Management and control method and apparatus, and computing device and cluster
By introducing target-identified control and business messages into the cluster, the efficiency and security issues of cluster node management are solved, enabling in-band management and hierarchical access control, reducing costs and improving security and decoupling.
Patent Information
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- HUAWEI TECH CO LTD
- Filing Date
- 2025-07-29
- Publication Date
- 2026-07-30
AI Technical Summary
How to effectively manage and control the nodes within a cluster, especially to improve security and efficiency without increasing costs.
By introducing control and service messages with target identifiers into the cluster, and using the target identifiers to determine message permissions, in-band management and hierarchical permissions are achieved. This avoids building a separate logical channel, and uses the service message logical channel to transmit control messages. Combined with permission authentication and interception mechanisms, security and efficiency are ensured.
It enables efficient in-band management of each node in the cluster, reduces management and control costs, improves security and decoupling, and ensures the independence and security of the management and control plane and the business plane.
Smart Images
Figure CN2025111308_30072026_PF_FP_ABST
Abstract
Description
Control methods, devices, computing equipment and clusters
[0001] This application claims priority to Chinese Patent Application No. 202510126578.X, filed with the State Intellectual Property Office of China on January 26, 2025, entitled "Control Method, Apparatus, Computing Device and Cluster", the entire contents of which are incorporated herein by reference. Technical Field
[0002] This application relates to the field of computer technology, and more particularly to a control method, apparatus, computing device, and cluster. Background Technology
[0003] A cluster refers to a highly efficient, intelligent, and flexible computing environment formed by interconnecting multiple nodes. Nodes in a cluster can be servers, central processing units (CPUs), graphics processing units (GPUs), neural network processing units (NPUs), and memory, among other things.
[0004] Currently, the common approach for large-scale computing tasks is to build a cluster, which completes the large-scale computing tasks through close collaboration among multiple nodes in the cluster, thereby improving job efficiency.
[0005] Since a cluster consists of multiple nodes, how to manage and control each node within the cluster is a technical problem that needs to be solved by those in the field. Summary of the Invention
[0006] In view of this, this application provides a management and control method, apparatus, computing device and cluster for managing and controlling each node in a cluster (such as a supernode, computing cluster, etc.).
[0007] To achieve the above objectives, in a first aspect, embodiments of this application provide a management and control method applied to a management and control node in a cluster, the method comprising:
[0008] A first message carrying a target identifier is sent to the service nodes in the cluster. The target identifier is used to identify the permissions of the first message. The message type of the first message can include control messages and service messages, with control messages having higher permissions than service messages.
[0009] The control method provided in this embodiment involves a control node in the cluster sending a first message carrying a target identifier to a service node. The target identifier identifies the permissions of the first message. The message type of the first message can include both control messages and service messages, with control messages having higher permissions than service messages. This allows service nodes to determine the permissions of the first message based on the target identifier, then determine its message type, and finally execute the corresponding task. In other words, service nodes can determine the message type of the first message based on its permissions corresponding to the target identifier, eliminating the need to construct a separate logical channel for transmitting control messages. Control messages can be transmitted using the logical channel for service messages. Therefore, the solution in this application can deploy the control plane based on the existing service topology of the cluster, enabling in-band management of each node in the cluster. Furthermore, this solution uses the target identifier to implement hierarchical permissions for control traffic (i.e., control messages) and service traffic (i.e., service messages), thereby decoupling the service plane and control plane and improving the security of the control plane.
[0010] In-band management refers to transmitting network management and control information and user network service information through the same logical channel. In other words, management traffic and service traffic share the same network resources.
[0011] In one possible implementation of the first aspect, if the first message has superuser privileges, then the first message is a control message; if the first message has non-superuser privileges, then the first message is a service message. Superuser privileges typically refer to the highest level of access and control permissions obtained by a user or application in an operating system. Different operating systems may correspond to different superuser privileges; for example, the superuser privilege in a Linux operating system can be root, while the superuser privilege in a Windows operating system can be administrator.
[0012] Through the above implementation method, super privileges can be used as the identifier of control messages. In this way, business nodes only need to identify whether the target identifier message in the message corresponds to super privileges to identify the message type, which is a simple identification method.
[0013] In one possible implementation of the first aspect, the permissions of a service message are related to its service type. For example, if the service type of a service message is ordinary service, the permissions of the service message can be non-secure; if the service type of a service message is confidential computing, the permissions of the service message can be secure.
