CN117857642A - Data access processing method, device and equipment - Google Patents

Data access processing method, device and equipment Download PDF

Info

Publication number
CN117857642A
CN117857642A CN202311605629.4A CN202311605629A CN117857642A CN 117857642 A CN117857642 A CN 117857642A CN 202311605629 A CN202311605629 A CN 202311605629A CN 117857642 A CN117857642 A CN 117857642A
Authority
CN
China
Prior art keywords
access request
service node
domain name
target service
data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202311605629.4A
Other languages
Chinese (zh)
Inventor
蔡修明
于明亮
李劲松
王刚
王映彤
彭振
彭跟耀
郭宗宝
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Travelsky Technology Co Ltd
Original Assignee
China Travelsky Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Travelsky Technology Co Ltd filed Critical China Travelsky Technology Co Ltd
Priority to CN202311605629.4A priority Critical patent/CN117857642A/en
Publication of CN117857642A publication Critical patent/CN117857642A/en
Pending legal-status Critical Current

Links

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention provides a data access processing method, a device and equipment, which are applied to proxy nodes, wherein the method comprises the following steps: obtaining an access request of an external system to a target service node, wherein the target service node is positioned on a blockchain network inside a cluster; obtaining the internal address of the target service node according to the access request; and forwarding the access request to a target service node in the cluster according to the internal address. The scheme of the invention can realize the construction of the peer-to-peer P2P network by the inter-network of the blockchain service nodes deployed in different private networks.

