation evidence chain against the installation completion criteria, generating an evidence status marker. When the evidence status marker is marked as "failed," the installation isolation environment is maintained, and the reason for failure is written into the review entry. When the evidence status marker is marked as "passed," a node installation rollback transaction is created, and the installation process is stopped and the transaction status is registered, forming a node installation rollback transaction record. Based on the node installation rollback transaction record, connectivity verification is performed on the target service VLAN to obtain a service connectivity verification marker. Combined with the evidence status marker, the rollback closed-loop handling method is determined, forming an isolation closed-loop record.

[0008] As a preferred embodiment of the node installation temporary isolation network closed-loop method based on DPU and BMC linkage described in this invention, the specific steps for generating the node installation task sheet are as follows:

[0009] BMC receives the system installation request and performs format and source verification on the system installation request to obtain a valid system installation request;

[0010] Extract the node to be installed, node vNIC, target service VLAN, and installation completion criteria from the valid system installation request, and organize them according to the node to be installed to obtain the corresponding entries for node installation;

[0011] Based on the corresponding entries for node installation, the consistency of the node to be installed, node vNIC, target service VLAN, and installation completion criteria is checked, and the entries are arranged according to the installation order of the nodes to be installed to generate a node installation task sheet.

[0012] As a preferred embodiment of the node installation-period temporary isolation network closed-loop method based on DPU and BMC linkage described in this invention, the specific steps for forming the temporary isolation state record are as follows:

[0013] The DPU queries the current VLAN occupancy status based on the node installation task sheet, selects the unoccupied VLAN identifier as the installation isolation environment identifier, and creates the installation isolation environment based on the installation isolation environment identifier.

[0014] The DPU locates the DPU-side forwarding port corresponding to the node vNIC and performs installation isolation environment attribution configuration on the DPU-side forwarding port to form a temporary access record for the node vNIC.

[0015] Based on the node vNIC temporary access record, the node installation process for the installation isolation environment is started, and the installation access path and unauthorized blocking rules within the installation isolation environment are set. The node installation process start flag and unauthorized blocking flag are generated and associated with the corresponding nodes to be installed and time-series aggregated to form a temporary isolation status record.

[0016] As a preferred embodiment of the node installation-period temporary isolation network closed-loop method based on DPU and BMC linkage described in this invention, the specific steps for forming the installation and operation side status record are as follows:

[0017] Based on the temporary isolation status record, the DPU maps the installation isolation environment and the DPU-side forwarding port to the same node to be installed, thus obtaining the installation network collection range.

[0018] Based on the installation network collection range, the node installation process access status, node vNIC forwarding status and installation completion report status are collected and grouped into installation running status. Then, the installation running status is marked according to the node to be installed to obtain the node status group.

[0019] The installation and operation status of the node status group are arranged chronologically according to the collection time to form an installation network chronological status group. This group is then registered with the node to be installed, the node vNIC, the installation isolation environment, and the collection time to form an installation and operation side status record.

[0020] As a preferred embodiment of the node installation-period temporary isolation network closed-loop method based on DPU and BMC linkage described in this invention, the specific steps for forming the platform management side status record are as follows:

[0021] BMC determines the out-of-band management channel for accessing the node to be installed based on the node installation task sheet, and then collects the power-on status, firmware-on status, installation media mounting status and installation completion reporting status of the node to be installed based on the out-of-band management channel and merges them into the platform management side status.

[0022] The platform management status collected from the nodes to be installed is marked to form a platform management status group. The platform management status group is then time-series aggregated according to the collection time in the platform management status group, and then written into the status record corresponding to the node to be installed to form a platform management status record.

[0023] As a preferred embodiment of the node installation temporary isolation network closed-loop method based on DPU and BMC linkage described in this invention, the specific steps for obtaining the dual-sided installation evidence chain are as follows:

[0024] The DPU uses the node to be installed in the installation and operation side status record as the associated object, determines the installation network status group corresponding to the node to be installed, and locates the platform management status group corresponding to the same node to be installed in the platform management side status record to form a node association group.

[0025] Within the same node association group, time sequence pairing is performed based on the state recording time of the node association group. The installation and operation state and the platform management side state with the closest recording time are combined into a two-sided state pair, and the two-sided evidence time sequence deviation value between the installation and operation state and the platform management side state is calculated.

[0026] Based on the state type, the two-sided state pairs are classified into start-up preparation evidence, installation execution evidence, and installation completion evidence, and evidence classification labels are obtained. Then, the time sequence deviation values ​​of the two-sided evidence are written into the corresponding evidence to obtain the two-sided installation evidence chain.

[0027] As a preferred embodiment of the node installation temporary isolation network closed-loop method based on DPU and BMC linkage described in this invention, the specific steps for creating the node installation rollback transaction are as follows:

[0028] The DPU verifies the bilateral status pairs and evidence classification markers item by item along the bilateral installation evidence chain, matches the initiation preparation evidence, installation execution evidence, and installation completion evidence to the corresponding criterion items, and forms evidence status markers based on the criterion coverage, evidence arrangement order, and bilateral status consistency.

[0029] When the evidence status is marked as failed, the corresponding two-sided status pair, evidence classification mark, and failure reason mark are written into the review entry and kept in the installation isolation environment;

[0030] When the evidence status is marked as passed, the node to be installed, the node vNIC, the installation isolation environment, the target service VLAN, and the two-sided installation evidence chain are written into the same transaction entry, and a node installation rollback transaction is created.

[0031] As a preferred embodiment of the node installation temporary isolation network closed-loop method based on DPU and BMC linkage described in this invention, the specific steps for forming the node installation switchback transaction record are as follows:

[0032] The DPU stops the installation access path in the installation isolation environment based on the node installation rollback transaction, thus forming an installation access stop state.

[0033] Based on the installation access stop status and according to the back-off target in the node installation back-off transaction, the DPU-side forwarding port corresponding to the node vNIC is switched from the installation isolation environment to the target service VLAN, and the port affiliation relationship between the node vNIC and the installation isolation environment is removed. The integrity of the node installation back-off transaction is calculated.

[0034] Write the node installation rollback transaction integrity, installation access stop flag, service VLAN access flag, and execution status after removing port affiliation into the same record in the execution order to form the node installation rollback transaction record.