[0014] Through the above implementation method, corresponding permissions can be flexibly set for business messages according to their business type, enabling business messages to adapt to more business types.
[0015] In one possible implementation of the first aspect, the method further includes: if the target service node requests access to the cluster, then performing permission authentication on the target service node;
[0016] If the target business node is successfully authenticated, it is allowed to access the cluster. The authenticated target business node is used to send business messages.
[0017] The above implementation method enables business nodes that access the cluster through authentication to send only business messages and not control messages with high privileges.
[0018] In one possible implementation of the first aspect, authentication of the target service node includes:
[0019] Determine the permission attributes of the target register of the target service node. The target register is used to store the target identifier carried in the message sent by the target service node.
[0020] If the permission attributes of the target register are configured by the management node, then the target service node is determined to have passed the permission authentication.
[0021] Through the above implementation method, it can be ensured that the permission attributes of the register used by the authenticated business node to store the target identifier are configured by the management node. In this way, when the business node sends a business message, it will assign the corresponding permission level to the business message through the register. The business message cannot specify its own permission level, thereby ensuring that the business node cannot send messages with management permissions.
[0022] Secondly, embodiments of this application provide a management and control device applied to a management and control node in a cluster, the device comprising:
[0023] The sending module is used to send the first message to the service nodes in the cluster. The first message carries a target identifier, which is used to identify the permissions of the first message. The message type of the first message includes control messages and service messages. Control messages have higher permissions than service messages.
[0024] In one possible implementation of the second aspect, if the first message has super privileges, then the first message is a control message; if the first message has non-super privileges, then the first message is a service message.
[0025] In one possible implementation of the second aspect, the permissions of the service message are related to the service type of the service message.
[0026] In one possible implementation of the second aspect, the apparatus further includes: an authentication module, used to perform permission authentication on the target service node if the target service node requests access to the cluster;
[0027] If the target business node is successfully authenticated, it is allowed to access the cluster. The authenticated target business node is used to send business messages.
[0028] In one possible implementation of the second aspect, the authentication module is specifically used for:
[0029] Determine the permission attributes of the target register of the target service node. The target register is used to store the target identifier carried in the message sent by the target service node.
[0030] If the permission attributes of the target register are configured by the management node, then the target service node is determined to have passed the permission authentication.
[0031] Thirdly, embodiments of this application provide a management and control method applied to service nodes in a cluster, the method comprising:
[0032] Receive the first message sent by the control node. The first message carries a target identifier, which is used to identify the permission of the first message. The message type of the first message includes control messages and service messages. The permissions of control messages are higher than those of service messages.
[0033] Determine the message type of the first message based on the permissions corresponding to the target identifier;
[0034] If the message type of the first message is a control message, execute the control task corresponding to the first message;
[0035] If the message type of the first message is a business message, execute the business task corresponding to the first message.
[0036] In one possible implementation of the third aspect, the method further includes: intercepting control messages sent from the cluster's external network.
[0037] The above implementation method can intercept control messages sent from external networks, ensuring that the control messages received by each service node in the cluster all come from the control node in the cluster.
[0038] In one possible implementation of the third aspect, intercepting control messages sent from the cluster's external network includes:
[0039] By using the port connected to the external network, control messages sent from the external network are intercepted.
[0040] Fourthly, embodiments of this application provide a management and control device applied to service nodes in a cluster, the device comprising:
[0041] The receiving module is used to receive the first message sent by the control node. The first message carries a target identifier, which is used to identify the permission of the first message. The message type of the first message includes control messages and service messages. The permissions of control messages are higher than those of service messages.
[0042] Determining module: Used to determine the message type of the first message based on the permissions corresponding to the target identifier;
[0043] Execution module: Used to execute the control task corresponding to the first message when the message type of the first message is a control message;
[0044] If the message type of the first message is a business message, execute the business task corresponding to the first message.
[0045] In one possible implementation of the fourth aspect, the apparatus further includes an interception module for intercepting control messages sent from the cluster’s external network.
[0046] In one possible implementation of the fourth aspect, the interception module is specifically used to: intercept control messages received from the external network through a port connected to the external network.
[0047] Fifthly, embodiments of this application provide a computing device, including: a memory and a processor, wherein the memory is used to store a computer program; and the processor is used to execute the method described in any of the embodiments of the first or third aspect above when the computer program is invoked.