Description

Data access processing method, device and equipment
Technical Field
The present invention relates to the field of data communications technologies, and in particular, to a data access processing method, apparatus, and device.
Background
In cloud management of Kubernetes (K8S) environment management, service-to-service calls are through short domain names inside a cluster (cluster domain names). Such short domain names can only be used inside the cluster, and external access agents are not accessible through the short domain names. In some business scenarios, it is necessary to expose internal services to external access agents, and the internal services may be exposed outside the cluster through a service exposure component provided by the K8S.
In a blockchain BaaS platform based on a K8S environment, the platform provides blockchain service, a plurality of organizations are firstly created, and a plurality of service nodes (taking ChainMaker as an example, one or a plurality of consensus nodes and one certificate node) corresponding to each organization are formed; one Service node is represented as a POD and Service in K8S, a plurality of Service nodes form a P2P network, a blockchain network is established on the established P2P network, and intelligent contracts are deployed, so that blockchain services are provided for users.
If the entire blockchain network is deployed within the same K8S cluster or within the same accessible network, then no agent is needed, but most scenarios are where the blockchain network is deployed in an enterprise private K8S cluster, i.e., K8S is deployed in an enterprise intranet. This limits the service nodes in the blockchain network from building a P2P network across enterprises, making blockchain traffic unable to cross enterprises.
Disclosure of Invention
The invention aims to solve the technical problem of providing a data access processing method, a device and equipment, and solves the problem of networking across different networks under the scene of dynamic change of service nodes in a block chain platform.
In order to solve the technical problems, the technical scheme of the invention is as follows:
a data access processing method is applied to a proxy node, and comprises the following steps:
obtaining an access request of an external system to a target service node, wherein the target service node is positioned on a blockchain network inside a cluster;
obtaining the internal address of the target service node according to the access request;
and forwarding the access request to a target service node in the cluster according to the internal address.
Optionally, obtaining the internal address of the target service node according to the access request includes:
according to the access request, analyzing an external domain name of the access request;
determining the request quantity of access data of the current external domain name according to the external domain name;
and obtaining the internal address of the target service node according to the request quantity through a domain name mapping rule.
Optionally, according to the access request, resolving the external domain name to obtain the access request includes:
obtaining a transmission protocol of the access request according to the access request;
and calling a corresponding protocol analysis plug-in according to the transmission protocol to obtain an external domain name.
Optionally, obtaining the internal address of the target service node through a domain name mapping rule includes:
acquiring stored service mapping data;
and obtaining an internal address corresponding to the external domain name of the current access request according to the service mapping data.
Optionally, the service mapping data is updated in real time, including:
acquiring a newly added service node marked with a domain name label in a cluster;
and storing the internal address of the newly added service node, and updating the mapping data.
Optionally, the data access processing method further includes:
and copying the data traffic obtained after the external system accesses the target service node, and sending the copied data traffic to the target port.
The invention also provides a data access processing system, which comprises:
the agent node is in the cluster and is used for acquiring an access request of an external system to the target service node and sending the access request to the target service node;
the domain name resolution module is used for carrying out domain name resolution on the access request of the external system to obtain an external domain name of the access request;
the current limiting fusion module is used for judging whether current limiting fusion is carried out according to the number of the current external domain name access data requests;
the rule self-discovery module is used for mapping the external domain name to the internal address according to the stored service mapping data;
a service group, within the cluster, comprising at least one service node.
The invention also provides a data access processing device, which comprises:
the acquisition module is used for acquiring an access request of an external system to a target service node, wherein the target service node is positioned on a blockchain network inside the cluster;
the forwarding module is used for obtaining the internal address of the target service node according to the access request; and forwarding the access request to a target service node in the cluster according to the internal address.
The present invention also provides a computing device comprising: a processor, a memory storing a computer program which, when executed by the processor, performs the method as described above.
The invention also provides a computer readable storage medium storing instructions that, when executed on a computer, cause the computer to perform a method as described above.
The scheme of the invention at least comprises the following beneficial effects:
according to the scheme, the access request of the external system to the target service node is obtained, and the target service node is located on the block chain network inside the cluster; obtaining the internal address of the target service node according to the access request; and forwarding the access request to a target service node in the cluster according to the internal address. The peer-to-peer P2P network can be built across networks of blockchain service nodes deployed inside different private networks.
Drawings
FIG. 1 is a flow chart of a data access processing method according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of a data access processing system according to an embodiment of the present invention;
fig. 3 is a schematic diagram of a data access processing apparatus according to an embodiment of the present invention.
Detailed Description
Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.
As shown in fig. 1, an embodiment of the present invention proposes a data access processing method, applied to a proxy node, including:
step 11, obtaining an access request of an external system to a target service node, wherein the target service node is positioned on a blockchain network inside a cluster;
step 12, according to the access request, obtaining the internal address of the target service node;
and step 13, forwarding the access request to a target service node in the cluster according to the internal address.