[0035] As a preferred embodiment of the node installation-period temporary isolation network closed-loop method based on DPU and BMC linkage described in this invention, the specific steps for obtaining the service connectivity verification mark are as follows:

[0036] The DPU checks the installation access stop flag and the service VLAN access flag in the node installation switchback transaction record and determines that the node vNIC has switched back from the installation isolation environment to the target service VLAN.

[0037] Using the DPU-side forwarding port corresponding to the node vNIC as the verification message sending port, the target service VLAN identifier, the DPU-side forwarding port identifier, and the verification message sending time are encapsulated into a runtime reachability probe request.

[0038] The DPU-side forwarding port corresponding to the node vNIC sends an operational reachability probe request to the target service VLAN, and calculates the service link connectivity credibility based on the operational environment affiliation, return port, and return time limit of the service link response message. When the service link connectivity credibility reaches the preset connectivity threshold, a service connectivity verification mark is generated.

[0039] As a preferred embodiment of the temporary isolation network closed-loop method for node installation based on DPU and BMC linkage described in this invention, the specific steps for forming the isolation closed-loop record are as follows:

[0040] The DPU writes the business connectivity verification flag and evidence status flag corresponding to the same node to be installed into the closed-loop processing field to form a node installation back-off transaction record;

[0041] Priority matching is performed on the evidence status marker and the service connectivity verification marker in the installation back-off transaction record of the node to be processed. The processing item is determined according to the order that the evidence status marker takes precedence over the service connectivity verification marker, and the processing item is used as the back-off closed-loop processing method for the installation back-off transaction record of the node to be processed.

[0042] According to the closed-loop handling method, select the corresponding handling action from transaction commit, transaction abort, isolation maintenance and BMC diagnostic channel retention handling and execute it. Then, install the closed-loop transaction record on the node to be handled after handling to register the closed-loop status and form an isolation closed-loop record.

[0043] The beneficial effects of this invention are as follows: By associating the installation and operation status records and the platform management status records with corresponding nodes, matching time sequences, and classifying evidence, the joint representation of the DPU-side installation and operation status and the BMC-side platform management status under the same node to be installed is achieved. This improves the reliability of installation completion determination and reduces the risk of node false back-switch caused by false alarms on one side. Through closed-loop processing based on the consistency determination of the dual-side installation evidence chain, node installation back-switch transaction records, and service connectivity verification markers, the sequential linkage of installation evidence verification, installation process stoppage, node vNIC back-switch, target service VLAN connectivity verification, and anomaly isolation is achieved. This prevents abnormal nodes from entering the service network, improves back-switch security, and enhances the traceability of installation anomaly diagnosis. Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart of a temporary isolation network closed-loop method during node installation based on the linkage of DPU and BMC.

[0046] Figure 2 A flowchart for creating a temporary isolation status record.

[0047] Figure 3 A flowchart for obtaining the evidence chain on both sides.

[0048] Figure 4 A flowchart for creating an isolated closed-loop record. Detailed Implementation

[0049] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0050] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0051] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0052] Reference Figures 1-4 This is one embodiment of the present invention, which provides a method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage, including the following steps:

[0053] S1. Extract the node to be installed, node vNIC, target service VLAN and installation completion criteria from the system installation request through BMC, and arrange them accordingly according to the node installation process to generate a node installation task sheet.

[0054] BMC receives the system installation request and performs format and source verification on the system installation request to obtain a valid system installation request.

[0055] The specific process includes: BMC receives system installation requests and, according to the record order when the system installation request enters the node installation process, performs format validation on the request structure, request fields, field value formats, and field arrangement relationships in the system installation request to determine whether the system installation request is parsable and can continue processing. Then, it performs source validation on the source identifier, source channel, and request generation time in the system installation request to determine whether the system installation request is the source of the node installation process. When a system installation request has missing request structure, incomplete request fields, field value formats that do not meet parsing requirements, field arrangement relationships that do not meet processing order, or source information that fails validation, BMC will exclude the corresponding system installation request. When a system installation request passes format and source validation, BMC marks the corresponding system installation request as valid, thus obtaining a valid system installation request.

[0056] Extract the node to be installed, node vNIC, target service VLAN, and installation completion criteria from the valid system installation request, and organize them according to the node to be installed to obtain the corresponding entries for node installation.

[0057] The specific process includes: the BMC extracts the node to be installed, node vNIC, target service VLAN, and installation completion criteria from valid system installation requests according to the request record order; and, taking the node to be installed as the sorting object, it aggregates the node vNIC, target service VLAN, and installation completion criteria corresponding to the same node to be installed, so that each node to be installed corresponds to a clear virtual interface, switchback target, and installation completion judgment criterion; after completing the aggregation, the BMC registers the extracted content corresponding to each node to be installed item by item, and writes the registered content into the same installation sorting record according to the node to be installed, thus obtaining the corresponding entry for node installation.

[0058] Based on the corresponding entries for node installation, the consistency of the node to be installed, node vNIC, target service VLAN, and installation completion criteria is checked, and the entries are arranged according to the installation order of the nodes to be installed to generate a node installation task sheet.

[0059] The specific process includes: the BMC uses the node to be installed as the verification object, and performs consistency verification on the node to be installed, node vNIC, target service VLAN, and installation completion criteria in the corresponding entry for the same node installation. It determines whether the node vNIC can be used as a virtual interface of the node to be installed in the installation process, whether the target service VLAN can be used as the access target after the node to be installed is installed, and whether the installation completion criteria can be used to confirm the installation completion of the node to be installed. When any content cannot be matched with the node to be installed, the BMC marks the corresponding node installation entry as an abnormal entry. When the node installation entry passes the consistency verification, the BMC arranges the corresponding entries for each node installation according to the installation order of the nodes to be installed, and writes the arranged corresponding entries for each node installation into the same task record to generate a node installation task sheet.

[0060] S2 and DPU create an installation isolation environment based on the node installation task sheet, connect the node vNIC to the installation isolation environment, start the node installation process, and block unauthorized access requests, thus forming a temporary isolation state record.

[0061] The DPU queries the current VLAN occupancy status based on the node installation task sheet, selects the unoccupied VLAN identifier as the installation isolation environment identifier, and creates the installation isolation environment based on the installation isolation environment identifier.