[0048] Sixthly, embodiments of this application provide a cluster, including: a management node and service nodes. The management node is used to execute the method as described in the first aspect or any embodiment of the first aspect, and the service nodes are used to execute the method as described in the third aspect or any embodiment of the third aspect. Specifically, the cluster here can be a computing cluster or a supernode.
[0049] In a seventh aspect, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the embodiments of the first or third aspect described above.
[0050] Eighthly, embodiments of this application provide a computer program product that, when run on a computing device, causes the computing device to perform the method described in any of the embodiments of the first or third aspect described above.
[0051] Ninthly, embodiments of this application provide a chip system including a processor coupled to a memory. The processor executes a computer program stored in the memory to implement the method described in any of the embodiments of the first or third aspects. The chip system may be a single chip or a chip module composed of multiple chips.
[0052] It is understood that the beneficial effects of aspects two through nine above can be found in the relevant descriptions in aspect one above, and will not be repeated here. Attached Figure Description
[0053] Figures 1 and 2 are schematic diagrams of the cluster provided in the embodiments of this application;
[0054] Figure 3 is a flowchart illustrating the control method provided in this embodiment when applied to a computing cluster.
[0055] Figure 4 is a schematic diagram of the computing cluster provided in an embodiment of this application;
[0056] Figure 5 is a schematic diagram of the first message provided in an embodiment of this application;
[0057] Figure 6 is a schematic diagram of a control device provided in an embodiment of this application;
[0058] Figure 7 is a schematic diagram of another control device provided in an embodiment of this application;
[0059] Figure 8 is a schematic diagram of the structure of the computing device provided in the embodiment of this application. Detailed Implementation
[0060] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is only for explaining specific embodiments and is not intended to limit the application. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.
[0061] A cluster refers to interconnecting multiple nodes (such as servers, CPUs, GPUs, NPUs, and memory) to form a highly efficient, intelligent, and flexible computing environment. For large-scale computing tasks, clusters are typically built, where the nodes within the cluster collaborate closely to complete the task and improve efficiency. The methods of building a cluster may differ depending on whether the nodes are servers or CPUs, GPUs, NPUs, and memory. The following example illustrates how to build a cluster using servers as the nodes; such a cluster can also be called a computing cluster. Since this invention does not limit the cluster construction method, other methods will not be detailed here, but only briefly explained. For example, when the nodes in the cluster are CPUs, GPUs, NPUs, and memory, multiple CPUs can form a CPU resource pool, multiple GPUs can form a GPU resource pool, multiple NPUs can form an NPU resource pool, and multiple memory modules can exist in multiple memory pools. These resource pools can collectively build a supercomputing node. These nodes communicate via a bus or network protocol; a cluster built in this way can also be called a supernode.
[0062] One way to build a cluster is to deploy multiple servers within a single rack. For example, as shown in Figure 1, servers 1, 2, 3...n in rack 1 are all connected to switch 1, forming a cluster. Multiple servers can perform different computing tasks individually or collaboratively. The servers used to build the cluster can be general-purpose computing servers or artificial intelligence (AI) computing servers.
[0063] Another way to build a cluster is to connect multiple racks using switches, with each rack housing multiple servers. For example, as shown in Figure 2, servers 1, 2, 3...n in rack 1 are all connected to switch 1, and servers n+1, n+2, n+3...2n in rack 2 are all connected to switch 2. Switches 1 and 2 are connected via switch 3. The servers in racks 1 and 2, along with switches 1, 2, and 3, form a cluster.
[0064] Since the cluster comprises multiple servers, a management role is needed to centrally and uniformly manage all servers within the cluster. This includes tasks such as address allocation, routing management, resource allocation, and handling issues related to reliability, availability, and serviceability.
[0065] One approach to cluster management involves building independent fabric management (FM) software on the server's baseboard management controller (BMC) chip to manage the entire cluster. FM software typically requires a low-speed out-of-band bus, such as a system management bus (SMBus), to manage each node. This method relies on a single BMC chip to host the management software and requires additional low-speed out-of-band buses for cluster management, resulting in high costs.
