CN114615008B - A black and white list control method and device for a mass storage distributed system - Google Patents

Abstract

The invention relates to the field of access authority control of mass storage distributed systems, specifically discloses a method and device for controlling black and white lists of mass storage distributed systems, configures the cluster environment, connects the cluster Web to SSH, and enables the cluster CTDB high-availability state and load balancing Status; create a user and storage bucket in the cluster, set the access control list of the storage bucket to public read and above permissions; create a web page file and upload it to the storage bucket, enable static website hosting for the storage bucket, and open all access permissions to the website; for The webpage in the storage bucket configures the blacklist and whitelist of the host, and saves the blacklist and whitelist into the database. The invention can restrict access to hosts from a specific source, allow access to hosts from a specific source, and can support the control of different numbers and combination strategies according to requirements, improve the robustness, ease of use, and richness of functions of the system, and improve mass storage. Competitiveness of the automation platform.

Description

A black and white list control method and device for a mass storage distributed system

technical field

The invention relates to the field of access authority control of a mass storage distributed system, in particular to a method and device for controlling a black and white list of a mass storage distributed system.

Background technique

The automated operation of mass storage has been widely used in IT enterprises, cloud computing, big data, virtualization and other fields. At the same time, these fields have higher and higher security requirements for client access to hosting websites. It can only support client access to hosting websites, but cannot support access control related to access restrictions and access permissions. It can no longer meet the needs of users. It can restrict access to hosts from a specific source, allow access to hosts from a specific source, and can support control of different numbers and combinations of policies according to requirements. Since the automation platform of the mass storage distributed system cannot support access control related to access restriction and access permission, it will affect the robustness, ease of use and richness of functions of the system, and seriously affect the competitiveness of the mass storage automation platform.

Contents of the invention

In order to solve the above problems, the present invention provides a method and device for controlling the black and white list of a mass storage distributed system, which can realize restricting and allowing access to hosts, and control different numbers and combination strategies according to needs, so as to improve system robustness, Ease of use and richness of features.

In the first aspect, the technical solution of the present invention provides a method for controlling black and white lists of a mass storage distributed system, comprising the following steps:

Configure the cluster environment, enable the cluster Web to connect to SSH, and enable the cluster CTDB high availability and load balancing status;

Create users and storage buckets in the cluster, and set the access control list of storage buckets to public read and above permissions;

Create a web page file and upload it to the storage bucket, enable static website hosting for the storage bucket, and open all access rights to the website;

Configure the blacklist and whitelist of hosts for the web pages in the storage bucket, and save the blacklist and whitelist into the database.

Further, the method also includes the following steps:

The database obtains the blacklist, and adds the blacklist to the anti-leech policy for blacklist verification;

Among them, the blacklist is added to the anti-leech policy for blacklist verification, including:

Simulate the connection between each host in the blacklist and the cluster Web, and perform connection verification;

If there is a normal connection between the host and the cluster Web, the blacklist is abnormal and the program reports an error; otherwise, the blacklist is normal and the next step is performed;

Check whether each host in the blacklist can access the web pages in the cluster Web;

If none of them can be accessed, the blacklist is normal and the blacklist will take effect; otherwise, the blacklist is abnormal and the program reports an error.

Further, the method also includes the following steps:

The database obtains the white list, and adds the white list to the anti-leech policy for white list verification;

Among them, add the white list to the anti-leech policy for white list verification, including:

Simulate the connection between each host in the whitelist and the cluster Web, and perform connection verification;

If all hosts are connected to the cluster Web normally, then the whitelist is normal and proceed to the next step; otherwise, the whitelist is abnormal and the program reports an error;

Verify that each host in the whitelist can access the web pages in the cluster Web;

If all can be accessed, the whitelist is normal and the whitelist will take effect; otherwise, the whitelist is abnormal and the program reports an error.

Further, the method also includes the following steps:

If a certain host is in both the blacklist and the whitelist, the host will be verified in the blacklist and deleted from the whitelist.