[0062] The specific process includes: the DPU determines the node to be installed that needs to be isolated based on the node installation task sheet, and queries the current VLAN occupancy status based on the node installation task sheet. From the current VLAN occupancy status, it distinguishes between occupied VLANs and unoccupied VLANs, excludes VLANs occupied by business communication, management communication and other installation tasks, and retains unoccupied VLANs that can be used for temporary isolation. After completing the occupancy status query, the DPU selects a VLAN from the unoccupied VLANs to carry the installation process of the node to be installed, and registers the selected unoccupied VLAN as the installation isolation environment identifier. Then, the installation isolation environment is established based on the installation isolation environment identifier.

[0063] The DPU locates the DPU-side forwarding port corresponding to the node vNIC and performs installation isolation environment attribution configuration on the DPU-side forwarding port to form a temporary access record for the node vNIC.

[0064] The specific process includes: the DPU determines the node vNIC that needs to be connected to the installation isolation environment based on the node installation task sheet, and finds the forwarding port corresponding to the node vNIC on the DPU side to determine the DPU-side forwarding port used to carry the node vNIC installation access traffic; after completing the port location, the DPU writes the installation isolation environment identifier into the DPU-side forwarding port's home configuration, so that the DPU-side forwarding port changes from the original access state to the access state under the installation isolation environment, and then registers the node vNIC, DPU-side forwarding port, installation isolation environment identifier and home configuration completion status accordingly to form a node vNIC temporary access record.

[0065] Based on the node vNIC temporary access record, the node installation process for the installation isolation environment is started, and the installation access path and unauthorized blocking rules within the installation isolation environment are set. The node installation process start flag and unauthorized blocking flag are generated and associated with the corresponding nodes to be installed and time-series aggregated to form a temporary isolation status record.

[0066] The specific process includes: the DPU, based on the node vNIC temporary access record, restricts the installation access traffic of the node to be installed to the installation isolation environment, and starts the node installation process for the node to be installed within the installation isolation environment as the operating scope. The node installation process enters the installation isolation environment through the node vNIC and the DPU-side forwarding port to perform installation access. After the node installation process starts, the DPU sets the installation access path according to the node vNIC, DPU-side forwarding port and installation isolation environment identifier already registered in the node vNIC temporary access record, so that the installation access request enters the installation isolation environment along the DPU-side forwarding port corresponding to the node vNIC.

[0067] The DPU sets unauthorized blocking rules based on the installation access path, blocking access requests that do not conform to the installation access path, do not correspond to the node vNIC, or do not belong to the installation isolation environment. It writes the node installation process startup status to the node installation process startup flag and the unauthorized access request blocking status to the unauthorized blocking flag. It associates the node installation process startup flag, unauthorized blocking flag, node vNIC, DPU-side forwarding port, and installation isolation environment identifier with the node to be installed, and collects them in time sequence according to the generation time to form a temporary isolation status record.

[0068] It should be noted that the installation access path is set based on the node to be installed, the node vNIC, the DPU-side forwarding port, and the installation isolation environment identifier in the node vNIC temporary access record, as well as the record status of the node vNIC already connected to the installation isolation environment. It is used to limit the transmission direction, transmission range, and access boundary of the installation access request issued by the node installation process between the node vNIC, the DPU-side forwarding port, and the installation isolation environment. The unauthorized blocking rule is set based on the correspondence between the installation access path, the node vNIC and the DPU-side forwarding port, and the affiliation between the DPU-side forwarding port and the installation isolation environment identifier. It is used to determine whether the access request conforms to the installation access path, whether it corresponds to the node vNIC, and whether it belongs to the installation isolation environment, and to block access requests that do not conform to the correspondence and affiliation.

[0069] S3 and DPU obtain the installation and operation status based on the temporary isolation status record and perform node marking and time sequence aggregation to form the installation and operation side status record; BMC obtains the platform management side status based on the node installation task sheet and performs node marking and time sequence aggregation to form the platform management side status record; DPU performs node correspondence association between the installation and operation side status record and the platform management side status record to obtain the dual-side installation evidence chain.

[0070] Based on the temporary isolation status record, the DPU maps the installation isolation environment and the DPU-side forwarding port to the same node to be installed, thus obtaining the installation network collection range.

[0071] The specific process includes: the DPU determines whether the current node to be installed is in the installation isolation state based on the temporary isolation state record; then, based on the installation isolation environment identifier and DPU-side forwarding port registered in the temporary isolation state record, it confirms whether the installation isolation environment and DPU-side forwarding port correspond to the same node to be installed; after confirmation, the DPU uses the installation isolation environment as the environment collection boundary for the installation process running status and the DPU-side forwarding port as the port collection boundary for the node vNIC forwarding status, so that the subsequent collection of node installation process access status, node vNIC forwarding status, and installation completion report status is limited to the temporary installation isolation range of the same node to be installed, thus obtaining the installation network collection range.

[0072] Based on the installation network collection scope, the node installation process access status, node vNIC forwarding status, and installation completion report status within the installation isolation environment are collected and grouped into installation running status. Then, the installation running status is marked according to the node to be installed to obtain the node status group.

[0073] The specific process includes: the DPU determines the installation isolation environment and DPU-side forwarding port to be collected based on the installation network collection range, and uses the installation isolation environment as the collection location for the node installation process access status, and the DPU-side forwarding port as the collection location for the node vNIC forwarding status; the DPU collects the node installation process access status within the installation isolation environment to determine whether the node installation process is accessing along the installation access path, and collects the node vNIC forwarding status at the DPU-side forwarding port to determine whether the node vNIC is maintaining forwarding within the installation isolation environment, and simultaneously collects the installation completion report status to determine whether the node installation process has generated an installation completion report; the DPU merges the node installation process access status, node vNIC forwarding status, and installation completion report status according to the collection object and collection time to form the installation running status, and writes the installation running status to the corresponding node to be installed to obtain the node status group.

[0074] The installation and operation status of the node status group are arranged chronologically according to the collection time to form an installation network chronological status group. This group is then registered with the node to be installed, the node vNIC, the installation isolation environment, and the collection time to form an installation and operation side status record.

