Access isolation method and apparatus, and computing cluster, storage medium and program product

Abstract

The present application belongs to the technical field of computers. Disclosed are an access isolation method and apparatus, and a computing cluster, a storage medium and a program product. In the method, EIDs are uniformly assigned to function instances and UPIs are uniformly assigned to user entities to which the function instances belong; when data access is performed between two different function instances, a data access packet carries a DEID and a UPI; after receiving the data access packet, a physical node uses a UPI stored in the physical node itself to verify whether a function instance that requests access and a destination function instance belong to the same user entity; and if the two function instances belong to the same user entity, access is permitted, thereby realizing access isolation between different user entities at the granularity of function instances.

Description

Access isolation methods, devices, computing clusters, storage media and software products

[0001] This application claims priority to Chinese Patent Application No. 202410704189.6, filed on May 31, 2024, entitled “Access Isolation Method, Apparatus, Computing Cluster, Storage Medium and Program Product”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of computer technology, and in particular to an access isolation method, apparatus, computing cluster, storage medium, and program product. Background Technology

[0003] Current computing clusters are built around servers as the basic unit. A server includes a host and devices such as solid-state drives (SSDs), network interface cards (NICs), neural processing units (NPUs), or graphics processing units (GPUs). Administrators of computing clusters can allocate one or more server resources to a user as bare-metal services. Alternatively, administrators can create one or more virtual machines (VMs) on the host server, allocate physical or virtual device resources to the corresponding VMs on the same server, and then allocate these VM resources to a user as virtual machine services. A device can have one or more device instances; virtual device resources refer to the resources allocated to a device instance.

[0004] To improve the resource utilization of computing clusters, the scalability of available host device resources, and the efficiency of cross-server access, the industry has proposed resource pooling architecture or composable server architecture. This allows a host / virtual machine to use device resources within the computing cluster on demand and supports direct memory access between hosts / virtual machines. How to isolate access between hosts, virtual machines, and device instances with different users to ensure access security is a crucial issue in resource pooling architecture and composable server architecture. Summary of the Invention

[0005] This application provides an access isolation method, apparatus, computing cluster, storage medium, and program product, which can achieve access isolation between different users at the functional instance granularity and ensure the reliability of access isolation. The technical solution is as follows:

[0006] Firstly, an access isolation method is provided. The computing cluster includes multiple physical nodes, each of which has at least one functional instance. The functional instance is used to schedule the computing cluster to be used by the user. Each physical node stores the entity identifier (EID) of each functional instance in the corresponding physical node and the unified bus partition identifier (UPI) of the user to which the corresponding functional instance belongs. The EIDs of different functional instances are different, and the UPIs of different user objects are different.

[0007] The method includes: a first physical node receiving a first data access message sent by a second physical node, the first data access message carrying a first UPI and a first destination (Destination EID, DEID), the first DEID being the EID of a first functional instance, the first functional instance being a functional instance possessed by the first physical node, and the first and second physical nodes being physical nodes in a computing cluster; the first physical node determining a second UPI based on the first DEID, the second UPI being the UPI of the object to which the first DEID belongs, stored by the first physical node; and, if the first UPI and the second UPI are the same, the first physical node responding to the first data access message.

[0008] As can be seen, this scheme uniformly assigns EID to functional instances and uniformly assigns UPI to the user objects to which functional instances belong. When data access occurs between two different functional instances, the data access message carries DEID and UPI. After receiving the data access message, the physical node uses its own stored UPI to identify whether the requesting functional instance and the destination functional instance belong to the same user object. Access is allowed only if the two functional instances belong to the same user object, thereby achieving access isolation between different user objects at the functional instance level.

[0009] If the first UPI and the second UPI are different, the first physical node discards the first data access message. That is, if the source function instance and the destination function instance do not belong to the same user, the first physical node does not respond to the first access message, thereby isolating access for different users.

[0010] The first physical node can be a host or a general-purpose device (specifically, a unified bus (UB) device). Correspondingly, the aforementioned functional instances can be hosts scheduled in bare-metal form, virtual machines created on hosts, or device instances of general-purpose devices. That is, this application supports access isolation between multiple types of functional instances. The following sections will describe these scenarios separately.

[0011] Optionally, the first physical node is a host, which includes a first controller (specifically, a Unified Bus (UB) controller), and the host scheduled in bare-metal form is a functional instance; or, the first physical node is a general-purpose device (specifically, a UB device), which has at least one device instance, and each device instance is a functional instance; each controller and each device instance has a configuration space, which stores the EID of the corresponding functional instance and the UPI of the user object to which the corresponding functional instance belongs. That is, for device instances and functional instances such as hosts scheduled in bare-metal form, these functional instances have independent configuration spaces.

[0012] Optionally, the computing cluster also includes a fabric manager (FM), which has write permissions to the aforementioned configuration space. The FM is used to assign a corresponding EID to each functional instance and a corresponding UPI to each user object. That is, this solution ensures the security of the configuration space by restricting write permissions to the configuration space.

[0013] Optionally, the FM writes configuration data to the configuration space by sending configuration management messages to the physical node. Configuration data may include EID and / or UPI. To ensure configuration reliability, after receiving the configuration management message, the physical node authenticates the FM based on the received message to determine if the message was generated by the FM. If authentication is successful, the physical node responds to the configuration management message, for example, by writing configuration data to the configuration space.

[0014] There are many ways to authenticate FM. Taking the method of carrying a specified tag in the configuration management message as an example, the specified tag is a reference UPI. The method also includes: the first physical node receives the first configuration management message, the first configuration management message carries a third UPI; if the third UPI is the same as the reference UPI, the first physical node responds to the first configuration management message, and the reference UPI is used to identify the configuration management message generated by the FM.

[0015] To prevent the host from impersonating the FM to send configuration management messages, the physical node can also use the reference UPI to judge the configuration management messages generated by the host, in order to determine whether the configuration management messages generated by the host are impersonated configuration management messages generated by the FM.

[0016] Taking a first physical node as a host as an example, the first physical node also includes a first processor and a first controller that records a reference UPI. The method further includes: the first processor generating a second configuration management message, the second configuration management message carrying a fourth UPI; and the first controller blocking the transmission of the second configuration management message when verifying that the fourth UPI is the same as the reference UPI.

[0017] When both the controller and the device instance have independent configuration spaces, if the first functional instance is a host or a general-purpose device (specifically, a UB device) that is scheduled in bare metal form, the first physical node determines the second UPI based on the first DEID, including: the first physical node determines the UPI in the first configuration space based on the first DEID to obtain the second UPI, where the first configuration space is the configuration space of the first functional instance.

[0018] If the first physical node is a general-purpose device, and the first physical node has multiple device instances, and the first functional instance is one of the multiple device instances, then the first physical node determines the UPI in the first configuration space based on the first DEID to obtain the second UPI, including: the first physical node determines the first configuration space from the configuration space of the multiple device instances based on the first DEID; the first physical node uses the UPI in the first configuration space as the second UPI.

[0019] In the case where the first physical node is a host, and the functional instances on the first physical node include at least one virtual machine created on the first physical node, the first physical node stores a first mapping relationship. This first mapping relationship records the mapping relationship between the EID of each virtual machine created on the first physical node and the UPI of the corresponding virtual machine's user object. The first functional instance is the first virtual machine created on the first physical node. The first physical node determines the second UPI based on the first DEID, including: the first physical node determines the UPI corresponding to the first DEID in the first mapping relationship as the second UPI. That is, in the virtual machine scenario, the EIDs and UPIs of all virtual machines created on the host are stored in the same mapping relationship, and each virtual machine may not have an independent configuration space.

[0020] As discussed above, when a physical node is the host, it can be scheduled to users of the computing cluster either as a bare metal machine or as a virtual machine (VM). When the host is directly scheduled to a user as a bare metal machine, its resources are exposed to that user. To ensure the reliability of this solution, the host can be configured in untrusted mode, forcing access control to adhere to the configuration data within the FM-only writable configuration space. However, when a VM is scheduled to a user, its resources are not exposed. Therefore, the host can be configured in trusted mode, allowing access control to proceed without adhering to the configuration data within the aforementioned configuration space. This will be discussed further below.

[0021] Optionally, the first physical node is a host, which includes a first controller. The first controller has a first configuration space, and the first configuration space also stores a trust mode configured for the first physical node. The method further includes: when the trust mode in the first configuration space is a first trust mode (also known as an untrusted mode), the first physical node generates a second data access message based on the UPI in the first configuration space; the first physical node sends the second data access message to a third physical node in the computing cluster, where the third physical node is the physical node where the second functional instance is located, and the second functional instance is the destination functional instance of the second data access message; wherein, the first trust mode indicates that the first physical node is scheduled for use by the user in the computing cluster in a bare-metal manner, and the second data access message carries a second DEID and the UPI in the first configuration space, where the second DEID is the EID of the second functional instance.

[0022] That is, in the untrusted mode, the first physical node generates a data access message based on the configuration data in the configuration space.