Further, configure the cluster environment, connect the cluster Web to SSH, and enable the cluster CTDB high availability status and load balancing status, including:

Obtain mass storage management software information and SSH information, where mass storage management software information includes mass storage management software address, login name, and login password, and SSH information includes SSH login user name and login password;

According to the mass storage management software information and SSH information, log in to the cluster web terminal and connect the cluster web and SSH;

Query the health status of the cluster, if the cluster is healthy, execute the next step, otherwise report an error and exit the program;

Obtain and detect the high-availability status of the cluster CTDB. If the high-availability status of the cluster CTDB is enabled, execute the next step. Otherwise, an error will be reported and the program will exit and prompt to configure and enable the high-availability status of the cluster CTDB;

Obtain and detect the cluster load balancing status. If the cluster load balancing status is enabled, execute the next step; otherwise, enable cluster load balancing and obtain and detect the cluster load balancing status again;

Obtain and detect the automatic activation status of cluster load balancing. If the automatic activation status of cluster load balancing is enabled, execute the next step. Otherwise, enable cluster load balancing and obtain and detect the automatic activation status of cluster load balancing again after startup;

Determine whether the number of currently configured load balancing domain names exceeds the threshold, and if so, report an error and exit the program; otherwise, execute the next step to create users and storage buckets in the cluster.

In the second aspect, the technical solution of the present invention provides a black and white list control device for a mass storage distributed system, including:

Cluster environment configuration module: configure the cluster environment, connect the cluster Web with SSH, and enable the cluster C TDB high availability state and load balancing state;

User creation module: create users in the cluster;

Bucket creation module: create buckets in the cluster;

Bucket permission configuration module: set the access control list of the bucket to public read and above permissions;

Static website configuration module: create a webpage file and upload it to the storage bucket, enable static website hosting for the storage bucket, and open all access rights to the website;

Black and white list configuration module: configure the black list and white list of the host for the web pages in the storage bucket, and save the black list and white list into the database.

Further, the device also includes,

Black and white list verification module: the database obtains the black list, and adds the black list to the anti-leech strategy for black list verification;

Among them, the blacklist is added to the anti-leech policy for blacklist verification, including:

Simulate the connection between each host in the blacklist and the cluster Web, and perform connection verification;

If there is a normal connection between the host and the cluster Web, the blacklist is abnormal and the program reports an error; otherwise, the blacklist is normal and the next step is performed;

Check whether each host in the blacklist can access the web pages in the cluster Web;

If none of them can be accessed, the blacklist is normal and the blacklist will take effect; otherwise, the blacklist is abnormal and the program reports an error.

Further, the black and white list verification module is also used to obtain the white list from the database, adding the white list to the anti-leech strategy for white list verification;

Among them, add the white list to the anti-leech policy for white list verification, including:

Simulate the connection between each host in the whitelist and the cluster Web, and perform connection verification;

If all hosts are connected to the cluster Web normally, then the whitelist is normal and proceed to the next step; otherwise, the whitelist is abnormal and the program reports an error;

Verify that each host in the whitelist can access the web pages in the cluster Web;

If all can be accessed, the whitelist is normal and the whitelist will take effect; otherwise, the whitelist is abnormal and the program reports an error.

Further, the black-and-white list verification module is also used to perform blacklist verification on a certain host and delete it from the white list when the host is both in the black list and in the white list.

Further, the cluster environment configuration module includes,

Cluster site configuration import module: obtain mass storage management software information and SSH information, wherein mass storage management software information includes mass storage management software address, login name and login password, and SSH information includes SSH login user name and login password;

Cluster login module: According to the mass storage management software information and SSH information, log in to the cluster web terminal and connect the cluster web and SSH;

CTDB access module: query the health status of the cluster. If the cluster is not healthy, it will report an error and exit the program. Otherwise, it will obtain and detect the high availability status of the cluster CTDB. If the cluster CTDB high availability status is enabled, it will trigger the execution of the load balancing verification configuration module, otherwise Exit the program with an error and prompt to configure and enable the high availability state of the cluster CTDB;

Load balancing verification configuration module: obtain and detect the status of cluster load balancing. If the status of cluster load balancing is off, enable cluster load balancing and then obtain and detect the status of cluster load balancing again. Otherwise, obtain and detect the status of automatically enabling cluster load balancing. If the automatic enablement status of the cluster load balancing is off, the cluster load balancing will be enabled to obtain and detect the automatic activation status of the cluster load balancing again after startup, otherwise, judge whether the number of currently configured load balancing domain names exceeds the threshold, and if so, report an error and exit the program. Otherwise trigger user created module execution.