[0075] The specific process includes arranging the installation and operation statuses of nodes that have been marked in the node status group according to the collection time, so that the node installation process access status, node vNIC forwarding status, and installation completion report status can form a continuous time sequence under the same node to be installed; after completing the time sequence arrangement, the DPU organizes the installation and operation statuses under the same node to be installed into an installation network time sequence status group, and registers each installation and operation status in the installation network time sequence status group with the node to be installed, node vNIC, installation isolation environment, and collection time, so that each installation and operation status has a node source, interface source, isolation environment source, and time source, forming an installation and operation side status record.

[0076] Based on the node installation task sheet, BMC determines the out-of-band management channel for accessing the node to be installed, and then collects the power-on status, firmware startup status, installation media mounting status, and installation completion reporting status of the node to be installed based on the out-of-band management channel, and merges them into the platform management side status.

[0077] The specific process includes: BMC determines the out-of-band management channel that can perform out-of-band management access to the node to be installed based on the registration information of the node to be installed in the node installation task sheet, and collects the status of the node to be installed during the startup and installation process through the out-of-band management channel, obtaining the power startup status, firmware startup status, installation media mounting status and installation completion reporting status of the node to be installed; BMC aggregates the power startup status, firmware startup status, installation media mounting status and installation completion reporting status collected under the same node to be installed according to the collection source and collection time to form the platform management side status.

[0078] The platform management status collected from the nodes to be installed is marked to form a platform management status group. The platform management status group is then time-series aggregated according to the collection time in the platform management status group, and then written into the status record corresponding to the node to be installed to form a platform management status record.

[0079] The specific process includes: BMC uses the nodes to be installed as the sorting object, and marks the power-on status, firmware-on status, installation media mounting status, and installation completion reporting status corresponding to the same node to be installed, so that the collected platform management side status belongs to the corresponding node to be installed. Then, the platform management side status under the same node to be installed is grouped into a platform management status group, so that the power-on status, firmware-on status, installation media mounting status, and installation completion reporting status are not scattered. BMC arranges the platform management status groups in order of collection time according to the collection time of each platform management side status in the platform management status group, so that the startup, media mounting, and installation completion reporting processes of the node to be installed under the out-of-band management channel can be presented continuously in chronological order. The platform management status group and its corresponding collection time are written into the status record of the node to be installed, forming the platform management side status record.

[0080] The DPU uses the node to be installed in the installation and operation side status record as the associated object, determines the installation network status group corresponding to the node to be installed, and locates the platform management status group corresponding to the same node to be installed in the platform management side status record to form a node association group.

[0081] The specific process includes: the DPU uses the nodes to be installed registered in the installation and operation side status record as the objects for state association between the two sides, determines the installation network timing status group corresponding to the same node to be installed, and organizes the installation and operation status in the installation network timing status group according to the collection time into an installation network status group, so that the node installation process access status, node vNIC forwarding status, and installation completion reporting status belong to the installation and operation side record of the same node to be installed; the DPU searches for the same node to be installed in the platform management side status record and locates the platform management status group corresponding to the same node to be installed, so that the power-on status, firmware-on status, installation media mounting status, and installation completion reporting status belong to the platform management side record of the same node to be installed; when the same node to be installed exists in both the installation and operation side status record and the platform management side status record, the DPU writes the corresponding installation network status group and platform management status group into the same association record, forming a node association group.

[0082] Within the same node association group, time-series pairing is performed based on the state record time of the node association group. The installation / operation state and the platform management side state with the closest record time are combined into a two-sided state pair, and the two-sided evidence time-series deviation value between the installation / operation state and the platform management side state is calculated. The expression is:

[0083] ;

[0084] in, Indicates the first Each two-sided state pair corresponds to the time sequence deviation of the two-sided evidence; Indicates the index of a two-sided state pair; Indicates the first In each of the two-sided state pairs, the acquisition time of the installation and operation status is collected by the DPU, where D stands for the abbreviation of DPU; Indicates the first In each pair of two-sided states, the acquisition time of the platform management side state is collected by BMC, where B stands for the abbreviation of BMC; This indicates the maximum allowed two-sided timing deviation threshold.

[0085] It should be noted that, It is a time limit determined before the construction of the two-sided evidence chain, based on the collection cycle of the DPU for the installation and operation status, the collection cycle of the BMC for the platform management side status, and the maximum allowable delay for status reporting during the node installation process. It is used to determine whether the installation and operation status and the platform management side status in the same two-sided status pair belong to the same installation stage. The exemplary value range is usually 1s to 10s.

[0086] The specific process includes: within the same node association group, using the node to be installed as the limited scope, extracting the installation and operation status and the platform management status from the installation network status group, and obtaining the status record time for each installation and operation status and each platform management status. Then, using the status record time as the pairing basis, arranging the installation and operation status and platform management status under the same node to be installed in chronological order; the DPU compares the status record time of the installation and operation status with the status record time of the platform management status item by item, selecting the set of installation and operation status and platform management status with the smallest record time interval to form a pair of two-sided statuses, and calculating the time sequence deviation value of the two-sided evidence by combining the time interval between the collection time of the installation and operation status collected by the DPU and the collection time of the platform management status collected by the BMC.

[0087] Based on the state type, the two-sided state pairs are classified into start-up preparation evidence, installation execution evidence, and installation completion evidence, and evidence classification labels are obtained. Then, the time sequence deviation values ​​of the two-sided evidence are written into the corresponding evidence to obtain the two-sided installation evidence chain.

[0088] The specific process includes classifying and judging the state types of the installation and operation state and the platform management state in the two-sided state pair. When the state type in the two-sided state pair points to the power-on state, firmware-on state, and installation media mounting state, the DPU classifies the corresponding two-sided state pair as startup preparation evidence. When the state type in the two-sided state pair points to the node installation process access state and the node vNIC forwarding state, the DPU classifies the corresponding two-sided state pair as installation execution evidence. When the state type in the two-sided state pair points to the installation completion report state and the installation completion reporting state, the DPU classifies the corresponding two-sided state pair as installation completion evidence. After completing the classification, the DPU writes the corresponding evidence classification tag for each two-sided state pair and writes the two-sided evidence time sequence deviation value into the corresponding evidence. Then, the two-sided evidence is concatenated according to the time sequence of the state records under the same node to be installed to obtain the two-sided installation evidence chain.