[0023] The first physical node further includes a first processor and stores a second mapping relationship. This second mapping relationship records the DEID corresponding to the physical address (PA) of the memory that each functional instance in the first physical node is allowed to access. The DEID corresponding to the PA is the EID of the functional instance to which the corresponding memory belongs. When the trust mode in the first configuration space is the first trust mode, the first physical node generates a second data access message based on the UPI in the first configuration space. This includes: the first processor generating a first data access instruction, which indicates the first physical address (PA); the first controller obtaining a first relational item in the second mapping relationship based on the first PA, where the first relational item records the DEID corresponding to the first PA, which is the second DEID; and the first controller generating the second data access message based on the first data access instruction, the first relational item, and the UPI in the first configuration space. That is, the first physical node also stores a second mapping relationship that can be used for decoding. This decoding includes address translation of the PA and determining the DEID based on the PA.

[0024] Optionally, the functional instances on the first physical node include at least one virtual machine created on the first physical node. The first physical node also stores a third mapping relationship, which records the UPI of the user object to which each virtual machine created on the first physical node belongs. The method further includes: when the trust mode in the first configuration space is the second trust mode (also known as the trusted mode), the first physical node generates a third data access message based on the fifth UPI in the third mapping relationship. The fifth UPI is the UPI of the user object to which the first virtual machine belongs, and the first virtual machine is a virtual machine created on the first physical node, serving as the source virtual machine for the third data access message; the first physical node sends the third data access message to a fourth physical node in the computing cluster. The fourth physical node is the physical node where the third functional instance resides, and the third functional instance is the destination functional instance for the third data access message; wherein, the second trust mode indicates that the first physical node schedules the created virtual machine to the user object of the computing cluster for use by creating the virtual machine, and the third data access message carries a third DEID and a fifth UPI, where the third DEID is the EID of the third functional instance.

[0025] That is, in trusted mode, the first physical node generates a data access message based on the UPI in the third mapping relationship stored outside the configuration space.

[0026] The first physical node also includes a first processor. The third mapping relationship records the DEID corresponding to the memory access point (PA) of each virtual machine created on the first physical node and the UPI of the corresponding virtual machine's user object. The DEID corresponding to the PA is the EID of the corresponding memory's functional instance. When the trust mode in the first configuration space is the second trust mode, the first physical node generates a third data access message based on the fifth UPI in the third mapping relationship. This includes: the first processor generating a second data access instruction, which instructs the second PA; the first controller obtaining a second relation item in the third mapping relationship based on the second PA, where the second relation item records the DEID and UPI corresponding to the second PA, which are respectively the third DEID and the fifth UPI; and the first controller generating the third data access message based on the second data access instruction and the second relation item.

[0027] Optionally, any of the above mapping relationships can be stored in the memory of the first physical node or in the controller of the first physical node. That is, since the above mapping relationships are used in virtual machine scenarios, where host resources are not exposed to users, this solution does not restrict the storage location of the above mapping relationships.

[0028] Secondly, an access isolation device is provided, which has the function of implementing the access isolation method described in the first aspect. The access isolation device includes one or more modules for implementing the access isolation method provided in the first aspect.

[0029] Thirdly, a computing cluster is provided, comprising multiple physical nodes, wherein the physical nodes in the computing cluster are used to implement the access isolation method provided in the first aspect. Optionally, the computing cluster further includes a bus architecture, and the multiple physical nodes are connected through the bus architecture.

[0030] Fourthly, a computing device is provided, comprising a processor and a memory, the memory storing a program for executing the access isolation method provided in the first aspect, and storing data related to implementing the access isolation method provided in the first aspect. The processor is configured to execute the program stored in the memory. The computing device may further include a communication bus for establishing a connection between the processor and the memory. The computing device includes some or all of the physical nodes described in the first aspect.

[0031] Fifthly, a computer-readable storage medium is provided, wherein instructions are stored therein, which, when executed on a processor, cause the processor to perform the access isolation method described in the first aspect.

[0032] In a sixth aspect, a computer program product containing instructions is provided that, when run on a processor, causes the processor to perform the access isolation method described in the first aspect above.

[0033] The technical effects achieved by the second to sixth aspects mentioned above are similar to those achieved by the corresponding technical means in the first aspect, and will not be repeated here. Attached Figure Description

[0034] Figure 1 is a system architecture diagram involving the access isolation method provided in the embodiments of this application;

[0035] Figure 2 is another system architecture diagram involving the access isolation method provided in the embodiments of this application;

[0036] Figure 3 is another system architecture diagram involving the access isolation method provided in the embodiments of this application;

[0037] Figure 4 is a flowchart illustrating an access isolation method provided in an embodiment of this application;

[0038] Figure 5 is a schematic diagram of the format of a data access message provided in an embodiment of this application;

[0039] Figure 6 is a schematic diagram of the format of a configuration management message provided in an embodiment of this application;

[0040] Figure 7 is a schematic diagram of a configuration space provided in an embodiment of this application;

[0041] Figure 8 is a schematic diagram of a UB controller sending a data access message according to an embodiment of this application;

[0042] Figure 9 is a schematic diagram of an access isolation method in a virtual machine scenario provided by an embodiment of this application;

[0043] Figure 10 is a schematic diagram of an access isolation device provided in an embodiment of this application. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0045] To facilitate understanding, the implementation environment of the embodiments of this application will be introduced first.

[0046] Figure 1 is a system architecture diagram involving the access isolation method provided in this application embodiment. This system architecture can also be referred to as a computing cluster, computing center, data center, or cloud service center, etc. Referring to Figure 1, the system architecture includes multiple physical nodes, each physical node having at least one functional instance, and the multiple physical nodes are connected via wired or wireless means. Each physical node can achieve access isolation between different users according to the access isolation method provided in this application embodiment, thereby ensuring system security.

[0047] Each physical node can be a host or a device such as an SSD, NIC, NPU, or GPU. A host may include at least one general-purpose central processing unit (CPU), and an operating system (OS) may be running on the host. In the embodiments of this application, a host may also include at least one controller, memory, etc.

[0048] These multiple physical nodes can establish communication connections through a unified bus (UB) architecture, or through other communication architectures or technologies. This application does not limit this approach; the technical solution of this application will be described below using the UB architecture as an example. In the scenario where these multiple physical nodes are connected through a UB architecture, general-purpose devices such as SSDs, NICs, NPUs, and GPUs can be referred to as UB devices, and the controller within the host can be referred to as a UB controller. When these multiple physical nodes are connected through other communication architectures or technologies, devices such as SSDs, NICs, NPUs, and GPUs, as well as the controller within the host, can also have other names. In the following description, the controller within the host will be referred to as the UB controller, and devices such as SSDs, NICs, NPUs, and GPUs will be referred to as UB devices.

[0049] Optionally, at least one virtual machine can be created on any one or more hosts, and one or more device instances can be supported on any one or more devices. For example, a NIC may have multiple network interface card (NIC) instances. This solution supports access isolation at the granularity of virtual machines, bare-metal hosts, and device instances. The scheduling of bare-metal hosts can be achieved by assigning the controller within the corresponding host to a specific user object. Virtual machines, device instances, and hosts scheduled in bare-metal form can all be referred to as functional instances in this embodiment. Each functional instance has a unique instance identifier; that is, different functional instances have different instance identifiers, which are used to distinguish different functional instances. In this embodiment, the instance identifier can be represented as an EID. Different EIDs are used to distinguish different functional instances. For example, each UB controller has one EID, each device instance has one EID, and each virtual machine has one EID. Furthermore, each user object has a unique object identifier; that is, different user objects have different object identifiers, which are used to distinguish different user objects. In other words, functional instances belonging to the same user object also have the same object identifier. In this embodiment, the object identifier can be represented as a UPI. In other embodiments, instance identifiers and object identifiers may also be represented in other ways. In the following sections, instance identifiers and object identifiers will be represented as EID and UPI, respectively, as examples.

[0050] Optionally, the system architecture also includes an Architecture Manager (FM), which is used to assign EIDs to functional instances and UPIs to user objects. A description of the FM can be found in Figures 3 and 4 below. Of course, in other embodiments, EIDs and UPIs may also be assigned by other devices or apparatuses, and this application embodiment does not limit this.

[0051] Figure 2 is another system architecture diagram involving the access isolation method provided in the embodiments of this application. This system architecture can also be an example of the system architecture shown in Figure 1. As shown in Figure 2, the system architecture includes multiple hosts and multiple devices, all of which are connected to a bus fabric. This bus fabric includes a unified bus (UB). In the embodiments of this application, the bus fabric also includes the Architectural Manager (FM) shown in Figure 2. The FM is used to assign EIDs to functional instances and UPIs to user objects. The FM may also be referred to as a Fabric Manager or other names in some other embodiments.

[0052] The access isolation method provided in this application embodiment can be applied not only to the multi-host system architecture shown in Figure 2, but also to the single-host system architecture, which includes one host and at least one device.

[0053] Figure 3 is another system architecture diagram related to the access isolation method provided in the embodiments of this application. This system architecture can also be a specific example of the system architecture shown in Figure 2. Referring to Figure 3, this system architecture includes 6 hosts and 7 devices. The 6 hosts are referred to as Host 1, Host 2, Host 3, Host 4, Host 5, and Host 6. The 7 devices are referred to as Device 1, Device 2, Device 3, Device 4, Device 5, Device 6, and Device 7. All 6 hosts and 7 devices are connected to a bus architecture, which includes FM.