Compared with the prior art, the method and device for controlling black and white lists of a mass storage distributed system provided by the present invention have the following beneficial effects: configure black lists and white lists for hosts, restrict access to hosts from specific sources, and restrict access to hosts from specific sources. The mainframe allows access, and can support the control of different quantities and combination strategies according to requirements, improve the robustness, ease of use and richness of functions of the system, and improve the competitiveness of the mass storage automation platform.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the accompanying drawings that need to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings in the following description are only For some embodiments of the present application, those of ordinary skill in the art can also obtain other drawings based on these drawings without creative effort.

FIG. 1 is a schematic flowchart of a method for controlling black and white lists in a mass storage distributed system according to Embodiment 1 of the present invention.

FIG. 2 is a schematic flow chart of the cluster self-inspection process in Embodiment 1 of the present invention.

FIG. 3 is a schematic diagram of a load balancing state detection process in Embodiment 1 of the present invention.

FIG. 4 is a schematic flowchart of an anti-leeching strategy in Embodiment 1 of the present invention.

FIG. 5 is a schematic block diagram showing the structure of a black-and-white list control device for a mass storage distributed system according to Embodiment 2 of the present invention.

FIG. 6 is a schematic structural diagram of a terminal provided by Embodiment 3 of the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the solution of the present application, the present application will be further described in detail below in conjunction with the drawings and specific implementation methods. Apparently, the described embodiments are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

Embodiment one

Embodiment 1 provides a black and white list control method for a mass storage distributed system, which restricts access to hosts from a specific source, allows access to hosts from a specific source, and can support control of different numbers and combinations of strategies according to requirements.

As shown in Figure 1, the method includes the following steps.

S1, configure the cluster environment, connect the cluster Web to SSH (Secure Shell, a network protocol for encrypted login between computers), and open the cluster CTDB (Cluster Trivial Database e, a lightweight cluster database implementation ) High availability status and load balancing status.

S2, create a user and a storage bucket in the cluster, and set the access control list of the storage bucket to public read and above permissions.

S3, create a web page file and upload it to the storage bucket, enable static website hosting for the storage bucket, and open all access permissions to the website.

S4, configuring a blacklist and a whitelist of hosts for web pages in the storage bucket, and saving the blacklist and whitelist into a database.

It is understandable that the hosts in the blacklist are hosts that cannot access the webpage, and the hosts in the whitelist are hosts that can access the webpage. Users can add any number of hosts to the blacklist and whitelist as needed, and realize the host authentication based on the blacklist and whitelist configuration. Control of access rights, and can support the control of different quantities and combinations of strategies according to requirements.

In order to further explain the present invention, a specific embodiment is provided below, and the specific embodiment includes the following process.

(1) Cluster environment configuration

It is understandable that before configuring the black and white lists, configure the cluster environment to ensure that the black and white lists can be configured normally in the future. The configuration of the cluster environment in this embodiment includes connecting the cluster Web with SSH, and enabling the cluster C TDB high availability state and load balancing state, and the following process is specifically implemented.

S101. Obtain mass storage management software information and SSH information.

The mass storage management software information includes the mass storage management software address, login name, and login password, and the SSH information includes the SSH login user name and login password.

Specifically, the mass storage management software address $CLUSTER_IP, management software login name $CLUSTER_USERNAME and management software password $CLUSTER_PASSWORD, SSH login user name $SSH_NAME and SSH login password $SSH_PASSWORD are obtained through the env configuration file.

S102. According to the mass storage management software information and SSH information, log in to the cluster web terminal and connect the cluster web and SSH.

Use login_console to log in to the web side of the cluster and save $SESSION, use ssh_connect for SSH connection, and save $CLUSTER_SSH.

S103. Query the health status of the cluster. If the cluster is not healthy, report an error and exit the program. Otherwise, obtain and detect the high availability status of the cluster CTDB. If the cluster CTDB high availability status is enabled, execute the next step to detect the load balancing status, otherwise report an error and exit. The program also prompts to configure and enable the high availability state of the cluster CTDB.

As shown in Figure 2, the cluster self-inspection process is performed, and the cluster health status $CLUSTE R_HEALTH is queried through icfs-s. If the cluster status is abnormal, it will return 1 and the program will report an error. If the cluster status is normal, it will return 0 and save it in the database for persistence. Then use verify_ctdb_start($SESSION) to judge whether the high-availability status of CTDB in the cluster environment is enabled. If it is not enabled, an error will be reported and it will prompt that CTDB high-availability needs to be enabled before the next step of load balancing status detection.