[0066] Another approach to cluster management is to use a dedicated server for control and management, building an Ethernet control plane within the cluster and managing it based on the Transmission Control Protocol / Internet Protocol (TCP / IP) stack. This method requires deploying an additional dedicated Ethernet server and the control plane protocol stack, and also incurs higher costs.
[0067] To address this, this application provides a management and control method that involves a management and control node in a cluster sending a first message carrying a target identifier to service nodes. The target identifier identifies the permissions of the first message, and the message type of the first message can include both management and control messages and service messages, with management and control messages having higher permissions than service messages. This allows service nodes to determine the permissions of the first message based on the target identifier, then determine the message type based on the permissions, and finally execute the corresponding task (such as a management and control task or a service task) based on the message type. In other words, service nodes can determine the message type of the first message based on the permissions corresponding to the target identifier, eliminating the need to construct a separate logical channel for transmitting management and control messages; management and control messages can be transmitted using the logical channel for service messages. Therefore, the solution of this application can deploy management and control planes based on the existing service topology of the cluster, achieving in-band management of each node in the cluster and reducing the management and control costs of the cluster. Furthermore, this solution uses target identifiers to implement hierarchical access control for traffic (i.e., control messages) and business traffic (i.e., business messages), thereby decoupling the business plane and the control plane and improving the security of the control plane.
[0068] In some embodiments, the service node can also directly determine the message type of the first message based on the target identifier carried in the first message. For example, if the value corresponding to the target identifier in the first message is 1, the service node can determine that the first message is a control message; if the value corresponding to the target identifier in the first message is 0, the service node can determine that the first message is a service message. The embodiments of this application will subsequently use the example of first determining the permissions of the first message based on the target identifier of the first message, and then determining the message type of the first message based on the permissions of the first message, to provide an exemplary description.
[0069] The control method provided in this invention can be applied to different cluster domains. The cluster can be a computing cluster or it can include supernodes, etc.
[0070] The control method provided in this application can be applied to computing clusters, which may include control nodes and service nodes. Control nodes and service nodes may be computing devices, such as desktop computers, netbooks, tablet computers, handheld computers, etc.
[0071] Figure 3 is a flowchart illustrating the control method provided in this embodiment of the application when applied to a computing cluster. As shown in Figure 3, the method may include the following steps:
[0072] S110, The business node sends a request to the management node to access the computing cluster.
[0073] When a business node connects to the computing cluster, it can first send a request to the management node of the computing cluster to connect to the computing cluster. Only if the management node of the computing cluster allows it can the business node connect to the computing cluster.
[0074] The request sent by a business node to access the computing cluster can carry the identifier of the business node, such as the device name and device serial number.
[0075] In some embodiments, users can specify the control node of the computing cluster through a specific out-of-band channel (a communication or signal transmission channel outside a specific frequency band or channel) or a specific physical link. The control node can be deployed on a standalone computing device, which can be used solely for sending control messages. In some embodiments, the control node can also be deployed by deploying control software on service nodes. Service nodes with the control software deployed can act as either control nodes sending control messages or service nodes sending service messages. The embodiments in this application will subsequently illustrate this by assuming the control node only sends control messages.
[0076] S120. The control node receives the request from the business node to access the computing cluster, and performs authorization authentication on the business node. If the business node is successfully authenticated, step S120 is executed; otherwise, step S130 is executed.
[0077] After receiving a request from a business node to access the computing cluster, the control node can first authenticate the business node to verify its security.
[0078] In some embodiments, the control node can first determine the permission attributes of the target register of the service node requesting access to the computing cluster. The target register can be used to store the target identifier carried in the message sent by the service node. In this way, when the service node sends a message, the target register can control the encapsulation of the target identifier, and the permission attributes of the target register can control the permission level of the message sent by the service node.
[0079] If the permission attributes of the target register of a service node are configured by the management node, it means that the service messages sent by the service node can only be assigned permission levels through this register and cannot be modified by the service software. In this case, the service node passes the authentication and the management node allows the service node to access the computing cluster. If the permission attributes of the target register are not configured by the management node, it means that the permission level of the service messages sent by the service node may be modified by the service software, and the permission level of the service messages sent by the service node cannot be guaranteed. In this case, the service node fails the authentication and the management node prohibits the service node from accessing the computing cluster.
[0080] The control node can directly configure the permission attributes of the target registers of the service nodes, or it can configure the permission attributes of the target registers of the service nodes through the security firmware of the service nodes. After the permission attributes of the target registers of the service nodes are configured by the control node, the service nodes can only send service messages with lower permissions and cannot send control messages with higher permissions (such as super permissions).