[0054] Each of the six hosts has at least one UB controller (UBC). A host scheduled in bare metal form can be considered a functional instance. Virtual machines 4.1 and 4.2 are also created on host 4, and virtual machine 5.1 is created on host 5. Each virtual machine constitutes a functional instance. Devices 1 through 5 have device instances 1.1, 2.1, 3.1, 4.1, and 5.1, respectively. Device 6 has device instances 6.1, 6.2, and 6.3. Device 7 has device instances 7.1, 7.2, 7.3, and 7.4. Each device instance constitutes a functional instance.

[0055] In Figure 3, all the hosts and devices form a computing cluster, and each functional instance can be scheduled to be used by users of the computing cluster. For example, host 1, host 2, device instance 1.1, device instance 2.1, device instance 6.1, and device instance 7.2 are scheduled to user a; host 3, device instance 3.1, and device instance 6.2 are scheduled to user b; virtual machine 4.1, device instance 4.1, and device instance 7.3 are scheduled to user c; virtual machine 4.2, virtual machine 5.1, device instance 6.3, and device instance 7.1 are scheduled to user d; and other functional instances and hosts are not scheduled yet.

[0056] It should be understood that host scheduling can refer to the host being scheduled to a user in bare metal form. The user receives a host containing a UB controller. In this embodiment, host scheduling can be achieved by assigning the UB controller within the host to a user. Furthermore, two device instances scheduled to the same user can be registered on the same host, or they can be registered on different hosts. For example, device instance 3.1 and device instance 6.2 can both be registered on host 3 to be scheduled to user b.

[0057] In this embodiment, hosts, virtual machines, and device instances belonging to the same user are allowed to access each other, while hosts, virtual machines, and device instances belonging to different users are not allowed to access each other. Unscheduled resources such as hosts, virtual machines, and device instances are not allowed to be accessed by any user. A user can be a tenant, a task, or other types of objects; this embodiment does not limit this.

[0058] The system architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0059] The access isolation method provided in the embodiments of this application will be described next. This method can be applied to any computing cluster shown in Figures 1 to 3.

[0060] In this embodiment, the computing cluster includes multiple physical nodes, each of which has at least one functional instance. These functional instances are used to schedule usage by users of the computing cluster. Each physical node stores the EID of each functional instance within that physical node and the UPI of the user to which that functional instance belongs. Different functional instances have different EIDs, and different user objects have different UPIs. The following describes the access isolation method provided in this embodiment using the example of a fourth functional instance accessing a first functional instance within the computing cluster. Here, the first functional instance is a functional instance possessed by a first physical node, and the fourth functional instance is a functional instance possessed by a second physical node.

[0061] Figure 4 is a flowchart of an access isolation method provided in an embodiment of this application. Referring to Figure 4, the method includes the following steps.

[0062] Step 401: The first physical node receives the first data access message sent by the second physical node. The first data access message carries the first UPI and the first DEID. The first DEID is the EID of the first functional instance. The first functional instance is a functional instance that the first physical node has.

[0063] Among them, the first physical node and the second physical node are physical nodes in the computing cluster.

[0064] To achieve access isolation for different users, the first data access message sent by the second physical node carries a first UPI, so that the receiving end (here, the first physical node) can achieve access isolation by verifying the consistency of the UPI. Here, the first UPI is the UPI of the user to which the fourth functional instance belongs, the fourth functional instance is the source functional instance of the first data access message, and the fourth functional instance is a functional instance possessed by the second physical node.

[0065] Furthermore, since the first physical node may have more than one functional instance, and different functional instances may be scheduled to different users, meaning that the UPIs of the users to which different functional instances belong may be different, in order for the receiving end to determine the UPI of the user to which the destination functional instance belongs from multiple functional instances, the first data access message also carries a first DEID. The first DEID is the EID of the first functional instance, the first functional instance is the destination functional instance of the first data access message, and the first functional instance is a functional instance possessed by the first physical node.

[0066] Of course, the first data access message carries other information in addition to the first UPI and the first DEID.

[0067] For example, the first data access message also carries the first (source EID, SEID) and the memory address information requested for access. Among them, the first SEID is the EID of the source functional instance of the first data access message, which is also the EID of the fourth functional instance. The first data access message carries the first SEID so that the first physical node can respond to the corresponding functional instance.

[0068] For example, the first data access message also carries the source Clan network address (SCNA) and the destination Clan network address (DCNA), which are used to identify the network addresses of the physical nodes to which the source and destination functional instances belong within the Clan domain, respectively. The Clan network address can be used for addressing the corresponding message.

[0069] For example, the first data access message also carries an operation header, which indicates the operation to be performed on the requested memory, such as a write operation or a read operation.

[0070] Figure 5 is a schematic diagram of a data access message format provided in an embodiment of this application. Referring to Figure 5, the data access message includes at least five fields. The first field is used to carry DCNA and SCNA, the second field is used to carry UPI (such as the first UPI in the first data access message), the third field is used to carry DEID and SEID (such as the first DEID and the first SEID), the fourth field is used to carry operation header information, and the fifth field is used to carry payload and other data. This application embodiment does not limit the order of these five fields, and the message format shown in Figure 5 is not intended to limit the embodiments of this application.

[0071] As mentioned above, each physical node may be a host or a general-purpose device, such as a UB device. The following section will introduce the possible scenarios for the first and second physical nodes, as well as the possible scenarios for the corresponding first and fourth functional instances.

[0072] First, we will introduce the possible scenarios for the first physical node.

[0073] In one embodiment, the first physical node is a host, and the first physical node includes a first UB controller. Optionally, the first functional instance is a bare-metal first physical node, that is, the first physical node is scheduled to a user in bare-metal form, specifically by assigning the first UB controller to the user. Alternatively, at least one virtual machine is created on the first physical node, and the first functional instance is the first virtual machine among the at least one virtual machine, that is, the first physical node schedules the virtual machine to the user of the computing cluster by creating the virtual machine.

[0074] It should be understood that the first physical node may include a UB controller, which is the first UB controller, and the aforementioned first DEID is the EID of the first UB controller. The EID of the first UB controller is essentially also the EID of the host, and the EID information recorded on the bus architecture regarding the host can be a mapping between the host's identifier and the EID. Of course, in some other embodiments, the EID information recorded on the bus architecture regarding the host can also be a mapping between the first UB controller's identifier and the EID.

[0075] Alternatively, the first physical node may also include UB controllers other than the first UB controller. If the first physical node is scheduled to a user in bare-metal form, then all UB controllers in the first physical node are assigned to that user. In this embodiment, the aforementioned first DEID may be the EID of the first UB controller, or it may be the EID of other UB controllers in the first physical node. The EID information about the host recorded on the bus architecture may include the correspondence between the identifier of each UB controller within the host and its corresponding EID. In some other embodiments, the host scheduled in bare-metal form also has an EID, and the aforementioned first DEID is the EID of the first physical node scheduled in bare-metal form. The EID information about the host recorded on the bus architecture may include the correspondence between the host's identifier and the host's EID, as well as the correspondence between the identifier of each UB controller within the host and its corresponding EID.

[0076] In another embodiment, the first physical node is a UB device, which has at least one device instance. A device instance is a functional instance of the corresponding UB device. The aforementioned first functional instance is a device instance of the UB device, and this device instance may be referred to as the first device instance.

[0077] Then, the possible scenarios for the second physical node are introduced.

[0078] In one embodiment, the second physical node is a host, and the second physical node includes a second UB controller. Optionally, the fourth functional instance described above is a bare-metal second physical node, that is, the second physical node is scheduled to a user in bare-metal form, specifically by assigning the second UB controller to the user. Alternatively, at least one virtual machine is created on the second physical node, and the fourth functional instance is the first virtual machine among the at least one virtual machine, that is, the second physical node schedules the virtual machine to the user of the computing cluster by creating the virtual machine.

[0079] The second physical node may include a UB controller, which is the second UB controller, and the first SEID mentioned above is the EID of the second UB controller.

[0080] Alternatively, the second physical node may also include UB controllers other than the second UB controller. If the second physical node is scheduled to a user in bare-metal form, then all UB controllers in the second physical node are assigned to that user. In the embodiments of this application, the aforementioned first SEID may be the EID of the second UB controller, or it may be the EID of other UB controllers in the second physical node. In some other embodiments, the host scheduled in bare-metal form also has an EID, and the aforementioned first SEID is the EID of the second physical node scheduled in bare-metal form.

[0081] In another embodiment, the second physical node is a UB device, which has at least one device instance, and a device instance is a functional instance of the corresponding UB device. The aforementioned fourth functional instance is a device instance of the UB device, and this device instance can be referred to as the second device instance.

[0082] Based on the above-described possible scenarios, both the first functional instance and the fourth functional instance may be a host, a device instance, or a virtual machine scheduled in bare metal form. That is, the embodiments of this application support data access between functional instances of the same type among the three types of functional instances: host, device instance, and virtual machine, as well as data access between functional instances of different types among the three types of functional instances.