[0089] S4. Use DPU to determine the consistency between the two-sided installation evidence chain and the installation completion criterion, and generate evidence status markers. When the evidence status marker is a failure marker, maintain the installation isolation environment and write the failure reason into the review entry. When the evidence status marker is a pass marker, create a node installation back-off transaction, and register the installation process stop and transaction status to form a node installation back-off transaction record.

[0090] The DPU verifies the bilateral status pairs and evidence classification markers item by item along the bilateral installation evidence chain, matches the initiation preparation evidence, installation execution evidence, and installation completion evidence to the corresponding criterion items, and forms evidence status markers based on criterion coverage, evidence arrangement order, and bilateral status consistency.

[0091] The specific process includes: the DPU extracts bilateral state pairs and evidence classification tags item by item along the bilateral installation evidence chain according to the state record time, and verifies whether the installation and operation status and platform management side status in the bilateral state pairs are consistent with the evidence classification tags. Then, it extracts the criterion items corresponding to the installation process from the installation completion criterion, matches the startup preparation evidence to the criterion items corresponding to the power-on status, firmware startup status, and installation media mounting status, matches the installation execution evidence to the criterion items corresponding to the node installation process access status and node vNIC forwarding status, and matches the installation completion evidence to the criterion items corresponding to the installation completion reporting status and installation completion uploading status. After completing the matching, the DPU verifies whether each criterion item has corresponding evidence coverage, verifies whether the startup preparation evidence, installation execution evidence, and installation completion evidence are arranged in the order of the installation process, verifies whether the installation and operation status and platform management side status in the same bilateral state pair point to the same installation stage, and forms evidence status tags based on the criterion coverage, evidence arrangement order, and bilateral state consistency.

[0092] It should be noted that the consistency of the two-sided states is determined based on the state combination corresponding to the evidence classification marker. When the evidence classification marker is "startup preparation evidence," the platform management side state should correspond to the power-on state, firmware-on state, and installation media mounting state, and the installation operation state should not show any installation access anomalies. When the evidence classification marker is "installation execution evidence," the installation operation state should correspond to the node installation process access state or the node vNIC forwarding state, and the platform management side state should correspond to the installation media mounting state. When the evidence classification marker is "installation completion evidence," the installation operation state should correspond to the installation completion reporting state, and the platform management side state should correspond to the installation completion reporting state. When the two-sided states satisfy the state combination relationship under the corresponding evidence classification marker, the two-sided states are considered consistent; otherwise, the two-sided states are considered inconsistent.

[0093] When the evidence status is marked as failed, the corresponding two-sided status pair, evidence classification mark, and failure reason mark are written into the review entry and kept in the installation isolation environment.

[0094] The specific process includes: when the evidence status is marked as failed, the DPU determines the corresponding position of failure along the double-sided evidence chain and obtains the corresponding double-sided status pair, evidence classification tag, and failure reason tag; the DPU writes the double-sided status pair, evidence classification tag, and failure reason tag corresponding to failure into the same review entry, so that the review entry can completely retain the source, category, and reason of the failed evidence; after the review entry is formed, the DPU does not perform the switchback operation from the node vNIC to the target service VLAN and keeps the node vNIC in the installation isolation environment.

[0095] It should be noted that the review items are written by the DPU based on the failed bilateral status pairs, evidence classification marks, and failure reason marks in the bilateral installation evidence chain when the evidence status is marked as failed. This serves as the evidentiary basis for determining the back-cut closed-loop handling method and forming the isolation closed-loop record.

[0096] When the evidence status is marked as passed, the node to be installed, the node vNIC, the installation isolation environment, the target service VLAN, and the two-sided installation evidence chain are written into the same transaction entry, and a node installation rollback transaction is created.

[0097] The specific process includes: when the evidence status is marked as passed, the DPU confirms that the startup preparation evidence, installation execution evidence, and installation completion evidence in the bilateral installation evidence chain have covered the corresponding criterion items in the installation completion criterion, and that the evidence arrangement order is consistent with the installation process; extracting the node to be installed, the node vNIC, and the target service VLAN from the node installation task sheet, extracting the installation isolation environment corresponding to the node to be installed from the temporary isolation status record, and performing a cross-check between the node to be installed, the node vNIC, the installation isolation environment, and the target service VLAN to ensure that the installation isolation environment where the node vNIC is currently located clearly corresponds to the target service VLAN that needs to be accessed after installation; writing the node to be installed, the node vNIC, the installation isolation environment, the target service VLAN, and the bilateral installation evidence chain into the same transaction entry, so that the transaction entry simultaneously records the switchback object, the current isolation location, the switchback target, and the evidence basis; after the transaction entry is written, using the transaction entry as the transaction content, creating a node installation switchback transaction.

[0098] The DPU stops the installation access path within the isolation environment based on the node installation rollback transaction, thus forming an installation access stop state.

[0099] The specific process includes the DPU locating the established installation access path within the installation isolation environment based on the installation isolation environment registered in the node installation back-off transaction, stopping the access process from the node vNIC and the DPU-side forwarding port into the installation isolation environment, and then registering the stop status of the installation access path within the installation isolation environment. The node to be installed, the node vNIC, the installation isolation environment, the installation access path stop time, and the installation access path stop status are written into the same status record to form the installation access stop status.

[0100] Based on the installation access stop state and according to the fallback target in the node installation fallback transaction, the DPU-side forwarding port corresponding to the node vNIC is switched from the installation isolation environment to the target service VLAN, and the port affiliation between the node vNIC and the installation isolation environment is removed. The integrity of the node installation fallback transaction is calculated, expressed as:

[0101] ;

[0102] in, This indicates the completeness of the node installation and rollback transaction. Indicates the installation access stop flag; Indicates the service VLAN access tag; Indicates the removal of the isolation environment ownership marker;

[0103] It should be noted that, This indicates that the installation access has stopped; the installation access path has stopped when the installation is complete. Set to 1 if the installation access path is not completed. Set to 0; This indicates a service VLAN access flag, which is used when a node vNIC accesses the target service VLAN. Set to 1 when the node vNIC is not connected to the target service VLAN. Set to 0; This indicates the removal of the isolation environment ownership flag, which is triggered when the port ownership relationship between the node vNIC and the isolation environment is severed. Set to 1 when the port ownership relationship between the node vNIC and the installation isolation environment has not been severed. Take 0.