S104. Obtain and detect the cluster load balancing status. If the cluster load balancing status is enabled, perform the next step; otherwise, enable the cluster load balancing status to acquire and detect the cluster load balancing status again.

S105. Obtain and detect the automatic enabling state of the cluster load balancing. If the automatic enabling state of the cluster load balancing is enabled, perform the next step;

S106. Determine whether the number of currently configured load balancing domain names exceeds the threshold, and if so, report an error and exit the program; otherwise, execute the next step to create users and storage buckets in the cluster.

As shown in Figure 3, after the high-availability state of the cluster CTDB is normally enabled, the load balancing state is detected, and finally the number of connections at the receiving end is configured.

Use get_loadbalance_service_status($SESSION) to get the current load balancing state $LOADBALANCE_STATE, then use get_loadbalance_selfstart_status($SESSI ON) to get the load balancing self-starting state $SELFSTART_STATE, if there is a closed state, turn it on; use get_ctdb_vir_ip_list() to get CTDB For virtual IP $VIR_IP_LIST, use config_loadbalanc_subdomain($SESSION, $VIR_IP_LIST) to configure the number of connections at the receiving end.

Among them, the configuration of the number of connections at the receiving end specifically includes configuring the load balancing domain name $LOADBALANCE_DOMAIN, which is used to generate the static website hosting domain name $WEBSITE_DOMAIN, and store it in the database for persistent storage; When LOADBALANCE_DOMAIN>20, the system will report an error indicating that it is greater than the maximum value and exit.

(2) User, storage bucket and bucket ACL permissions

After the cluster environment configuration is successful, create users and storage buckets, and configure the ACL (Access Control List) permission configuration of storage buckets.

Use create_user($USER_NAME) to create a user; use create_bucket($BUCKET_NAME) to create a bucket, use set_bucket_acl($USER_NAME,$BUCKET_NAME,$ALL_READ) to set the public read $ALL_READ bucket ACL permission for the bucket $BUCKET_NAME of user $USER_NAME .

(3) Static website configuration

After configuring the ACL permission for the bucket, configure the static website.

Create a webpage file $WEB_FILE and upload it to the bucket $OBJECT_BUCKET. Specifically, in the bucket $BUCKET_NAME, use the echo method to write the html webpage file $INDEX_HTML, and use s3_put_ object($INDEX_HTML, $BUCKET_NAME) to write the webpage file $INDEX_HTML Upload to bucket.

Then enable static website hosting for the bucket $OBJECT_BUCKET and open all access rights to the website.

(4) Black and white list configuration and verification

Configure the blacklist $BLACK_LISTS to be restricted access, configure the whitelist $WHITE_LI STS that is allowed to access, and poll to obtain the blacklist and blacklist, thereby supporting the blacklist and whitelist of multiple access sources, and persistently saving the website information in the blacklist and blacklist into database, mark this $BLACK_LIST with $BLACK_LIST_ID, and mark this $WHITE_LISTS with $WHITE_LIST_ID.

As shown in Figure 4, use set_bucket_anti_stealing_link($BUCKET_NAME, $BLACK _REFFER_LIST, $WHITE_REFFER_LIST) to set whitelist $WHITE_REFFER_LIST or blacklist $BLACK_REFFER_LIST for all webpages in bucket $BUCKET_NAME, such as $INDEX_HTML.

Then get the configured $BLACK_LIST and $WHITE_LIST from the database, enable the anti-leech setting of the website $WEBS ITE_DOMAIN, and add the blacklist $BLACK_LIST and $whitelist $WHITE_LIST to the anti-leech policy at the same time; if the user is in $BLACK_LIST If only one blacklist is configured in $BLACK_LIST and no whitelist is configured, only one blacklist will be added to the anti-leech policy, and it will be persistently saved as $REFER_1; if multiple blacklists are configured in $BLACK_LIST and no whitelist is configured, All blacklists belonging to $BLACK_LIST_ID in the database will be polled and added to the anti-leech policy; support configuration of single/multiple blacklists, single/multiple whitelists, support configuration of only blacklist, only whitelist, and configuration at the same time Black and white list, when the same host information exists in the black and white list, the host list in the black list will take effect; then the program calls the curl command on the first node of the cluster to perform self-test for the effective detection of the anti-leech black and white list, when all the source hosts in the black list cannot When accessing $WEBSITE_DOMAIN, the persistent storage of $BLACK_VALUE is TRUE. When all whitelist source hosts cannot access $WEBSITE_DOMAIN, the persistent storage of $WHITE_VALUE is also TRUE, and the program self-test passes and returns to 1.