[0083] In this embodiment, each UB controller and each device instance has a configuration space that stores the EID of the corresponding functional instance and the UPI of the user object to which the corresponding functional instance belongs. This allows physical nodes to easily obtain the UPI of the user object to which the source functional instance belongs from the configuration space of the source functional instance and add the obtained UPI to the data access message. For example, if the fourth functional instance is a second physical node or a second device instance scheduled in bare-metal mode, the second physical node obtains the UPI of the user object to which the fourth functional instance belongs from the configuration space of the fourth functional instance, obtains the first UPI, and encapsulates the first UPI into the first data access message.

[0084] To ensure the security of the configuration space and prevent it from being attacked, write permissions for the configuration space can be restricted.

[0085] In this embodiment of the application, the computing cluster also includes an Architecture Manager (FM), which has write permissions to the configuration space. The FM is used to assign a corresponding EID to each functional instance and a corresponding UPI to each user object, and write the assigned EID and UPI into the configuration space of the corresponding functional instance.

[0086] Optionally, FM writes configuration data to the configuration space by sending configuration management messages to physical nodes. The configuration data includes EID and UPI.

[0087] Taking the allocation of EID and UPI to a functional instance of the first physical node as an example, the FM sends a configuration management message to the first physical node. The configuration management message carries the EID and / or UPI allocated to the functional instance. After receiving the configuration management message, the first physical node authenticates the FM based on the configuration management message. After successful authentication, the FM writes the EID and / or UPI carried in the configuration management message into the configuration space of the corresponding functional instance.

[0088] Figure 6 is a schematic diagram of the format of a configuration management message provided in an embodiment of this application. Referring to Figure 6, the format of this configuration management message is similar to that of the data access message shown in Figure 5. This configuration management message also includes at least five fields: the first field carries DCNA and SCNA; the second field carries UPI (such as the reference UPI below); the third field carries DEID and SEID; the fourth field carries command header information; and the fifth field carries command payload, etc. This application embodiment does not limit the order of these five fields, and the message format shown in Figure 6 is not intended to limit this application embodiment. The command header information indicates the operation performed on the configuration space, such as formatting or modification operations.

[0089] There are many ways to authenticate FM, such as using public and private keys, carrying a specified flag in the configuration management message, or any other possible method. This application embodiment does not limit this method.

[0090] Taking the method of carrying a specified tag in the configuration management message as an example, in this embodiment of the application, the specified tag can be a reference UPI. The reference UPI is used to identify the configuration management message generated by the FM. The physical node only authenticates the FM if the received configuration management message carries the reference UPI.

[0091] For example, the first physical node receives a first configuration management message. This first configuration management message carries a third UPI. If the third UPI is the same as the reference UPI, the first physical node responds to the first configuration management message. The first configuration management message can refer to the configuration management message mentioned above that carries the EID and / or UPI assigned to the functional instance. Of course, the first configuration management message can also be a configuration management message carrying other configuration data.

[0092] To prevent the host from impersonating an FM to send configuration management messages, embodiments of this application can also use a reference UPI to judge the configuration management messages generated by the host, so as to determine whether the configuration management messages generated by the host are configuration management messages impersonated by an FM.

[0093] Taking a host as an example, the first physical node also includes a first processor, and the first UB controller records a reference UPI. The first processor generates a second configuration management message, which carries a fourth UPI. If the first UB controller verifies that the fourth UPI is the same as the reference UPI, it blocks the transmission of the second configuration management message.

[0094] The reference UPI can be any set value, such as 0x7FFF, or other values.

[0095] Of course, in addition to using the reference UPI method to block the host from generating configuration management messages that spoof FM, other methods can also be used to identify configuration management messages generated by the host in other embodiments.

[0096] Step 402: The first physical node determines the second UPI based on the first DEID. The second UPI is the UPI of the object to which the first DEID belongs, stored by the first physical node.

[0097] In this embodiment, after receiving the first data access message, the first physical node parses out the first DEID and the first UPI from the first data access message. The first physical node determines the second UPI based on the first DEID, and the second UPI is the UPI of the user object to which the first DEID belongs, stored by the first physical node.

[0098] As described above, in some embodiments, the first functional instance is a host or a device instance of a UB device scheduled in bare-metal form. Both the UB controller and the device instance have corresponding configuration spaces. Therefore, the first physical node determines the UPI in the first configuration space based on the first DEID to obtain the second UPI. The first configuration space is the configuration space of the first functional instance.

[0099] If the first physical node is a UB device and has multiple device instances, and the first functional instance is one of the multiple device instances, then the first physical node determines the first configuration space from the configuration space of the multiple device instances based on the first DEID, and uses the UPI in the first configuration space as the second UPI.

[0100] If the first physical node is a host, and the first functional instance is a host scheduled logically, and if the first DEID is the EID of the first UB controller, then the first physical node determines the configuration space of the first UB controller as the first configuration space based on the first DEID, and uses the UPI in the first configuration space as the second UPI. In some embodiments, the first physical node may include multiple UB controllers. Since these multiple UB controllers are assigned to the same user, the UPIs in the configuration spaces of these multiple UB controllers are the same. The first DEID may be the EID of any UB controller in the first physical node. In this case, the first configuration space is the configuration space of the UB controller identified by the first DEID among the multiple UB controllers, and the first physical node uses the UPI in the first configuration space as the second UPI. If the first DEID is the EID of the first physical node itself, then the first physical node determines the configuration space of any UB controller within the first physical node as the first configuration space, and uses the UPI in the first configuration space as the second UPI.

[0101] In other embodiments, the first physical node is a host, and the functional instances on the first physical node include at least one virtual machine created on the first physical node. The first functional instance is the first virtual machine created on the first physical node. The first physical node stores a first mapping relationship, which records the mapping relationship between the EID of each virtual machine created on the first physical node and the UPI of the corresponding virtual machine's user object. Then, the first physical node determines the UPI corresponding to the first DEID in the first mapping relationship as the second UPI.

[0102] The first mapping relationship can be in the form of a table, which may be called the EID-UPI configuration table. Alternatively, the first mapping relationship may also be in other forms, which are not limited in this embodiment.

[0103] Step 403: If the first UPI and the second UPI are the same, the first physical node responds to the first data access message.

[0104] The first UPI being identical to the second UPI indicates that the first functional instance and the fourth functional instance belong to the same user. In other words, the source functional instance and the destination functional instance of the first data access message belong to the same user. In this case, the first physical node responds to the first data access message.

[0105] As can be seen from the above, the first data access message can also carry the first SEID. Therefore, after responding to the first data access message, the first physical node may optionally send a response result about the first data access message to the second physical node based on the first SEID.

[0106] For example, if the first data access message indicates that the memory space belonging to the first functional instance should be read or written, then the first physical node should read or write to that memory space.

[0107] If a read operation is performed on the memory space, the first physical node acquires part or all of the memory data in that memory space and sends a first data response message to the second physical node. The first data response message carries the data acquired by the first physical node, and may also carry DEID, SEID, and the UPI of the user object to which the function instance identified by SEID belongs. For example, the format of the first data response message is similar to the message format shown in Figure 5, except that the DEID and SEID carried in the first data response message are the EIDs of the fourth function instance and the first function instance, respectively; the UPI carried is the second UPI; and the DCNA and SCNA carried are the opposite of those carried in the first data access message. The data carried is the data acquired by the first physical node.

[0108] If a write operation is performed on the memory space, the first physical node sends a second data response message to the second physical node. This second data response message carries an indication message indicating whether the write was successful or not. Optionally, the format of the second data response message is similar to the message format shown in Figure 5. For example, the information carried by the second data response message and the fields containing that information are similar to those of the first data response message. The main difference is that the data carried by the second data response message is an indication message indicating whether the write was successful or not. Of course, the first physical node may also choose not to send any data response message to the second physical node.

[0109] If the first UPI and the second UPI are different, the first physical node discards the first data access message. That is, the first functional instance and the fourth functional instance do not belong to the same user; that is, the source functional instance and the destination functional instance of the first data access message do not belong to the same user. In this case, the first physical node discards the first data access message, thereby isolating access between different users.

[0110] As discussed above, when a physical node is the host, it can be scheduled to users of the computing cluster either as a bare metal machine or as a virtual machine (VM). When the host is directly scheduled to a user as a bare metal machine, its resources are exposed to that user. To ensure the reliability of this solution, the host can be configured in untrusted mode, forcing access control to adhere to the configuration data within the FM-only writable configuration space. However, when a VM is scheduled to a user, its resources are not exposed. Therefore, the host can be configured in trusted mode, allowing access control to proceed without adhering to the configuration data within the aforementioned configuration space. This will be discussed further below.

[0111] Taking a first physical node as a host, which includes a first UB controller and a first configuration space as an example, the first configuration space stores the EID of the first UB controller and the UPI of the user object to which the host belongs, as well as the trust mode configured for the first physical node. Under this premise, the first physical node performs access control based on the configuration data in the first configuration space.