In this embodiment, the existing reverse proxy-based method only supports static rule configuration, and cannot dynamically configure reverse proxy service according to dynamic rules. And a new reverse proxy component applied in the K8s (Kubernetes for short, an open-source container arrangement engine) environment is provided to solve the problems that in some situations, access ports are limited, other protocols except HTTP protocol clusters need to be proxied, and proxy rules, current limiting and fusing mechanisms need to be dynamically configured. Dynamic proxy is supported, self-generating proxy rules are supported, multiprotocol is supported, only one limited port is occupied, and conventional proxy characteristics are supported.
As shown in fig. 2, in the method of the present invention, the service in a service group corresponds to a service node in a blockchain, and the proxy node forwards an access request of an external system to a target service node inside the K8s cluster.
In an optional embodiment of the present invention, step 12, obtaining the internal address of the target service node according to the access request includes:
step 121, according to the access request, resolving an external domain name of the access request;
step 122, determining the request quantity of the access data of the current external domain name according to the external domain name;
and step 123, obtaining the internal address of the target service node according to the request quantity through a domain name mapping rule.
In this embodiment, for an external access request, the domain name resolution module resolves an external domain name of the external access request, and then the current-limiting fusion module determines whether current-limiting processing is required or not according to access data of the current external domain name, and if the current-limiting fusion is required, the current-limiting fusion module performs corresponding processing. And when judging that the fusion is not needed, the proxy node acquires the internal service information which needs to be forwarded from the rule self-discovery module, wherein the internal service information comprises the cluster domain name, the IP address and the port information of the internal service. And then forwarding the request to the corresponding cluster internal service, and returning a response result.
In an optional embodiment of the present invention, step 121, resolving, according to the access request, the external domain name of the access request includes:
step 1211, obtaining a transmission protocol of the access request according to the access request;
and step 1212, calling a corresponding protocol analysis plug-in according to the transmission protocol to obtain an external domain name.
In this embodiment, the domain name resolution module invokes different protocol resolution plug-ins to obtain the domain name accessed from the outside according to the protocol type used. When the HTTP protocol is used, acquiring the domain name according to the Host field of the request header; when using TLS-like protocols, domain names are obtained from TLS certificates.
In an optional embodiment of the present invention, step 123, obtaining the internal address of the target service node through the domain name mapping rule includes:
step 1231, obtaining stored service mapping data;
step 1232, obtaining the internal address corresponding to the external domain name of the current access request according to the service mapping data.
In this embodiment, the rule self-discovery module stores the monitored cluster domain name or the IP address and the port information of the target service, and when the proxy node needs, the proxy node sends the address of the internal service node mapped by the external domain name to the proxy node, so that the proxy node forwards the request to the target service node.
In an optional embodiment of the present invention, the service mapping data is updated in real time, including:
acquiring a newly added service node marked with a domain name label in a cluster;
and storing the internal address of the newly added service node, and updating the mapping data.
In this embodiment, the rule discovery module may automatically discover the service that needs to be proxied, and when it is monitored that the service configuration with domain labels takes effect, the rule discovery module automatically acquires the corresponding domain name and the service cluster domain name to save the domain name and the service cluster domain name, and provides the domain name and the service cluster domain name to the proxy module for use.
In an alternative embodiment of the present invention, the method further includes:
and copying the data traffic obtained after the external system accesses the target service node, and sending the copied data traffic to the target port.
In this embodiment, a flow mirror function is further provided, and when the mirror flow function is started, the flow is copied to a mirror flow processing interface for processing.
The invention also provides a data access processing system, which comprises:
the agent node is in the cluster and is used for acquiring an access request of an external system to the target service node and sending the access request to the target service node;
the domain name resolution module is used for carrying out domain name resolution on the access request of the external system to obtain an external domain name of the access request;
the current limiting fusion module is used for judging whether current limiting fusion is carried out according to the number of the current external domain name access data requests;
the rule self-discovery module is used for mapping the external domain name to the internal address according to the stored service mapping data;
a service group, within the cluster, comprising at least one service node.
In this embodiment, specific functions corresponding to the above modules are as follows:
realization of the agent module:
the reverse proxy system realized by the method is a four-layer proxy system, and the proxy module realizes proxy logic and main control logic of the whole system. Realization of proxy logic: to obtain the request, obtain the information of the forwarding target service, and forward the request to the target service as it is.
The rule self-discovery module realizes:
when monitoring that a service is created, judging whether the service has a domain label or not; if so, the module acquires the cluster domain name or the IP address and the port information of the target service and stores the cluster domain name or the IP address and the port information.
Realization of a domain name protocol resolution module:
the HTTP protocol:
for the request of Http, directly acquiring the domain name to be forwarded from the Host field in the header information of the request;
TLS security protocol cluster:
for TLS security protocol clusters (e.g., HTTPS, GPRCS, WSS, etc.), a connection procedure needs to be established from listening TLS, and the domain name needs to be resolved from the certificate field of the first TLS handshake message.
The current limiting module is realized:
the system will place tokens into the bucket at a constant rate, a token agent will allow the number of requests to be processed, and if there are requests to be processed, it will need to first fetch tokens from the bucket, and when there are not enough tokens to process the request in the bucket, the request will be placed into the waiting queue or be directly rejected (melted).