[0081] After configuring the permission attributes of the target registers of the service nodes, the management node can save the service node's identifier (such as the device serial number). When authenticating a service node, the management node only needs to check if the device serial number of the service node is saved. If the device serial number is saved, it means the management node has configured the permission attributes of the service node's target registers, the service node passes authentication, and the management node allows the service node to access the computing cluster. If the device serial number is not saved, it means the management node has not configured the permission attributes of the service node's target registers, the service node fails authentication, and the management node prohibits the service node from accessing the computing cluster.
[0082] S130, the control node allows business nodes to access the computing cluster.
[0083] If a business node passes the authorization authentication, the management node allows the business node to access the computing cluster. The business node accessing the computing cluster can only send business messages and cannot send management messages.
[0084] S140. Control nodes are prohibited from accessing the computing cluster.
[0085] If a business node fails to pass authorization authentication, the control node will prohibit that business node from accessing the computing cluster.
[0086] S150. The control node sends the first message to the service node. The first message carries a target identifier, which is used to identify the permissions of the first message.
[0087] The message type of the first message can include control messages and business messages, and the permissions of control messages can be higher than those of business messages.
[0088] In some embodiments, the permissions for control messages can be secure, while the permissions for service messages can be non-secure.
[0089] In some embodiments, the permissions for control messages can be superuser privileges, while the permissions for service messages can be non-superuser privileges. Different operating systems may correspond to different superuser privileges; for example, the superuser privilege for Linux operating systems can be root, while the superuser privilege for Windows operating systems can be administrator. This application embodiment will subsequently use the example of control messages having root privileges and service messages having non-root privileges for illustrative purposes.
[0090] For example, as shown in Figure 4, the computing cluster includes one management node and four service nodes. The control messages issued by the management node correspond to root privileges, while the service messages issued by the four service nodes correspond to non-root privileges.
[0091] The specific permissions of a service message can be related to its service type. For example, if the service type of a service message is ordinary service, the permission of the service message can be non-secure; if the service type of a service message is confidential computing, the permission of the service message can be secure.
[0092] The target identifier can be located in the target field of the first message. The size of the target field can be determined according to the type of permission corresponding to the first message, and the position of the target field in the first message can be adjusted. For example, as shown in Figure 5, the first message includes 4 bytes: Byte0, Byte1, Byte2, and Byte3. The target field is bits 4 and 5 of Byte1. Different values of the target field can indicate different permissions for the first message. For example, a target field value of [1:0] indicates that the first message has root permission; a target field value of [0:0] indicates that the first message has secure permission; and a target field value of [1:1] indicates that the first message has non-secure permission.
[0093] S160. The service node receives the first message sent by the control node, and determines the message type of the first message according to the permission corresponding to the target identifier in the first message. If the message type of the first message is a control message, then step S170 is executed; if the message type of the first message is a service message, then step S180 is executed.
[0094] After receiving the first message from the control node, the service node can first obtain the value of the target field segment (i.e., the target identifier) of the first message, then determine the permissions of the first message based on the value of the target field segment, then determine the message type of the first message based on the permissions, and finally execute the corresponding task based on the message type. That is, the service node can determine the message type of the first message based on the permissions of the first message corresponding to the target identifier. This eliminates the need to construct a separate logical channel to transmit control messages; control messages can use the logical channel of service messages for transmission. Therefore, the solution of this application can deploy the control plane based on the existing service topology of the computing cluster, realizing in-band management of each node in the computing cluster and reducing the control cost of the computing cluster. Furthermore, this solution uses the target identifier to achieve hierarchical permission classification for control messages and various service messages, thereby decoupling the service plane and the control plane and improving the security of the control plane.
[0095] For example, if the value of the target domain segment is [1:0], then the permission of the first message can be determined to be root permission. Correspondingly, the message type of the first message is a control message, and the business node can execute the control task corresponding to the first message.
[0096] If the value of the target domain segment is [0:0], then the permission of the first message can be determined to be secure. Correspondingly, the message type of the first message is a business message, and the business node can execute the business task corresponding to the first message, such as confidential computing.