[0112] For example, when the trust mode in the first configuration space is the first trust mode (also known as the untrusted mode), the first physical node generates a second data access message based on the UPI in the first configuration space (i.e., the second UPI mentioned above). The first physical node sends the second data access message to the third physical node in the computing cluster. The third physical node is the physical node where the second functional instance resides, and the second functional instance is the destination functional instance of the second data access message. Here, the first trust mode indicates that the first physical node is scheduled for use by the user in the computing cluster in a bare-metal manner. The second data access message carries the second DEID and the UPI in the first configuration space. The second DEID is the EID of the second functional instance. That is, in the untrusted mode, the first physical node generates a data access message based on the UPI in the configuration space. The second functional instance is a different functional instance from the fourth functional instance mentioned above, and the third physical node is a different physical node from the second physical node mentioned above. Of course, the third physical node can also be the same physical node as the second physical node. In this case, the second functional instance and the fourth functional instance mentioned above can be the same functional instance, or they can be different functional instances.

[0113] Optionally, the first physical node further includes a first processor. The first physical node also stores a second mapping relationship. The second mapping relationship records the DEID corresponding to the physical address PA of the memory that each functional instance in the first physical node is allowed to access. The DEID corresponding to the PA is the EID of the functional instance to which the corresponding memory belongs. When the trust mode in the first configuration space is the first trust mode, the implementation process of the first physical node generating a second data access message based on the UPI in the first configuration space includes: the first processor generating a first data access instruction, which instructs the first PA; the first UB controller obtaining a first relation item in the second mapping relationship based on the first PA, the first relation item recording the DEID corresponding to the first PA, which is the second DEID; and the first UB controller generating a second data access message based on the first data access instruction, the first relation item, and the UPI in the first configuration space.

[0114] Optionally, the second mapping relationship also records the UPI corresponding to the PA mentioned above. Here, the UPI refers to the UPI of the corresponding functional instance, that is, the UPI of the source functional instance. However, in the untrusted mode, the first physical node ultimately uses the UPI in the configuration space as the standard to generate data access messages.

[0115] Optionally, the second mapping relationship also records the unified bus memory address (UB address, UBA) corresponding to the PA mentioned above. Accordingly, the second data access message also carries the UBA from the first relationship item. The UBA is used to virtualize the PA, thereby ensuring the security of the physical memory address through the virtual UBA.

[0116] The aforementioned second mapping relationship can be in the form of a table, which can be called a decoder table. This decoder table is used to convert PA to UBA and determine the UPI corresponding to DEID and source function instance. Alternatively, the second mapping relationship can also be in other forms, which are not limited in this embodiment.

[0117] Optionally, the format of the second data access message is similar to that of the first data access message, and will not be repeated here.

[0118] Taking the functional instances on the first physical node, including at least one virtual machine created on the first physical node, as another example, the first physical node also stores a third mapping relationship. This third mapping relationship records the UPIs of the objects used by each virtual machine created on the first physical node. Under this premise, the first physical node performs access control based on the UPIs in the third mapping relationship.

[0119] For example, when the trust mode in the first configuration space is the second trust mode (i.e., trusted mode), the first physical node generates a third data access message based on the fifth UPI in the third mapping relationship. The fifth UPI is the UPI of the user object to which the first virtual machine belongs, and the first virtual machine is a virtual machine created on the first physical node, serving as the source virtual machine for the third data access message. The first physical node sends the third data access message to the fourth physical node in the computing cluster. The fourth physical node is the physical node where the third functional instance resides, and the third functional instance is the destination functional instance for the third data access message. Here, the second trust mode indicates that the first physical node schedules the created virtual machine to the user object in the computing cluster. The third data access message carries the third DEID and the fifth UPI; the third DEID is the EID of the third functional instance. In other words, in trusted mode, the physical node generates the data access message based on the UPI in the third mapping relationship stored outside the configuration space.

[0120] Optionally, the first physical node further includes a first processor. The third mapping relationship records the DEID corresponding to the PA of the memory that each virtual machine created on the first physical node can access, and the UPI of the corresponding virtual machine's user object. The DEID corresponding to the PA is the EID of the functional instance to which the corresponding memory belongs. When the trust mode in the first configuration space is the second trust mode, the process of the first physical node generating a third data access message based on the fifth UPI in the third mapping relationship includes: the first processor generating a second data access instruction, which instructs the second PA; the first UB controller obtaining a second relation item in the third mapping relationship based on the second PA, the second relation item recording the DEID and UPI corresponding to the second PA, which are respectively the third DEID and the fifth UPI; and the first UB controller generating a third data access message based on the second data access instruction and the second relation item.

[0121] Optionally, the third mapping relationship also records the UPI corresponding to the PA mentioned above. Here, the UPI refers to the UPI of the corresponding functional instance, that is, the UPI of the source functional instance. In trusted mode, the physical node generates data access messages based on the UPI in the third mapping relationship.

[0122] Optionally, the third mapping relationship also records the UBA corresponding to the PA mentioned above, and correspondingly, the third data access message also carries the UBA in the second relationship item.

[0123] The aforementioned third mapping relationship can be in the form of a table, which can also be called a decoder table. This decoder table is used to convert PA to UBA and determine the UPI corresponding to DEID and source function instance. Alternatively, the third mapping relationship can also be in other forms, which are not limited in this embodiment.

[0124] Optionally, the format of the second data access message is similar to that of the first data access message, and will not be repeated here.

[0125] Optionally, any of the mapping relationships mentioned above can be stored in the memory of the first physical node or in the UB controller of the first physical node. For example, the first mapping relationship can be stored in the memory of the first physical node, and the second mapping relationship can be stored in the UB controller of the first physical node. Of course, any of the mapping relationships mentioned above can also be stored elsewhere, and this application embodiment does not limit this.

[0126] In this embodiment, if a host is scheduled to a user of the computing cluster in bare metal form, then that host no longer supports scheduling virtual machines (VMs) to users of the computing cluster by creating VMs. When a host schedules VMs to users of the computing cluster by creating VMs, that is, in a VM scenario, the VM has no right to modify the aforementioned first, second, and third mapping relationships. Furthermore, the UPI of unscheduled resource instances in the computing cluster defaults to 0, indicating that the corresponding resource is inaccessible.

[0127] Next, the access control method provided in the embodiments of this application will be explained again by way of example with reference to Figures 7 to 9.

[0128] Figure 7 is a schematic diagram of a configuration space provided in an embodiment of this application. Referring to Figure 7, the host includes at least a processor, a UB controller, and memory. Taking a host including a UB controller as an example, the UB controller has a configuration space that records an EID, a UPI, and a trust mode. Optionally, the configuration space also has a bus function core for performing corresponding operations of the UB controller.

[0129] In a scenario where the host is scheduled to a user in bare metal form, the EID recorded in the configuration space is the EID of the UB controller, the UPI recorded is the UPI of the user to which the host belongs, and the trust mode recorded is the first trust mode (i.e., untrusted mode) mentioned above.

[0130] Referring to Figure 7, the UB device has at least one device instance (two are shown as an example in the figure). Each device instance has a configuration space, which records the EID of the corresponding device instance and the UPI of the user object to which the corresponding device instance belongs. Optionally, each device instance has a device function instance core, which is used to perform the corresponding operations of the corresponding device instance.

[0131] Multiple device instances within a single UB device can be numbered starting from 0. For example, the two device instances in Figure 7 are denoted as FE0 and FE1 within the UB device, respectively. Similarly, if there are multiple UB controllers within a host, these controllers can also be numbered starting from 0. For example, the UB controller shown in Figure 7 is also denoted as FE0 within the host. Of course, in some embodiments, multiple functional instances within a physical node can also be numbered starting from other values, such as 1. In still other embodiments, functional instances can also have other forms of identification, such as FE-a, FE-b, etc.

[0132] In Figure 7, both the host and the UB device are connected to the bus architecture via UB links, which includes the FM. Both the UB controller and the UB device are unified bus devices following the bus / device model. The UB controller is the entry point for the host to access the unified bus, while the UB device is a peripheral providing a specific function, such as a network interface card (NIC), SSD, or NPU. Only the FM has write permissions to the configuration space; the host does not. Taking the host in Figure 7 being scheduled in bare-metal form as an example, the access isolation between the host and device instances is explained exemplarily.

[0133] After the UB device and host power on, all UPIs in the configuration space are set to default values, such as 0. The trust mode in the UB controller's configuration space is set to untrusted mode by default. Only FMs are allowed to configure the configuration space. After the UB controller and UB device receive a configuration management message from the UB link connected to the unified bus, they verify whether the UPI in the message is a reference UPI to identify whether the source of the message is FM. They only accept configuration management messages from FMs to configure the configuration space and discard configuration management messages from any host.

[0134] When the UB controller receives a configuration management message from the processor on the host, it verifies the UPI carried in the message and prohibits the sending of configuration management messages with a reference UPI (such as 0x7FFF). It only allows the sending of configuration management messages carrying UPIs in the configuration space of this UB controller.