[0104] The specific process includes: the DPU uses the installation access stop status as the confirmation basis before the switchback execution, and determines the target service VLAN as the switchback target in the node installation switchback transaction. Then, based on the node vNIC, it locates the corresponding DPU-side forwarding port, removes the DPU-side forwarding port from the port ownership configuration of the installation isolation environment, configures the DPU-side forwarding port to the target service VLAN, so that the node vNIC changes from the installation isolation environment access status to the target service VLAN access status, and removes the port ownership relationship between the node vNIC and the installation isolation environment. Finally, it verifies the completion status of the installation access path stoppage, DPU-side forwarding port switching, target service VLAN access, and port ownership relationship removal, and calculates the integrity of the node installation switchback transaction.

[0105] Write the node installation rollback transaction integrity, installation access stop flag, service VLAN access flag, and execution status after removing port affiliation into the same record in the execution order to form the node installation rollback transaction record.

[0106] The specific process includes: the DPU records the installation access stop flag as the record content that the installation access path has stopped, records the service VLAN access flag as the record content that the node vNIC has been connected to the target service VLAN, and records the execution status after the port affiliation is removed as the record content that the node vNIC has left the installation isolation environment; the DPU writes the node installation back-off transaction completeness and each record content into the same transaction execution record, and registers the node to be installed, the node vNIC, the installation isolation environment and the target service VLAN in the transaction execution record, so that each execution content corresponds to the same node installation back-off transaction, forming a node installation back-off transaction record.

[0107] S5. Based on the node installation back-switch transaction record, perform connectivity verification on the target service VLAN to obtain the service connectivity verification mark, and combine it with the evidence status mark to determine the back-switch closed-loop handling method and form an isolation closed-loop record.

[0108] The DPU checks the installation access stop flag and service VLAN access flag in the node installation rollback transaction record and determines that the node vNIC has been switched back from the installation isolation environment to the target service VLAN.

[0109] The specific process includes the DPU verifying the node to be installed, node vNIC, installation isolation environment, target service VLAN, installation access stop flag, and service VLAN access flag in the node installation back-off transaction record according to the same node installation back-off transaction. When the installation access stop flag indicates that the installation access path in the installation isolation environment has stopped, and the service VLAN access flag indicates that the DPU-side forwarding port corresponding to the node vNIC has been connected to the target service VLAN, the DPU confirms that the node vNIC has left the installation isolation environment and back-offs to the target service VLAN.

[0110] Using the DPU-side forwarding port corresponding to the node vNIC as the verification message sending port, the target service VLAN identifier, the DPU-side forwarding port identifier, and the verification message sending time are encapsulated into an operational reachability probe request.

[0111] The specific process includes: based on the node vNIC that has completed the back-off verification in the node installation back-off transaction record, locating the DPU-side forwarding port bound to the node vNIC, and using the DPU-side forwarding port as the verification message sending port; extracting the target service VLAN identifier and DPU-side forwarding port identifier according to the target service VLAN registered in the node installation back-off transaction record; when the verification message is generated, writing the current verification message sending time into the probe request so that the return message can be timed according to the sending time; encapsulating the target service VLAN identifier, DPU-side forwarding port identifier, and verification message sending time according to the field order of the same verification message to form an operational reachability probe request.

[0112] The DPU-side forwarding port corresponding to the node vNIC sends an operational reachability probe request to the target service VLAN, and calculates the service link connectivity credibility based on the operational environment affiliation, return port, and return time limit of the service link response message. When the service link connectivity credibility reaches the preset connectivity threshold, a service connectivity verification mark is generated.

[0113] The specific process includes: based on the record of node vNIC switching back to the target service VLAN, the DPU determines the DPU-side forwarding port corresponding to the node vNIC as the sending location for service link verification, and sends an operational reachability probe request to the target service VLAN through the DPU-side forwarding port; after the target service VLAN generates a service link response message, the DPU verifies the operating environment affiliation, return port, and return time limit in the service link response message to ensure that the operating environment affiliation corresponds to the target service VLAN identifier, the return port corresponds to the DPU-side forwarding port identifier, and the return time limit corresponds to the verification message sending time; the service link connectivity credibility is calculated based on the operating environment affiliation, return port, and return time limit of the service link response message. When the operating environment affiliation is consistent, the return port is consistent, and the return time limit meets the verification requirements, the corresponding service link connectivity credibility increases; when any corresponding item is inconsistent, the corresponding service link connectivity credibility decreases; the DPU compares the service link connectivity credibility with a connectivity threshold. When the service link connectivity credibility reaches the connectivity threshold, the node to be installed, the node vNIC, the target service VLAN, and the service link connectivity credibility are written into the verification record to generate a service connectivity verification mark.

[0114] It should be noted that the connectivity threshold is a threshold determined before the service connectivity verification mark is generated, based on the node installation back-switch transaction requirements for the access reliability of the target service VLAN. It is used to determine whether the connectivity credibility of the service link meets the connectivity verification conditions. The exemplary value range is usually between 0.8 and 1.

[0115] The expression for calculating the reliability of service link connectivity:

[0116] ;

[0117] in, Indicates the reliability of business link connectivity. Indicates a consistent identifier for the operating environment; This indicates that the returned port is consistent. This indicates the actual time taken for the response message to be returned in the service link. λ represents the maximum allowed return time; μ represents the weight of the runtime environment's consistent flag; μ represents the weight of the return port's consistent flag; ν represents the weight of the return timeout satisfying the flag, and λ+μ+ν=1.