In this embodiment, the blacklist is added to the anti-leech policy for blacklist verification, specifically including:

Step 1, simulate the connection between each host in the blacklist and the cluster Web, and perform connection verification;

Step 2, if there is a normal connection between the host and the cluster Web, the blacklist is abnormal, and the program reports an error; otherwise, the blacklist is normal, and the next step is performed;

Step 3, check whether each host in the blacklist can access the web pages in the cluster Web;

Step 4, if none of them can be accessed, the blacklist is normal, and the blacklist will take effect; otherwise, the blacklist is abnormal, and the program reports an error.

Add the whitelist to the anti-leech policy for whitelist verification, including:

Step 1, simulate the connection between each host in the whitelist and the cluster Web, and perform connection verification;

Step 2: If all hosts are connected to the cluster Web normally, the whitelist is normal, and the next step is executed; otherwise, the whitelist is abnormal and the program reports an error;

Step 3, check whether each host in the whitelist can access the web pages in the cluster Web;

Step 4, if all can be accessed, the white list is normal, and the white list will take effect; otherwise, the white list is abnormal, and the program reports an error.

As shown in Figure 4, the anti-leech policy is specifically:

Automatically call curl_check_web_site($INDEX_HTML), and use curl to simulate the connection label $CONNECT_FLAG between each blacklisted host and cluster web service through curl. If the list is abnormal, then use get_static_website_trusteeship($BLACK_REFFER_LIST[n],$INDE X_HTML) to verify whether each blacklist host can access the web pages in the cluster web service. If yes, set $VISIT_FLAG to FLASE, and the program reports an error.

If the whitelist $WHITE_REFFER_LIST is set, curl_check_web_site ($INDEX_HTML) will be called automatically, and curl$WHITE_REFFER_LIST[n]$INDEX_HTML is used to simulate the connection label $CONNECT_FLAG between each whitelist host and the cluster web service through curl. If FLAG is FLASE, Then the program reports an error indicating that the anti-leech whitelist is abnormal, and then uses gret_static_websit e_trusteeship($WHITE_REFFER_LIST[n],$INDEX_HTML) to verify whether each whitelisted host can access the web pages in the cluster web service. If not, then Set $VISIT_FLAG to FLASE, and the program reports an error.

If the blacklist $BLACK_REFFER_LIST has the same elements as the whitelist $WHITE_REFFER_LIST, the blacklist setting logic will be invoked by default to delete the same elements as $BLACK_REFFER_LIST from $WHITE_REFFER_LIST, and enter the blacklist verification logic get_static_website_trusteeship($BLACK_REFFER_LIST[n],$ INDEX_HTML).

The black and white list control method of the mass storage distributed system provided by this embodiment configures the black list and white list for the host, can restrict access to the host of a specific source, allow access to the host of a specific source, and can support different numbers, Combination policy control improves the robustness, ease of use and richness of functions of the system, and improves the competitiveness of the mass storage automation platform.

Embodiment two

On the basis of the first embodiment, the second embodiment provides a black-and-white list control device for a mass storage distributed system, which is used to implement the method in the first embodiment.

As shown in FIG. 5 , the device for controlling a blacklist and whitelist of a mass storage distributed system provided in Embodiment 2 includes the following functional modules.

Cluster environment configuration module 100: configure the cluster environment, connect the cluster Web with SSH, and enable the cluster CTDB high availability state and load balancing state.

User creation module 105: create a user in the cluster.

Bucket creation module 106: create a bucket in the cluster.

Bucket permission configuration module 107: set the access control list of the storage bucket to public read permission and above.

Static website configuration module 108: create a webpage file and upload it to the storage bucket, enable static website hosting for the storage bucket, and open all access rights of the website.

Black and white list configuration module 109: configure the black list and white list of hosts for the web pages in the storage bucket, and save the black list and white list into the database.

In this embodiment, in order to realize the configuration of the cluster environment, the cluster environment configuration module 100 specifically includes the following functional modules.

Cluster site configuration import module 101: Acquire mass storage management software information and SSH information, wherein the mass storage management software information includes mass storage management software address, login name and login password, and SSH information includes SSH login user name and login password.

Cluster login module 102: according to the mass storage management software information and SSH information, log in to the cluster Web terminal and connect the cluster Web and SSH.