[0135] When a UB device receives a data access message, it verifies the UPI carried in the message and only allows messages with the same UPI as those in the configuration space of the destination function instance to pass through. If the message passes through, it continues to access the resource space of the destination function instance (such as the on-chip storage space of the UB device). If the message fails through, it discards the data access message, that is, it discards the access that fails the UPI verification.

[0136] When the UB controller receives a data access message, it verifies the UPI carried in the message. At this time, the host's trust mode indicates that the host is in untrusted mode, and only messages with the same UPI as those in the UB controller's configuration space are allowed to pass. If the message passes, access to the host's memory space continues. If the message fails, the data access message is discarded, i.e., access that fails the UPI verification is discarded.

[0137] When sending data access messages, the device instance of the UB device always carries the UPI from the corresponding configuration space.

[0138] Figure 8 is a schematic diagram of the process of a UB controller sending a data access message according to an embodiment of this application. Referring to Figure 8, the UB controller is the same as the UB controller in Figure 7. The UB controller also includes a TX engine and stores a decoding table, which records the second mapping relationship as described above. Alternatively, the decoding table is stored in the host's memory, and the UB controller caches some or all of the entries of the decoding table. When the host accesses the memory space of a peripheral device, the data access instruction issued by the host's processor is distributed to the UB controller for processing based on the PA address. The TX engine looks up the decoding table based on the PA address to decode and obtain information such as DEID, UBA, and UPI corresponding to the PA. The TX engine encapsulates the data access message based on the decoding result, that is, it encapsulates the decoded DEID and UBA in the message. However, at this time, the host is in untrusted mode, and the TX engine always encapsulates the UPI field of the message with the UPI in the configuration space.

[0139] Figure 9 is a schematic diagram of an access isolation method in a virtual machine scenario provided by an embodiment of this application. In a virtual machine scenario, host resources are usually managed by an administrator, such as the administrator of an infrastructure operator. The users of the virtual machine cannot affect the configuration management of the physical host. Therefore, when scheduling host resources, FM can configure the host to trusted mode.

[0140] When creating a virtual machine (VM), the host connects each VM as an independent functional instance to the unified bus entry point. The FM assigns an EID and UPI to the VM, and the host creates a corresponding first mapping (i.e., the EID-UPI configuration table) and a third mapping (i.e., the decoding table) for the VM. Each mapping can be stored in the host's memory or in the UB controller. Optionally, the host also creates a unified bus memory management unit (UMMU) page table for the VM for address translation.

[0141] When a virtual machine (e.g., virtual machine 1 in Figure 9) accesses a memory space (e.g., the memory space of virtual machine 2 in Figure 9), the data access instruction issued by the processor of the host machine carries a PA address. The instruction is distributed to the UB controller of the host based on the PA address for processing. The TX engine in the UB controller looks up the third mapping relationship based on the PA address and decodes it to obtain the corresponding DEID, UBA, UPI and other information. The TX engine encapsulates the data access message based on the decoding result. At this time, the host is in trusted mode, so the TX engine encapsulates the decoded DEID, UBA and UPI in the data access message.

[0142] When the UB controller receives a data access packet from a virtual machine, even though the DEID carried in the packet is not the UB controller's EID, the host is currently in trusted mode. Therefore, the controller continues to use the DEID in the packet to search the EID-UPI configuration table to determine if the found UPI matches the UPI carried in the packet. Only access with the same UPI is allowed to proceed, and access to the destination virtual machine's memory space is continued, while accesses with failed UPI verification are discarded. If the access is successful, the UMMU page table is queried to perform address translation on the packet, thereby retrieving the corresponding data.

[0143] Figure 9 illustrates access isolation in a virtual machine scenario using virtual machine 1 accessing virtual machine 2 as an example. Virtual machine 1 and virtual machine 2 can be on the same physical node or on different physical nodes.

[0144] In summary, in this embodiment, by uniformly assigning EIDs to functional instances and uniformly assigning UPIs to the user objects to which functional instances belong, when data access occurs between two different functional instances, the data access message carries both EID and UPI. Upon receiving the data access message, the physical node uses its stored UPI to identify whether the requesting functional instance and the destination functional instance belong to the same user object. Access is allowed only if the two functional instances belong to the same user object, thus achieving access isolation between different user objects at the functional instance level. The physical node can be a host or a UB device. The UB device is unaware of the difference between a host and a virtual machine; that is, both bare-metal hosts and virtual machines can be considered as a single functional instance. The UPI-based access isolation method provided in this embodiment does not rely on the host system platform. By restricting write permissions in the configuration space and configuring the host's trust mode, it achieves hardware-level reliable access isolation.

[0145] Figure 10 is a schematic diagram of an access isolation device 1000 provided in an embodiment of this application. The device 1000 can be implemented as part or all of a physical node by software, hardware, or a combination of both. This physical node can be any of the physical nodes shown in Figure 1. In this embodiment, the computing cluster includes multiple physical nodes, each of which has at least one functional instance. These functional instances are used to schedule usage by users of the computing cluster. Each physical node stores the EID of each functional instance within the corresponding physical node and the UPI of the user to which the corresponding functional instance belongs. Different functional instances have different EIDs, and different user objects have different UPIs. Taking the first physical node included in the multiple physical nodes as an example, referring to Figure 10, the device 1000 includes: a first receiving module 1001, a determining module 1002, and a first response module 1003.

[0146] The first receiving module 1001 is used to receive a first data access message sent by the second physical node. The first data access message carries a first UPI and a first destination DEID. The first DEID is the EID of the first functional instance. The first functional instance is a functional instance that the first physical node has. The first physical node and the second physical node are physical nodes in the computing cluster.

[0147] The determination module 1002 is used to determine the second UPI based on the first DEID, wherein the second UPI is the UPI of the object to which the first DEID belongs, stored in the first physical node;

[0148] The first response module 1003 is used to respond to the first data access message when the first UPI and the second UPI are the same.

[0149] Optionally, the device 1000 further includes:

[0150] The discard module is used to discard the first data access message if the first UPI is different from the second UPI.

[0151] Optionally, the first physical node is a host, the first physical node includes a first UB controller, and the host scheduled in bare metal form is a functional instance; or, the first physical node is a UB device, the UB device has at least one device instance, and each device instance is a functional instance;

[0152] Each UB controller and each device instance has a configuration space, which stores the EID of the corresponding functional instance and the UPI of the object to which the corresponding functional instance belongs.

[0153] Optionally, the computing cluster also includes an architecture manager (FM), which has write permissions to the aforementioned configuration space. The FM is used to assign a corresponding EID to each functional instance and a corresponding UPI to each user object.

[0154] Optionally, the device 1000 further includes:

[0155] The second receiving module is used to receive the first configuration management message, which carries the third UPI;

[0156] The second response module is used to respond to the first configuration management message when the third UPI is the same as the reference UPI. The reference UPI is used to identify the configuration management message generated by FM.

[0157] Optionally, the first physical node is a host, and the first physical node further includes a first processor. The first UB controller records a reference UPI, and the device 1000 also includes:

[0158] The first generation module is used to generate a second configuration management message through the first processor, the second configuration management message carrying a fourth UPI;

[0159] The blocking module is used to block the transmission of the second configuration management message through the first UB controller when the fourth UPI is verified to be the same as the reference UPI.

[0160] Optionally, the first functional instance is a device instance of a host or UB device scheduled in bare-metal form, and the determining module 1002 includes:

[0161] The first determination submodule is used to determine the UPI in the first configuration space based on the first DEID, and obtain the second UPI. The first configuration space is the configuration space of the first functional instance.

[0162] Optionally, the first physical node is a UB device, the first physical node has multiple device instances, and the first functional instance is one of the multiple device instances;

[0163] The first determination submodule is specifically used for:

[0164] The first configuration space is determined from the configuration spaces of the multiple device instances based on the first DEID;

[0165] Use the UPI in the first configuration space as the second UPI.

[0166] Optionally, the first physical node is a host, the functional instances on the first physical node include at least one virtual machine created on the first physical node, the first physical node stores a first mapping relationship, the first mapping relationship records the mapping relationship between the EID of each virtual machine created on the first physical node and the UPI of the corresponding virtual machine's user object, and the first functional instance is the first virtual machine created on the first physical node.

[0167] The determination module 1002 includes:

[0168] The second determination submodule is used to determine the UPI corresponding to the first DEID in the first mapping relationship as the second UPI.

[0169] Optionally, the first physical node is a host, which includes a first UB controller. The first UB controller has a first configuration space, which also stores a trust mode configured for the first physical node. The device 1000 further includes:

[0170] The first generation module is used to generate a second data access message based on the UPI in the first configuration space when the trust mode in the first configuration space is the first trust mode.

[0171] The first sending module is used to send a second data access message to a third physical node in the computing cluster. The third physical node is the physical node where the second functional instance is located, and the second functional instance is the destination functional instance of the second data access message.

[0172] In this context, the first trust mode indicates that the first physical node is scheduled to be used by the user in the computing cluster in a bare-metal form, and the second data access message carries the second DEID and the UPI in the first configuration space. The second DEID is the EID of the second functional instance.