The method of the invention can solve the problem of networking across different networks by using the proxy, when the service nodes in the BaaS platform are dynamically created and deleted according to the service or the capacity is expanded according to the service pressure, the proxy configuration can be dynamically updated, the proxy system needing proxy service in K8s can be automatically found, the service requirement of constructing the blockchain network across the networks can be supported, meanwhile, the blockchain network uses a plurality of protocols (P2P, GRPC, HTTP and the like), and the proxy nodes can also proxy a plurality of protocols.
The method of the invention meets the reverse proxy requirement under the scene with more limited conditions, and mainly can realize the following functions:
1. dynamic proxy: the agent configuration can be dynamically updated without restarting the agent system;
2. rule self-discovery: the agent can automatically discover the service information of the K8s cluster needing the agent without manually adding an agent rule;
3. multiprotocol: support multiple protocols, such as HTTP, GPRC, P2P and their security protocols, such as HTTPS, GPRCS, etc.;
4. based on domain name proxy rules: according to the service of the domain name identification agent, only one service port is occupied;
5. current limiting and breaking: supporting a proxy current limiting fusion mechanism;
6. flow mirroring: the flow mirror function is supported, and the functions of flow analysis and safety monitoring are met.
The method of the invention can provide more flexible proxy service, and the proxy system can provide self-management and self-discovery service, and various protocols support and support the expansion function of the protocols.
As shown in fig. 3, the present invention further provides a data access processing apparatus 30, including:
the obtaining module 31 is configured to obtain an access request from an external system to a target service node, where the target service node is located on a blockchain network inside the cluster;
a forwarding module 32, configured to obtain an internal address of the target service node according to the access request; and forwarding the access request to a target service node in the cluster according to the internal address.
Optionally, obtaining the internal address of the target service node according to the access request includes:
according to the access request, analyzing an external domain name of the access request;
determining the request quantity of access data of the current external domain name according to the external domain name;
and obtaining the internal address of the target service node according to the request quantity through a domain name mapping rule.
Optionally, according to the access request, resolving the external domain name to obtain the access request includes:
obtaining a transmission protocol of the access request according to the access request;
and calling a corresponding protocol analysis plug-in according to the transmission protocol to obtain an external domain name.
Optionally, obtaining the internal address of the target service node through a domain name mapping rule includes:
acquiring stored service mapping data;
and obtaining an internal address corresponding to the external domain name of the current access request according to the service mapping data.
Optionally, the service mapping data is updated in real time, including:
acquiring a newly added service node marked with a domain name label in a cluster;
and storing the internal address of the newly added service node, and updating the mapping data.
Optionally, the data access processing method further includes:
and copying the data traffic obtained after the external system accesses the target service node, and sending the copied data traffic to the target port.
It should be noted that, the device is a device corresponding to the above method, and all implementation manners in the above method embodiments are applicable to the embodiment of the device, so that the same technical effects can be achieved.
An embodiment of the invention is a computing device comprising: a processor, a memory storing a computer program which, when executed by the processor, performs the method as described above. All the implementation manners in the method embodiment are applicable to the embodiment, and the same technical effect can be achieved.
Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform a method as described above. All the implementation manners in the method embodiment are applicable to the embodiment, and the same technical effect can be achieved.
Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.
In the embodiments provided in the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a usb disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk, etc.
Furthermore, it should be noted that in the apparatus and method of the present invention, it is apparent that the components or steps may be disassembled and/or assembled. Such decomposition and/or recombination should be considered as equivalent aspects of the present invention. Also, the steps of performing the series of processes described above may naturally be performed in chronological order in the order of description, but are not necessarily performed in chronological order, and some steps may be performed in parallel or independently of each other. It will be appreciated by those of ordinary skill in the art that all or any of the steps or components of the methods and apparatus of the present invention may be implemented in hardware, firmware, software, or a combination thereof in any computing device (including processors, storage media, etc.) or network of computing devices, as would be apparent to one of ordinary skill in the art after reading this description of the invention.
The object of the invention can thus also be achieved by running a program or a set of programs on any computing device. The computing device may be a well-known general purpose device. The object of the invention can thus also be achieved by merely providing a program product containing program code for implementing said method or apparatus. That is, such a program product also constitutes the present invention, and a storage medium storing such a program product also constitutes the present invention. It is apparent that the storage medium may be any known storage medium or any storage medium developed in the future. It should also be noted that in the apparatus and method of the present invention, it is apparent that the components or steps may be disassembled and/or assembled. Such decomposition and/or recombination should be considered as equivalent aspects of the present invention. The steps of executing the series of processes may naturally be executed in chronological order in the order described, but are not necessarily executed in chronological order. Some steps may be performed in parallel or independently of each other.
While the foregoing is directed to the preferred embodiments of the present invention, it will be appreciated by those skilled in the art that various modifications and adaptations can be made without departing from the principles of the present invention, and such modifications and adaptations are intended to be comprehended within the scope of the present invention.