[0118] It should be noted that, This indicates a consistent VLAN membership in the operating environment. When a service link response message belongs to the target service VLAN... Set to 1 when the service link response message does not belong to the target service VLAN. Set to 0; This indicates a return port consistency flag, which is used when the service link response message returns to the DPU-side forwarding port corresponding to the node vNIC. Set to 1 when the service link response message does not return to the DPU-side forwarding port corresponding to the node vNIC. Set to 0; It is obtained by correlating and statistically analyzing the runtime environment attribution consistency markers and the actual business connectivity markers in the historical installation back-switch samples, extracting the contribution of the runtime environment attribution consistency markers to distinguish between connectivity-passed and connectivity-failed samples, and then normalizing the weights. It is used to characterize the proportion of runtime environment attribution consistency in the business link connectivity credibility. It is obtained by correlating and statistically analyzing the return port consistency markers and actual service connectivity markers in historical installation back-switch samples, extracting the contribution of the return port consistency markers to distinguish between connectivity-passed and connectivity-failed samples, and then normalizing the weights. It is used to characterize the proportion of return port consistency in the reliability of service link connectivity. It is obtained by correlating the degree of return time limit satisfaction in historical installation back-cut samples with the actual business connectivity label, extracting the contribution of the degree of return time limit satisfaction to distinguish between connectivity-passed and connectivity-failed samples, and then normalizing the weights. It is used to characterize the proportion of the business link response message return time in the business link connectivity credibility.

[0119] The DPU writes the business connectivity verification flag and evidence status flag corresponding to the same node to be installed into the closed-loop processing field, forming a transaction record for the installation and rollback of the node to be processed.

[0120] The specific process includes the DPU verifying the consistency of the node to be installed in the node installation back-off transaction record with the business connectivity verification mark and the evidence status mark. When the business connectivity verification mark and the evidence status mark both correspond to the same node to be installed, the DPU writes the business connectivity verification mark and the evidence status mark into the closed-loop processing field of the node installation back-off transaction record in parallel, so that the closed-loop processing field records both the connectivity side status and the evidence side status, forming the node installation back-off transaction record to be processed.

[0121] Priority matching is performed on the evidence status marker and the service connectivity verification marker in the installation back-off transaction record of the node to be processed. The processing item is determined according to the order that the evidence status marker takes precedence over the service connectivity verification marker, and the processing item is used as the back-off closed-loop processing method for the installation back-off transaction record of the node to be processed.

[0122] The specific process includes the following steps: In the installation back-switch transaction record of the node to be processed, the evidence status flag reflects the verification status between the two-sided installation evidence chain and the installation completion criterion, and the service connectivity verification flag reflects the link reachability after the node vNIC switches back to the target service VLAN. When the evidence status flag is marked as "not passed", the DPU determines the evidence review, isolation maintenance, and BMC diagnostic channel retention as the processing items. When the evidence status flag is marked as "passed", the DPU determines whether the target service VLAN link is reachable based on the service connectivity verification flag and determines the transaction submission, transaction abort, and connectivity review related processing items. After completing the matching, the DPU writes the determined processing items into the installation back-switch transaction record of the node to be processed as the back-switch closed-loop processing method.

[0123] According to the closed-loop handling method, select the corresponding handling action from transaction commit, transaction abort, isolation maintenance and BMC diagnostic channel retention handling and execute it. Then, install the closed-loop transaction record on the node to be handled after handling to register the closed-loop status and form an isolation closed-loop record.

[0124] The specific process includes: the DPU selects the appropriate handling method based on the switchback closed-loop handling method in the node installation switchback transaction record. When the evidence status is marked as passed and the service connectivity verification mark indicates that the target service VLAN is reliably connected, the DPU selects transaction commit, registers the node installation switchback transaction as completed, and maintains the node vNIC access to the target service VLAN. When the evidence status is marked as passed but the service connectivity verification mark does not meet the connectivity requirements, the DPU selects transaction abort, stops the node installation switchback transaction commit, and writes the service connectivity verification exception into the node installation switchback transaction record. When the evidence status is marked as failed, the DPU selects isolation retention, allowing the node to be installed to remain in the installation isolation environment. When the evidence status is marked as passed but the service connectivity verification mark fails, the DPU selects BMC diagnostic channel retention, preserving the condition for the BMC to access the node to be installed through the out-of-band management channel. After the handling is completed, the DPU writes the handling action, handling execution status, evidence status mark, and service connectivity verification mark back to the node installation switchback transaction record and closed-loop record, forming an isolation closed-loop record.

[0125] In summary, this invention achieves joint representation of the DPU-side installation and operation status and the BMC-side platform management status under the same node to be installed by associating the installation and operation status records with nodes, matching the time sequence, and classifying the evidence. This improves the reliability of installation completion determination and reduces the risk of node false back-switch caused by false alarms from one side. By using a closed-loop process based on the consistency determination of the dual-side installation evidence chain, node installation back-switch transaction records, and service connectivity verification markers, this invention achieves sequential linkage of installation evidence verification, installation process termination, node vNIC back-switch, target service VLAN connectivity verification, and anomaly isolation maintenance. This prevents abnormal nodes from entering the service network, improves back-switch security, and enhances the traceability of installation anomaly diagnosis.

[0126] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage, characterized in that, include: The BMC extracts the node to be installed, node vNIC, target service VLAN, and installation completion criteria from the system installation request, and arranges them according to the node installation process to generate a node installation task sheet. The DPU creates an installation isolation environment based on the node installation task sheet, connects the node vNIC to the installation isolation environment, starts the node installation process, blocks unauthorized access requests, and forms a temporary isolation state record. The DPU obtains the installation and operation status based on the temporary isolation status record and performs node marking and time sequence aggregation to form an installation and operation side status record; the BMC obtains the platform management side status based on the node installation task sheet and performs node marking and time sequence aggregation to form a platform management side status record; the DPU performs node correspondence association between the installation and operation side status record and the platform management side status record to obtain a dual-side installation evidence chain; The DPU is used to determine the consistency between the two-sided installation evidence chain and the installation completion criterion, and an evidence status mark is generated. When the evidence status mark is a failure mark, the installation isolation environment is maintained, and the reason for failure is written into the review entry. When the evidence status is marked as passed, a node installation rollback transaction is created, and the installation process is stopped and the transaction status is registered, forming a node installation rollback transaction record; Based on the node installation back-switch transaction record, the target service VLAN is connected to verify the connection, and the service connection verification mark is obtained. Combined with the evidence status mark, the back-switch closed-loop handling method is determined, and an isolation closed-loop record is formed.

2. The method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage as described in claim 1, characterized in that, The specific steps for generating the node installation task form are as follows: BMC receives the system installation request and performs format and source verification on the system installation request to obtain a valid system installation request; Extract the node to be installed, node vNIC, target service VLAN, and installation completion criteria from the valid system installation request, and organize them according to the node to be installed to obtain the corresponding entries for node installation; Based on the corresponding entries for node installation, the consistency of the node to be installed, node vNIC, target service VLAN, and installation completion criteria is checked, and the entries are arranged according to the installation order of the nodes to be installed to generate a node installation task sheet.