[0173] Optionally, the first physical node also includes a first processor, and the first physical node also stores a second mapping relationship. The second mapping relationship records the DEID corresponding to the physical address PA of the memory that each functional instance in the first physical node is allowed to access, and the DEID corresponding to PA is the EID of the functional instance to which the corresponding memory belongs.

[0174] The first generation module includes:

[0175] A first generation submodule is used to generate a first data access instruction through a first processor, the first data access instruction instructing a first PA;

[0176] The first acquisition submodule is used to acquire the first relation item in the second mapping relationship based on the first PA through the first UB controller. The first relation item records the DEID corresponding to the first PA and the DEID corresponding to the first PA is the second DEID.

[0177] The second generation submodule is used to generate a second data access message through the first UB controller based on the first data access instruction, the first relation item, and the UPI in the first configuration space.

[0178] Optionally, the functional instances on the first physical node include at least one virtual machine created on the first physical node, and the first physical node also stores a third mapping relationship, which records the UPI of the user object to which each virtual machine created on the first physical node belongs; the device 1000 further includes:

[0179] The second generation module is used to generate a third data access message based on the fifth UPI in the third mapping relationship when the trust mode in the first configuration space is the second trust mode. The fifth UPI is the UPI of the object to which the first virtual machine belongs. The first virtual machine is a virtual machine created on the first physical node. The first virtual machine is the source virtual machine of the third data access message.

[0180] The second sending module is used to send a third data access message to the fourth physical node in the computing cluster. The fourth physical node is the physical node where the third functional instance is located, and the third functional instance is the destination functional instance of the third data access message.

[0181] The second trust mode means that the first physical node schedules the created virtual machine to the user of the computing cluster by creating a virtual machine. The third data access message carries the third DEID and the fifth UPI. The third DEID is the EID of the third functional instance.

[0182] Optionally, the first physical node also includes a first processor, and the third mapping relationship records the DEID corresponding to the PA of the memory that each virtual machine created on the first physical node can access, and the UPI of the user object to which the corresponding virtual machine belongs, wherein the DEID corresponding to the PA is the EID of the functional instance to which the corresponding memory belongs;

[0183] The second generation module includes:

[0184] The third generation submodule is used to generate a second data access instruction through the first processor, the second data access instruction instructing the second PA;

[0185] The second acquisition submodule is used to acquire the second relation item in the third mapping relationship based on the second PA through the first UB controller. The second relation item records the DEID and UPI corresponding to the second PA. The DEID and UPI corresponding to the second PA are the third DEID and the fifth UPI, respectively.

[0186] The fourth generation submodule is used to generate a third data access message through the first UB controller based on the second data access instruction and the second relation item.

[0187] Optionally, any of the above mapping relationships can be stored in the memory of the first physical node or in the UB controller of the first physical node.

[0188] In this embodiment, an EID is uniformly assigned to a functional instance and a UPI is uniformly assigned to the user object to which the functional instance belongs. When data access is performed between two different functional instances, the DEID and UPI are carried in the data access message. After the physical node receives the data access message, it uses its own stored UPI to identify whether the functional instance requesting access and the target functional instance belong to the same user object. Access is allowed on the premise that the two functional instances belong to the same user object, thereby realizing access isolation between different user objects at the functional instance granularity.

[0189] It should be noted that the access isolation device provided in the above embodiments is only illustrated by the division of the above functional modules when performing access control. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the access isolation device and the access isolation method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0190] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital versatile disc (DVD)), or a semiconductor medium (e.g., solid-state disk (SSD)). It is worth noting that the computer-readable storage medium mentioned in the embodiments of this application can be a non-volatile storage medium; in other words, it can be a non-transient storage medium.

[0191] It should be understood that "at least one" as mentioned herein refers to one or more, and "multiple" refers to two or more. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. In addition, in order to clearly describe the technical solutions of the embodiments of this application, the terms "first," "second," etc., are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or execution order, and the terms "first," "second," etc., are not necessarily different.

[0192] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, data stored, data displayed, etc.) and signals involved in the embodiments of this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0193] The above descriptions are embodiments provided in this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An access isolation method, characterized by, The computing cluster comprises multiple physical nodes, each of which has at least one functional instance. These functional instances are used to schedule applications for use within the computing cluster. Each physical node stores the Entity Identifier (EID) of each functional instance within that physical node and the Uniform Bus Partition Identifier (UPI) of the application to which the functional instance belongs. Different functional instances have different EIDs, and different applications have different UPIs. The method includes: The first physical node receives a first data access message sent by the second physical node. The first data access message carries a first UPI and a first destination DEID. The first DEID is the EID of a first functional instance. The first functional instance is a functional instance possessed by the first physical node. The first physical node and the second physical node are physical nodes in the computing cluster. The first physical node determines the second UPI based on the first DEID, and the second UPI is the UPI of the object to which the first DEID belongs, stored by the first physical node; When the first UPI and the second UPI are the same, the first physical node responds to the first data access message.

2. The method of claim 1, wherein, The method further includes: If the first UPI is different from the second UPI, the first physical node discards the first data access message.

3. The method as described in claim 1 or 2, characterized in that, The first physical node is a host, and the first physical node includes a first controller. The host scheduled in bare metal form is a functional instance; or, the first physical node is a general-purpose device, and the general-purpose device has at least one device instance, each device instance being a functional instance. Each controller and each general device instance has a configuration space that stores the EID of the corresponding functional instance and the UPI of the object to which the corresponding functional instance belongs.

4. The method as described in claim 3, characterized in that, The computing cluster also includes an Architecture Manager (FM), which has write permissions to the configuration space. The FM is used to assign a corresponding EID to each functional instance and a corresponding UPI to each user object.

5. The method as described in claim 4, characterized in that, The method further includes: The first physical node receives a first configuration management message, which carries a third UPI; When the third UPI is the same as the reference UPI, the first physical node responds to the first configuration management message, and the reference UPI is used to identify the configuration management message generated by the FM.

6. The method as described in claim 5, characterized in that, The first physical node is a host, the first physical node further includes a first processor, the first controller records the reference UPI, and the method further includes: The first processor generates a second configuration management message, which carries a fourth UPI. If the first controller verifies that the fourth UPI is the same as the reference UPI, it blocks the transmission of the second configuration management message.

7. The method according to any one of claims 3-5, characterized in that, The first functional instance is a device instance of the host or the general-purpose device scheduled in bare-metal form. The first physical node determines the second UPI based on the first DEID, including: The first physical node determines the UPI in the first configuration space based on the first DEID, and obtains the second UPI. The first configuration space is the configuration space of the first functional instance.

8. The method as described in claim 7, characterized in that, The first physical node is a general-purpose device. The first physical node has multiple device instances. The first functional instance is one of the multiple device instances. The first physical node determines the UPI in the first configuration space based on the first DEID to obtain the second UPI, including: The first physical node determines the first configuration space from the configuration spaces of the plurality of device instances based on the first DEID; The first physical node uses the UPI in the first configuration space as the second UPI.

9. The method according to any one of claims 1-6, characterized in that, The first physical node is a host, and the functional instances on the first physical node include at least one virtual machine created on the first physical node. The first physical node stores a first mapping relationship, which records the mapping relationship between the EID of each virtual machine created on the first physical node and the UPI of the corresponding virtual machine's user object. The first functional instance is the first virtual machine created on the first physical node. The first physical node determines the second UPI based on the first DEID, including: The first physical node determines the UPI corresponding to the first DEID in the first mapping relationship as the second UPI.

10. The method according to any one of claims 3-7, characterized in that, The first physical node is a host, the host includes the first controller, the first controller has a first configuration space, and the first configuration space also stores the trust mode configured for the first physical node; The method further includes: When the trust mode in the first configuration space is the first trust mode, the first physical node generates a second data access message based on the UPI in the first configuration space. The first physical node sends the second data access message to the third physical node in the computing cluster. The third physical node is the physical node where the second functional instance is located, and the second functional instance is the destination functional instance of the second data access message. Wherein, the first trust mode means that the first physical node is scheduled to be used by the user in the computing cluster in the form of bare metal, and the second data access message carries the second DEID and the UPI in the first configuration space, wherein the second DEID is the EID of the second function instance.

11. The method as described in claim 10, characterized in that, The first physical node also includes a first processor. The first physical node also stores a second mapping relationship. The second mapping relationship records the DEID corresponding to the physical address PA of the memory that each functional instance in the first physical node is allowed to access. The DEID corresponding to the PA is the EID of the functional instance to which the corresponding memory belongs. When the trust mode in the first configuration space is the first trust mode, the first physical node generates a second data access message based on the UPI in the first configuration space, including: The first processor generates a first data access instruction, which indicates a first physical address PA; The first controller obtains a first relation item in the second mapping relationship based on the first PA. The first relation item records a DEID corresponding to the first PA, and the DEID corresponding to the first PA is the second DEID. The first controller generates the second data access message based on the first data access instruction, the first relationship item, and the UPI in the first configuration space.