[0097] If the value of the target domain segment is [1:1], then the permission of the first message can be determined to be non-secure. Correspondingly, the message type of the first message is a business message, and the business node can execute the business task corresponding to the first message, such as non-confidential calculation.
[0098] In some embodiments, a service node may also receive service messages sent by other service nodes in the computing cluster and execute the corresponding service tasks.
[0099] S170, The business node executes the control task corresponding to the first message.
[0100] When the message type of the first message is a business message, the business node can execute the business task corresponding to the first message, such as confidential computing, non-confidential computing, or ordinary business.
[0101] S180, The service node executes the service task corresponding to the first message.
[0102] When the first message is a control message, the service node can execute the control tasks corresponding to the first message, such as address allocation, routing management, resource allocation, and reliability, availability, and serviceability (RAS) processing.
[0103] S190, the business node intercepts control messages sent from the external network of the computing cluster.
[0104] For business nodes communicating with the outside world within the computing cluster (e.g., boundary nodes of the computing cluster), when they receive control messages from the external network of the computing cluster, they need to intercept the messages to ensure that the control messages received by each business node in the computing cluster come from the control nodes in the computing cluster.
[0105] In some embodiments, service nodes communicating with external networks can intercept control messages received from external networks through ports accessing external networks.
[0106] In some embodiments, service nodes communicating with external entities can also intercept control messages received from external networks through other modules (such as an interception module).
[0107] The control method provided in this application can also be applied to supernodes. Supernodes can include control nodes and business nodes, which can be computing devices such as desktop computers, netbooks, tablets, and handheld computers.
[0108] In some embodiments, the control node and service nodes can also be CPUs, GPUs, NPUs, and memory, etc. For example, the control node and service nodes of supernode 1 are both GPUs. The control node and service nodes of supernode 2 are both NPUs. The control node of supernode 3 is a GPU, and the service nodes include NPUs and memory. The control node of supernode 4 is a CPU, and the service nodes are GPUs, NPUs, and memory.
[0109] The implementation method for applying the control method to a supernode is similar to the implementation method for applying the control method to a computing cluster, and will not be repeated here.
[0110] This application provides a control method in which a control node in a cluster sends a first message carrying a target identifier to a service node. The target identifier identifies the permissions of the first message, and the message type of the first message can include both control messages and service messages, with control messages having higher permissions than service messages. This allows service nodes to determine the permissions of the first message based on the target identifier, then determine the message type based on the permissions, and finally execute the corresponding task based on the message type. In other words, service nodes can determine the message type of the first message based on the permissions corresponding to the target identifier, eliminating the need to construct a separate logical channel for transmitting control messages; control messages can use the logical channel for service messages. Therefore, this application's solution can deploy control plane based on the existing service topology of the cluster, enabling in-band management of each node in the cluster and reducing cluster control costs. Furthermore, this solution uses the target identifier to implement hierarchical permissions for control traffic and service traffic, thereby decoupling the service plane and control plane and improving the security of the control plane.
[0111] Those skilled in the art will understand that the above embodiments are exemplary and not intended to limit this application. Where possible, the execution order of one or more of the above steps can be adjusted. For example, in some embodiments, step S190 can be executed before any of steps S150 to S180; in some embodiments, step S190 can be executed simultaneously with any of steps S150 to S180. Selective combinations can also be made to obtain one or more other embodiments. For example, in some embodiments, steps S110 to S140 may not be executed; in some embodiments, step S190 may not be executed; and in some embodiments, steps S110 to S140 and step S190 may all be omitted. Those skilled in the art can arbitrarily select and combine the above steps as needed; anything that does not depart from the essence of the present application falls within the protection scope of this application.
[0112] Based on the same concept, as an implementation of the method for executing the control node in the above embodiments, this application provides a control device applied to the control node. This device embodiment corresponds to the aforementioned method embodiment for executing the control node. For ease of reading, this device embodiment will not elaborate on the details of the aforementioned method embodiment for executing the control node, but it should be clear that the device in this embodiment can correspondingly implement all the contents of the aforementioned method embodiment for executing the control node.
[0113] Figure 6 is a schematic diagram of a control device provided in an embodiment of this application. As shown in Figure 6, the device provided in this embodiment includes:
[0114] The sending module 210 is used to send a first message to the service nodes in the cluster. The first message carries a target identifier, which is used to identify the permissions of the first message. The message type of the first message includes control messages and service messages. The permissions of control messages are higher than those of service messages.