CTDB access module 103: Query the health status of the cluster. If the cluster is not healthy, report an error and exit the program. Otherwise, obtain and detect the high-availability status of the cluster CTDB. If the cluster CTDB high-availability status is enabled, trigger the execution of the load balancing verification configuration module. Otherwise, an error will be reported to exit the program and a prompt needs to be configured and enabled for the high availability state of the cluster CTDB.

Load balance verification configuration module 104: obtain and detect the cluster load balance status, if the cluster load balance status is off, then obtain and detect the cluster load balance status again after the cluster load balance is turned on, otherwise obtain and detect the cluster load balance automatic enable state , if the automatic enablement status of the cluster load balancing is off, then the cluster load balancing will be enabled to obtain and detect the automatic activation status of the cluster load balancing again after startup, otherwise, judge whether the number of currently configured load balancing domain names exceeds the threshold, and if so, report an error and exit the program , otherwise triggers user-created module execution.

The mass storage distributed system black-and-white list control device of this embodiment also includes a black-and-white list verification module 110: the database acquires a blacklist, and adds the blacklist to the anti-leeching strategy for blacklist verification; the database acquires a whitelist, and adds the whitelist Whitelist verification is performed in the anti-leech policy. The verification and validation of the black and white lists are implemented based on the black and white list verification module 110 .

Among them, the blacklist is added to the anti-leech policy for blacklist verification, including:

Simulate the connection between each host in the blacklist and the cluster Web, and perform connection verification;

If there is a normal connection between the host and the cluster Web, the blacklist is abnormal and the program reports an error; otherwise, the blacklist is normal and the next step is performed;

Check whether each host in the blacklist can access the web pages in the cluster Web;

If none of them can be accessed, the blacklist is normal and the blacklist will take effect; otherwise, the blacklist is abnormal and the program reports an error.

Among them, add the white list to the anti-leech policy for white list verification, including:

Simulate the connection between each host in the whitelist and the cluster Web, and perform connection verification;

If all hosts are connected to the cluster Web normally, then the whitelist is normal and proceed to the next step; otherwise, the whitelist is abnormal and the program reports an error;

Verify that each host in the whitelist can access the web pages in the cluster Web;

If all can be accessed, the whitelist is normal and the whitelist will take effect; otherwise, the whitelist is abnormal and the program reports an error.

The black-and-white list verification module 110 is also used for performing black-list verification on a certain host and deleting it from the white-list when the host is in both the black-list and the white-list.

The black-and-white list control device of the mass storage distributed system in this embodiment is used to realize the aforementioned black-and-white list control method of the mass storage distributed system, so the specific implementation of the device can be seen in the above-mentioned black-and-white list control method of the mass storage distributed system For the embodiment part, therefore, for the specific implementation manner, reference may be made to the descriptions of the corresponding embodiments of each part, and no further introduction will be made here.

In addition, since the device for controlling the blacklist and whitelist of a distributed mass storage system in this embodiment is used to implement the aforementioned method for controlling a blacklist and whitelist of a distributed massive storage system, its function corresponds to that of the above method, and will not be repeated here.

Embodiment Three

FIG. 6 is a schematic structural diagram of a terminal device 600 provided by an embodiment of the present invention. The terminal device 600 can be used to implement the method for controlling black and white lists of a mass storage distributed system provided by an embodiment of the present invention.

Wherein, the terminal device 600 may include: a processor 610 , a memory 620 and a communication unit 630 . These components communicate through one or more buses. Those skilled in the art can understand that the structure of the server shown in the figure does not constitute a limitation to the present invention. It can be a bus structure, a star structure, or a More or fewer components than shown, or combinations of certain components, or different arrangements of components may be included.

Wherein, the memory 620 can be used to store the execution instructions of the processor 610, and the memory 620 can be realized by any type of volatile or non-volatile storage terminal or their combination, such as static random access memory (SRAM), electronic Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Magnetic Disk or Optical Disk . When the execution instructions in the memory 620 are executed by the processor 610, the terminal 600 is enabled to perform some or all of the steps in the following above-mentioned method embodiments.

The processor 610 is the control center of the storage terminal, using various interfaces and lines to connect various parts of the entire electronic terminal, by running or executing software programs and/or modules stored in the memory 620, and calling data stored in the memory, To perform various functions of the electronic terminal and/or process data. The processor may be composed of an integrated circuit (Integrated Circuit, IC for short), for example, may be composed of a single packaged IC, or may be composed of multiple packaged ICs connected with the same function or different functions. For example, the processor 610 may only include a central processing unit (Central Processing Unit, CPU for short). In the embodiments of the present invention, the CPU may be a single computing core, or may include multiple computing cores.