12. The method as described in claim 10 or 11, characterized in that, The functional instances on the first physical node include at least one virtual machine created on the first physical node. The first physical node also stores a third mapping relationship, which records the UPI of the user object to which each virtual machine created on the first physical node belongs; the method further includes: When the trust mode in the first configuration space is the second trust mode, the first physical node generates a third data access message based on the fifth UPI in the third mapping relationship. The fifth UPI is the UPI of the object to which the first virtual machine belongs. The first virtual machine is a virtual machine created on the first physical node. The first virtual machine is the source virtual machine of the third data access message. The first physical node sends the third data access message to the fourth physical node in the computing cluster. The fourth physical node is the physical node where the third functional instance is located, and the third functional instance is the destination functional instance of the third data access message. Wherein, the second trust mode means that the first physical node schedules the created virtual machine to the user of the computing cluster by creating a virtual machine, and the third data access message carries the third DEID and the fifth UPI, wherein the third DEID is the EID of the third functional instance.

13. The method as described in claim 12, characterized in that, The first physical node also includes a first processor. The third mapping relationship records the DEID corresponding to the PA of the memory that each virtual machine created on the first physical node can access, and the UPI of the user object to which the corresponding virtual machine belongs. The DEID corresponding to the PA is the EID of the functional instance to which the corresponding memory belongs. When the trust mode in the first configuration space is the second trust mode, the first physical node generates a third data access message based on the fifth UPI in the third mapping relationship, including: The first processor generates a second data access instruction, which instructs the second PA; The first controller obtains the second relation item in the third mapping relationship based on the second PA. The second relation item records the DEID and UPI corresponding to the second PA. The DEID and UPI corresponding to the second PA are the third DEID and the fifth UPI, respectively. The first controller generates the third data access message based on the second data access instruction and the second relationship item.

14. The method according to any one of claims 9, 11-13, characterized in that, The mapping relationship is stored in the memory of the first physical node or in the controller of the first physical node.

15. An access isolation device, characterized in that, The computing cluster includes multiple physical nodes, each of which has at least one functional instance. The functional instance is used to schedule the computing cluster to be used by the user. Each physical node stores the entity identifier (EID) of each functional instance in the corresponding physical node and the unified bus partition identifier (UPI) of the user to which the corresponding functional instance belongs. Different functional instances have different EIDs, and different user objects have different UPIs. The device includes a first physical node among the plurality of physical nodes, and the device comprises: The first receiving module is configured to receive a first data access message sent by the second physical node. The first data access message carries a first UPI and a first destination DEID. The first DEID is the EID of a first functional instance. The first functional instance is a functional instance possessed by the first physical node. The first physical node and the second physical node are physical nodes in the computing cluster. The determination module is used to determine a second UPI based on the first DEID, wherein the second UPI is the UPI of the user object to which the first DEID belongs, stored in the first physical node; The first response module is used to respond to the first data access message when the first UPI and the second UPI are the same.

16. The apparatus as claimed in claim 15, characterized in that, The device further includes: The discard module is used to discard the first data access message if the first UPI is different from the second UPI.

17. The apparatus as claimed in claim 15 or 16, characterized in that, The first physical node is a host, and the first physical node includes a first controller. The host scheduled in bare metal form is a functional instance; or, the first physical node is a general-purpose device, and the general-purpose device has at least one device instance, each device instance being a functional instance. Each controller and each device instance has a configuration space that stores the EID of the corresponding functional instance and the UPI of the object to which the corresponding functional instance belongs.

18. The apparatus as claimed in claim 17, characterized in that, The computing cluster also includes an Architecture Manager (FM), which has write permissions to the configuration space. The FM is used to assign a corresponding EID to each functional instance and a corresponding UPI to each user object.

19. The apparatus as claimed in claim 18, characterized in that, The device further includes: The second receiving module is used to receive the first configuration management message, wherein the first configuration management message carries a third UPI; The second response module is used to respond to the first configuration management message when the third UPI is the same as the reference UPI, wherein the reference UPI is used to identify the configuration management message generated by the FM.

20. The apparatus as claimed in claim 19, characterized in that, The first physical node is a host, the first physical node further includes a first processor, the first controller records the reference UPI, and the device further includes: A first generation module is configured to generate a second configuration management message through the first processor, wherein the second configuration management message carries a fourth UPI; The blocking module is used to block the transmission of the second configuration management message through the first controller when verifying that the fourth UPI is the same as the reference UPI.

21. The apparatus according to any one of claims 17-19, characterized in that, The first functional instance is a device instance of the host or the general-purpose device that is scheduled in bare-metal form, and the determining module includes: The first determining submodule is used to determine the UPI in the first configuration space based on the first DEID, and obtain the second UPI, wherein the first configuration space is the configuration space of the first functional instance.

22. The apparatus as claimed in claim 21, characterized in that, The first physical node is a general-purpose device, and the first physical node has multiple device instances. The first functional instance is one of the multiple device instances. The first determining submodule is specifically used for: The first configuration space is determined from the configuration spaces of the plurality of device instances based on the first DEID; Use the UPI in the first configuration space as the second UPI.

23. The apparatus according to any one of claims 15-20, characterized in that, The first physical node is a host, and the functional instances on the first physical node include at least one virtual machine created on the first physical node. The first physical node stores a first mapping relationship, which records the mapping relationship between the EID of each virtual machine created on the first physical node and the UPI of the corresponding virtual machine's user object. The first functional instance is the first virtual machine created on the first physical node. The determining module includes: The second determining submodule is used to determine the UPI corresponding to the first DEID in the first mapping relationship as the second UPI.

24. The apparatus according to any one of claims 17-21, characterized in that, The first physical node is a host, the host includes the first controller, the first controller has a first configuration space, and the first configuration space also stores the trust mode configured for the first physical node; The device further includes: The first generation module is used to generate a second data access message based on the UPI in the first configuration space when the trust mode in the first configuration space is the first trust mode. The first sending module is used to send the second data access message to the third physical node in the computing cluster. The third physical node is the physical node where the second functional instance is located, and the second functional instance is the destination functional instance of the second data access message. Wherein, the first trust mode means that the first physical node is scheduled to be used by the user in the computing cluster in the form of bare metal, and the second data access message carries the second DEID and the UPI in the first configuration space, wherein the second DEID is the EID of the second function instance.

25. The apparatus as claimed in claim 24, characterized in that, The first physical node also includes a first processor. The first physical node also stores a second mapping relationship. The second mapping relationship records the DEID corresponding to the physical address PA of the memory that each functional instance in the first physical node is allowed to access. The DEID corresponding to the PA is the EID of the functional instance to which the corresponding memory belongs. The first generation module includes: A first generation submodule is configured to generate a first data access instruction through the first processor, wherein the first data access instruction indicates a first physical address PA; The first acquisition submodule is used to acquire a first relation item in the second mapping relationship based on the first PA through the first controller. The first relation item records a DEID corresponding to the first PA, and the DEID corresponding to the first PA is the second DEID. The second generation submodule is used to generate the second data access message through the first controller based on the first data access instruction, the first relation item, and the UPI in the first configuration space.

26. The apparatus as claimed in claim 24 or 25, characterized in that, The functional instances on the first physical node include at least one virtual machine created on the first physical node. The first physical node also stores a third mapping relationship, which records the UPI of the user object to which each virtual machine created on the first physical node belongs; the device further includes: The second generation module is used to generate a third data access message based on the fifth UPI in the third mapping relationship when the trust mode in the first configuration space is the second trust mode. The fifth UPI is the UPI of the object to which the first virtual machine belongs. The first virtual machine is a virtual machine created on the first physical node. The first virtual machine is the source virtual machine of the third data access message. The second sending module is used to send the third data access message to the fourth physical node in the computing cluster. The fourth physical node is the physical node where the third functional instance is located, and the third functional instance is the destination functional instance of the third data access message. Wherein, the second trust mode means that the first physical node schedules the created virtual machine to the user of the computing cluster by creating a virtual machine, and the third data access message carries the third DEID and the fifth UPI, wherein the third DEID is the EID of the third functional instance.

27. The apparatus as claimed in claim 26, characterized in that, The first physical node also includes a first processor. The third mapping relationship records the DEID corresponding to the PA of the memory that each virtual machine created on the first physical node can access, and the UPI of the user object to which the corresponding virtual machine belongs. The DEID corresponding to the PA is the EID of the functional instance to which the corresponding memory belongs. The second generation module includes: The third generation submodule is used to generate a second data access instruction through the first processor, wherein the second data access instruction instructs the second PA; The second acquisition submodule is used to acquire the second relation item in the third mapping relationship based on the second PA through the first controller. The second relation item records the DEID and UPI corresponding to the second PA. The DEID and UPI corresponding to the second PA are the third DEID and the fifth UPI, respectively. The fourth generation submodule is used to generate the third data access message through the first controller based on the second data access instruction and the second relationship item.

28. The apparatus according to any one of claims 23, 25-27, characterized in that, The mapping relationship is stored in the memory of the first physical node or in the controller of the first physical node.

29. A computing cluster, characterized in that, The computing cluster includes multiple physical nodes, which are used to perform the steps of the method as described in any one of claims 1-14.

30. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1-14.

31. A computer program product, characterized in that, The computer program product stores computer instructions, which, when executed by a processor, implement the method described in any one of claims 1-14.

Images