[0115] As an optional implementation, if the first message has super privileges, then the first message is a control message; if the first message has non-super privileges, then the first message is a business message.
[0116] As an optional implementation method, the permissions of a service message are related to the service type of the service message.
[0117] As an optional implementation, the device further includes: an authentication module 220, used to perform authorization authentication on the target service node if the target service node requests access to the cluster;
[0118] Once the target business node is successfully authenticated, it is allowed to access the cluster. The authenticated target business node is used to send business messages.
[0119] As an optional implementation, the authentication module 220 is specifically used for:
[0120] Determine the permission attributes of the target register of the target service node. The target register is used to store the target identifier carried in the message sent by the target service node.
[0121] If the permission attributes of the target register are configured by the management node, then the target service node is determined to have passed the permission authentication.
[0122] The device provided in this embodiment can execute the method of controlling the node execution in the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.
[0123] Based on the same concept, as an implementation of the method for executing business nodes in the above embodiments, this application provides another control device applied to business nodes. This device embodiment corresponds to the aforementioned method embodiment for executing business nodes. For ease of reading, this device embodiment will not elaborate on the details of the aforementioned method embodiment for executing business nodes one by one, but it should be clear that the device in this embodiment can correspondingly implement all the contents of the aforementioned method embodiment for executing business nodes.
[0124] Figure 7 is a schematic diagram of another control device provided in an embodiment of this application. As shown in Figure 7, the device provided in this embodiment includes:
[0125] The receiving module 310 is used to receive the first message sent by the control node. The first message carries a target identifier, which is used to identify the permission of the first message. The message type of the first message includes control messages and service messages. The permission of the control message is higher than that of the service message.
[0126] Determine module 320: Used to determine the message type of the first message based on the permissions corresponding to the target identifier;
[0127] Execution module 330: Used to execute the control task corresponding to the first message when the message type of the first message is a control message;
[0128] If the message type of the first message is a business message, execute the business task corresponding to the first message.
[0129] As an optional implementation, the device further includes an interception module 340 for intercepting control messages sent from the external network of the cluster.
[0130] As an optional implementation, the interception module 340 is specifically used to: intercept control messages received from the external network through the port accessing the external network.
[0131] The device provided in this embodiment can execute the method of the business node in the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.
[0132] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.
[0133] Based on the same concept, this application embodiment also provides a computing device. Figure 8 is a structural schematic diagram of the computing device provided in this application embodiment. As shown in Figure 8, the computing device provided in this application embodiment may include: a memory 410 and a processor 420. The memory 410 is used to store computer programs; the processor 420 is used to implement the method described in the above method embodiment when the computer program is called.
[0134] The computing device provided in this embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so they will not be described again here.
[0135] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the methods described in the above-described method embodiments.
[0136] This application also provides a computer program product that, when run on an electronic device, causes the electronic device to implement the method described in the above-described method embodiments.
[0137] This application also provides a chip system including a processor coupled to a memory. The processor executes a computer program stored in the memory to implement the method described in the above-described method embodiments. The chip system may be a single chip or a chip module composed of multiple chips.
[0138] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, or magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).
[0139] Those skilled in the art will understand that implementing all or part of the processes in the above embodiments can be accomplished by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium can include various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.
[0140] The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical order indicated by the naming or numbering. The execution order of the named or numbered process steps can be changed according to the technical purpose to be achieved, as long as the same or similar technical effect can be achieved.
[0141] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.
[0142] In the embodiments provided in this application, it should be understood that the disclosed apparatus / devices and methods can be implemented in other ways. For example, the apparatus / device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
[0143] It should be understood that in the description of this application and the appended claims, the terms "comprising," "including," "having," and any variations thereof are intended to cover a non-exclusive inclusion and mean "including but not limited to," unless otherwise specifically emphasized. For example, a process, method, system, product, or apparatus that includes a series of steps or modules is not necessarily limited to those steps or modules that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such process, method, product, or apparatus.
[0144] In the description of this application, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can mean A or B. "And / or" in this application is used to describe the relationship between the related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural.
[0145] Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.
[0146] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."
[0147] Furthermore, in the description of this application and the appended claims, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein; features defined as "first" or "second" may explicitly or implicitly include at least one of those features.
[0148] In the embodiments described in this application specification, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of this application specification should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.