The communication unit 630 is configured to establish a communication channel, so that the storage terminal can communicate with other terminals. Receive user data sent by other terminals or send user data to other terminals.

Embodiment four

The present invention also provides a computer storage medium, wherein the computer storage medium may store a program, and the program may include part or all of the steps in the various embodiments provided by the present invention when executed. The storage medium may be a magnetic disk, an optical disk, a read-only memory (English: read-only memory, ROM for short) or a random access memory (English: random access memory, RAM for short), and the like.

Those skilled in the art can clearly understand that the technologies in the embodiments of the present invention can be implemented by means of software plus a necessary general-purpose hardware platform. Based on such an understanding, the technical solutions in the embodiments of the present invention essentially or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products are stored in a storage medium such as a USB flash drive, mobile Various media that can store program codes, such as hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, including several instructions to make a computer A terminal (which may be a personal computer, a server, or a second terminal, a network terminal, etc.) executes all or part of the steps of the methods described in various embodiments of the present invention.

For the same and similar parts among the various embodiments in this specification, refer to each other. In particular, for the terminal embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for relevant details, refer to the description in the method embodiment.

In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

The above disclosure is only a preferred embodiment of the present invention, but the present invention is not limited thereto, any non-creative changes that those skilled in the art can think of, and some improvements and modifications made without departing from the principle of the present invention , should fall within the protection scope of the present invention.

Claims (8)

1. A black-and-white list control method of a mass storage distributed system is characterized by comprising the following steps:

configuring a cluster environment, connecting a cluster Web with SSH, and starting a high-availability state and a load balancing state of a cluster CTDB;

creating a user and a storage bucket in the cluster, and setting an access control list of the storage bucket as public read and above authorities;

creating a webpage file, uploading the webpage file to a storage barrel, starting a static website for hosting the storage barrel, and opening all access rights of the website;

configuring a blacklist and a whitelist of a host according to the webpage in the storage barrel, and storing the blacklist and the whitelist into a database;

the database acquires a blacklist, and adds the blacklist into an anti-theft chain strategy to carry out blacklist verification;

the database acquires a white list, and adds the white list into an anti-theft chain strategy to carry out white list verification;

if a host is in the blacklist and the whitelist, the host is checked and deleted in the whitelist.

2. The method for controlling black-and-white lists of a mass storage distributed system according to claim 1, wherein adding the black list into an anti-hotlinking policy to perform black list verification, specifically comprises:

simulating the connection between each host in the blacklist and the Web of the cluster, and performing connection verification;

if the host is normally connected with the clustered Web, the blacklist is abnormal, and the program is wrongly reported; otherwise, the blacklist is normal, and executing the next step;

checking whether each host in the blacklist can access the Web pages in the cluster Web;

if the blacklist cannot be accessed, the blacklist is normal, and the blacklist is validated; otherwise, the blacklist is abnormal, and the program reports errors.

3. The method for black-and-white list control of a mass storage distributed system of claim 2, wherein,

adding the white list into the anti-theft chain strategy to carry out white list verification, which comprises the following steps:

simulating the connection between each host in the white list and the Web of the cluster, and performing connection verification;

if all hosts are normally connected with the clustered Web, the white list is normal, and the next step is executed; otherwise, the white list is abnormal, and the program reports errors;

checking whether each host in the white list can access the Web pages in the cluster Web;

if both the access is possible, the white list is normal, and the white list is validated; otherwise, the white list is abnormal, and the program reports errors.

4. A method for controlling a black-and-white list of a distributed mass storage system according to any one of claims 1 to 3, wherein configuring a cluster environment, connecting a cluster Web with an SSH, and opening a high availability state and a load balancing state of a cluster CTDB, specifically includes:

acquiring mass storage management software information and SSH information, wherein the mass storage management software information comprises a mass storage management software address, a login name and a login password, and the SSH information comprises an SSH login user name and a login password;

logging in a cluster Web end according to the mass storage management software information and the SSH information and connecting the cluster Web with the SSH;

inquiring the health state of the cluster, if the cluster is healthy, executing the next step, otherwise, reporting an error to exit the program;