3. The method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage as described in claim 1, characterized in that, The specific steps for creating a temporary isolation status record are as follows: The DPU queries the current VLAN occupancy status based on the node installation task sheet, selects the unoccupied VLAN identifier as the installation isolation environment identifier, and creates the installation isolation environment based on the installation isolation environment identifier. The DPU locates the DPU-side forwarding port corresponding to the node vNIC and performs installation isolation environment attribution configuration on the DPU-side forwarding port to form a temporary access record for the node vNIC. Based on the node vNIC temporary access record, the node installation process for the installation isolation environment is started, and the installation access path and unauthorized blocking rules within the installation isolation environment are set. The node installation process start flag and unauthorized blocking flag are generated and associated with the corresponding nodes to be installed and time-series aggregated to form a temporary isolation status record.

4. The method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage as described in claim 1, characterized in that, The specific steps for forming the installation and operation status record are as follows: Based on the temporary isolation status record, the DPU maps the installation isolation environment and the DPU-side forwarding port to the same node to be installed, thus obtaining the installation network collection range. Based on the installation network collection range, the node installation process access status, node vNIC forwarding status and installation completion report status are collected and grouped into installation running status. Then, the installation running status is marked according to the node to be installed to obtain the node status group. The installation and operation status of the node status group are arranged chronologically according to the collection time to form an installation network chronological status group. This group is then registered with the node to be installed, the node vNIC, the installation isolation environment, and the collection time to form an installation and operation side status record.

5. The method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage as described in claim 1, characterized in that, The specific steps for forming the platform management side status record are as follows: BMC determines the out-of-band management channel for accessing the node to be installed based on the node installation task sheet, and then collects the power-on status, firmware-on status, installation media mounting status and installation completion reporting status of the node to be installed based on the out-of-band management channel and merges them into the platform management side status. The platform management status collected from the nodes to be installed is marked to form a platform management status group. The platform management status group is then time-series aggregated according to the collection time in the platform management status group, and then written into the status record corresponding to the node to be installed to form a platform management status record.

6. The method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage as described in claim 1, characterized in that, The specific steps to obtain the bilaterally mounted evidence chain are as follows: The DPU uses the node to be installed in the installation and operation side status record as the associated object, determines the installation network status group corresponding to the node to be installed, and locates the platform management status group corresponding to the same node to be installed in the platform management side status record to form a node association group. Within the same node association group, time sequence pairing is performed based on the state recording time of the node association group. The installation and operation state and the platform management side state with the closest recording time are combined into a two-sided state pair, and the two-sided evidence time sequence deviation value between the installation and operation state and the platform management side state is calculated. Based on the state type, the two-sided state pairs are classified into start-up preparation evidence, installation execution evidence, and installation completion evidence, and evidence classification labels are obtained. Then, the time sequence deviation values ​​of the two-sided evidence are written into the corresponding evidence to obtain the two-sided installation evidence chain.

7. The method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage as described in claim 1, characterized in that, The specific steps for creating a node and installing a rollback transaction are as follows: The DPU verifies the bilateral status pairs and evidence classification markers item by item along the bilateral installation evidence chain, matches the initiation preparation evidence, installation execution evidence, and installation completion evidence to the corresponding criterion items, and forms evidence status markers based on the criterion coverage, evidence arrangement order, and bilateral status consistency. When the evidence status is marked as failed, the corresponding two-sided status pair, evidence classification mark, and failure reason mark are written into the review entry and kept in the installation isolation environment; When the evidence status is marked as passed, the node to be installed, the node vNIC, the installation isolation environment, the target service VLAN, and the two-sided installation evidence chain are written into the same transaction entry, and a node installation rollback transaction is created.

8. The method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage as described in claim 1, characterized in that, The specific steps for installing the rollback transaction record in the forming node are as follows: The DPU stops the installation access path in the installation isolation environment based on the node installation rollback transaction, thus forming an installation access stop state. Based on the installation access stop status and according to the back-off target in the node installation back-off transaction, the DPU-side forwarding port corresponding to the node vNIC is switched from the installation isolation environment to the target service VLAN, and the port affiliation relationship between the node vNIC and the installation isolation environment is removed. The integrity of the node installation back-off transaction is calculated. Write the node installation rollback transaction integrity, installation access stop flag, service VLAN access flag, and execution status after removing port affiliation into the same record in the execution order to form the node installation rollback transaction record.

9. The method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage as described in claim 1, characterized in that, The specific steps for obtaining the service connectivity verification flag are as follows: The DPU checks the installation access stop flag and the service VLAN access flag in the node installation switchback transaction record and determines that the node vNIC has switched back from the installation isolation environment to the target service VLAN. Using the DPU-side forwarding port corresponding to the node vNIC as the verification message sending port, the target service VLAN identifier, the DPU-side forwarding port identifier, and the verification message sending time are encapsulated into a runtime reachability probe request. The DPU-side forwarding port corresponding to the node vNIC sends an operational reachability probe request to the target service VLAN, and calculates the service link connectivity credibility based on the operational environment affiliation, return port, and return time limit of the service link response message. When the service link connectivity credibility reaches the preset connectivity threshold, a service connectivity verification mark is generated.

10. The method for temporary isolation network closed-loop during node installation based on DPU and BMC linkage as described in claim 9, characterized in that, The specific steps for forming the isolated closed-loop record are as follows: The DPU writes the business connectivity verification flag and evidence status flag corresponding to the same node to be installed into the closed-loop processing field to form a node installation back-off transaction record; Priority matching is performed on the evidence status marker and the service connectivity verification marker in the installation back-off transaction record of the node to be processed. The processing item is determined according to the order that the evidence status marker takes precedence over the service connectivity verification marker, and the processing item is used as the back-off closed-loop processing method for the installation back-off transaction record of the node to be processed. According to the closed-loop handling method, select the corresponding handling action from transaction commit, transaction abort, isolation maintenance and BMC diagnostic channel retention handling and execute it. Then, install the closed-loop transaction record on the node to be handled after handling to register the closed-loop status and form an isolation closed-loop record.

Images