[0149] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this specification include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in still other embodiments" appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.
[0150] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.
Claims
1. A control method, characterized in that, The method, applied to management nodes in a cluster, includes: A first message is sent to the service nodes in the cluster. The first message carries a target identifier, which is used to identify the permissions of the first message. The message type of the first message includes control messages and service messages, and the permissions of the control messages are higher than those of the service messages.
2. The method according to claim 1, characterized in that, If the first message has super privileges, then the first message is a control message; if the first message has non-super privileges, then the first message is a business message.
3. The method according to claim 1 or 2, characterized in that, The permissions of the service message are related to the service type of the service message.
4. The method according to any one of claims 1-3, characterized in that, The method further includes: if a target business node requests access to the cluster, then performing permission authentication on the target business node; If the target service node is successfully authenticated, it is allowed to access the cluster, and the authenticated target service node is used to send service messages.
5. The method according to claim 4, characterized in that, The authorization authentication of the target service node includes: Determine the permission attributes of the target register of the target service node, wherein the target register is used to store the target identifier carried in the message sent by the target service node; If the permission attributes of the target register are configured by the control node, then the target service node is determined to have passed the permission authentication.
6. A control method, characterized in that, The method, applied to business nodes in a cluster, includes: The system receives a first message sent by a control node. The first message carries a target identifier, which is used to identify the permissions of the first message. The message type of the first message includes control messages and service messages, and the permissions of the control messages are higher than those of the service messages. The message type of the first message is determined based on the permissions corresponding to the target identifier; If the message type of the first message is a control message, execute the control task corresponding to the first message; If the message type of the first message is a business message, the business task corresponding to the first message is executed.
7. The method according to claim 6, characterized in that, The method further includes: intercepting control messages sent from the external network of the cluster.
8. The method according to claim 7, characterized in that, The interception of control messages sent from the external network of the cluster includes: By using the port connected to the external network, control messages sent from the external network are intercepted.
9. A control device, characterized in that, The device, used for management nodes in a cluster, includes: The sending module is used to send a first message to the service nodes in the cluster. The first message carries a target identifier, which is used to identify the permission of the first message. The message type of the first message includes a control message and a service message, and the permission of the control message is higher than that of the service message.
10. The apparatus according to claim 9, characterized in that, If the first message has super privileges, then the first message is a control message; if the first message has non-super privileges, then the first message is a business message.
11. The apparatus according to claim 9 or 10, characterized in that, The permissions of the service message are related to the service type of the service message.
12. The apparatus according to any one of claims 9-11, characterized in that, The device further includes: an authentication module, used to perform permission authentication on the target business node if the target business node requests access to the cluster; If the target service node is successfully authenticated, it is allowed to access the cluster, and the authenticated target service node is used to send service messages.
13. The apparatus according to claim 12, characterized in that, The authentication module is specifically used for: Determine the permission attributes of the target register of the target service node, wherein the target register is used to store the target identifier carried in the message sent by the target service node; If the permission attributes of the target register are configured by the control node, then the target service node is determined to have passed the permission authentication.
14. A control device, characterized in that, The device is applied to service nodes in a cluster and includes: The receiving module is used to receive a first message sent by the control node. The first message carries a target identifier, which is used to identify the permission of the first message. The message type of the first message includes control messages and service messages, and the permission of the control message is higher than that of the service message. Determination module: used to determine the message type of the first message based on the permissions corresponding to the target identifier; Execution module: Used to execute the control task corresponding to the first message when the message type of the first message is a control message; If the message type of the first message is a business message, the business task corresponding to the first message is executed.
15. The apparatus according to claim 14, characterized in that, The device further includes an interception module for intercepting control messages sent from the external network of the cluster.
16. The apparatus according to claim 15, characterized in that, The interception module is specifically used to: intercept control messages sent from the external network through the port connected to the external network.
17. A computing device, characterized in that, include: A memory and a processor, the memory being used to store a computer program; the processor being used to execute the method as described in any one of claims 1-8 when the computer program is invoked.
18. A cluster, characterized in that, include: The control node and the service node are configured to perform the method as described in any one of claims 1-5, and the service node is configured to perform the method as described in any one of claims 6-8.
19. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-8.
20. A computer program product, characterized in that, When the computer program product is run on a computing device, it causes the computing device to perform the method as described in any one of claims 1-8.