acquiring and detecting a high availability state of the CTDB, if the high availability state of the CTDB is on, executing the next step, otherwise, reporting an error exit program and prompting that the high availability state of the CTDB is required to be configured and started;

acquiring and detecting a cluster load balancing state, if the cluster load balancing state is started, executing the next step, otherwise, acquiring and detecting the cluster load balancing state again after the cluster load balancing is started;

acquiring and detecting an automatic starting state of the cluster load balancing, if the automatic starting state of the cluster load balancing is started, executing the next step, otherwise, acquiring and detecting the automatic starting state of the cluster load balancing again after the automatic starting of the cluster load balancing is started;

judging whether the number of the currently configured load balancing domain names exceeds a threshold value, if so, reporting a fault to exit the program, otherwise, executing the next step to establish users and storage barrels in the cluster.

5. A black-and-white list control device of a mass storage distributed system is characterized by comprising,

cluster environment configuration module: configuring a cluster environment, connecting a cluster Web with SSH, and starting a high-availability state and a load balancing state of a cluster CTDB;

a user creation module: creating users in a cluster;

a storage bucket creation module: creating a storage bucket in a cluster;

barrel authority configuration module: setting an access control list of the storage barrel as public reading authority and the authority;

static website configuration module: creating a webpage file, uploading the webpage file to a storage barrel, starting a static website for hosting the storage barrel, and opening all access rights of the website;

black and white list configuration module: configuring a blacklist and a whitelist of a host according to the webpage in the storage barrel, and storing the blacklist and the whitelist into a database;

black and white list verification module: the database acquires a blacklist, and adds the blacklist into an anti-theft chain strategy to carry out blacklist verification; the database acquires a white list, and adds the white list into an anti-theft chain strategy to carry out white list verification; when a host is in the blacklist and the whitelist, the host is checked and deleted in the whitelist.

6. The mass storage distributed system black-and-white list control device of claim 5, wherein,

adding the blacklist into an anti-theft chain strategy for blacklist verification, which specifically comprises the following steps:

simulating the connection between each host in the blacklist and the Web of the cluster, and performing connection verification;

if the host is normally connected with the clustered Web, the blacklist is abnormal, and the program is wrongly reported; otherwise, the blacklist is normal, and executing the next step;

checking whether each host in the blacklist can access the Web pages in the cluster Web;

if the blacklist cannot be accessed, the blacklist is normal, and the blacklist is validated; otherwise, the blacklist is abnormal, and the program reports errors.

7. The device for controlling black-and-white lists of mass storage distributed systems according to claim 6, wherein adding the white list to the hotlink protection policy for performing the white list verification, specifically comprises:

simulating the connection between each host in the white list and the Web of the cluster, and performing connection verification;

if all hosts are normally connected with the clustered Web, the white list is normal, and the next step is executed; otherwise, the white list is abnormal, and the program reports errors;

checking whether each host in the white list can access the Web pages in the cluster Web;

if both the access is possible, the white list is normal, and the white list is validated; otherwise, the white list is abnormal, and the program reports errors.

8. The mass storage distributed system black-and-white list control device of any of claims 5-7, wherein the cluster environment configuration module comprises,

cluster site configuration import module: acquiring mass storage management software information and SSH information, wherein the mass storage management software information comprises a mass storage management software address, a login name and a login password, and the SSH information comprises an SSH login user name and a login password;

cluster login module: logging in a cluster Web end according to the mass storage management software information and the SSH information and connecting the cluster Web with the SSH;

CTDB admission module: inquiring the health state of the cluster, if the cluster is unhealthy, reporting an error exit program, otherwise, acquiring and detecting the high availability state of the CTDB of the cluster, if the high availability state of the CTDB of the cluster is on, triggering a load balancing verification configuration module to execute, otherwise, reporting the error exit program, prompting that the high availability state of the CTDB of the cluster is required to be configured and started;

load balancing verification configuration module: and acquiring and detecting a cluster load balancing state, if the cluster load balancing state is closed, acquiring and detecting the cluster load balancing state again after the cluster load balancing is started, otherwise acquiring and detecting an automatic cluster load balancing starting state, if the cluster load balancing automatic starting state is closed, acquiring and detecting the automatic cluster load balancing starting state again after the automatic cluster load balancing starting state is started, otherwise judging whether the number of the currently configured load balancing domain names exceeds a threshold value, if so, reporting to the wrong to exit the program, otherwise triggering a user creation module to execute.