Claims (10)

1. A data access processing method, applied to a proxy node, comprising:
obtaining an access request of an external system to a target service node, wherein the target service node is positioned on a blockchain network inside a cluster;
obtaining the internal address of the target service node according to the access request;
and forwarding the access request to a target service node in the cluster according to the internal address.
2. The data access processing method according to claim 1, wherein obtaining the internal address of the target service node according to the access request includes:
according to the access request, analyzing an external domain name of the access request;
determining the request quantity of access data of the current external domain name according to the external domain name;
and obtaining the internal address of the target service node according to the request quantity through a domain name mapping rule.
3. The data access processing method according to claim 2, wherein resolving the external domain name from which the access request is obtained according to the access request, comprises:
obtaining a transmission protocol of the access request according to the access request;
and calling a corresponding protocol analysis plug-in according to the transmission protocol to obtain an external domain name.
4. The data access processing method according to claim 2, wherein obtaining the internal address of the target service node by the domain name mapping rule comprises:
acquiring stored service mapping data;
and obtaining an internal address corresponding to the external domain name of the current access request according to the service mapping data.
5. The data access processing method according to claim 4, wherein the service mapping data is updated in real time, comprising:
acquiring a newly added service node marked with a domain name label in a cluster;
and storing the internal address of the newly added service node, and updating the mapping data.
6. The data access processing method according to any one of claims 1 to 5, characterized by further comprising:
and copying the data traffic obtained after the external system accesses the target service node, and sending the copied data traffic to the target port.
7. A data access processing system, comprising:
the agent node is in the cluster and is used for acquiring an access request of an external system to the target service node and sending the access request to the target service node;
the domain name resolution module is used for carrying out domain name resolution on the access request of the external system to obtain an external domain name of the access request;
the current limiting fusion module is used for judging whether current limiting fusion is carried out according to the number of the current external domain name access data requests;
the rule self-discovery module is used for mapping the external domain name to the internal address according to the stored service mapping data;
a service group, within the cluster, comprising at least one service node.
8. A data access processing apparatus, comprising:
the acquisition module is used for acquiring an access request of an external system to a target service node, wherein the target service node is positioned on a blockchain network inside the cluster;
the forwarding module is used for obtaining the internal address of the target service node according to the access request; and forwarding the access request to a target service node in the cluster according to the internal address.
9. A computing device, comprising: a processor, a memory storing a computer program which, when executed by the processor, performs the method of any one of claims 1 to 6.
10. A computer readable storage medium storing instructions which, when run on a computer, cause the computer to perform the method of any one of claims 1 to 6.
CN202311605629.4A 2023-11-28 2023-11-28 Data access processing method, device and equipment Pending CN117857642A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202311605629.4A CN117857642A (en) 2023-11-28 2023-11-28 Data access processing method, device and equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202311605629.4A CN117857642A (en) 2023-11-28 2023-11-28 Data access processing method, device and equipment

Publications (1)

Publication Number Publication Date
CN117857642A true CN117857642A (en) 2024-04-09

Family

ID=90542423

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202311605629.4A Pending CN117857642A (en) 2023-11-28 2023-11-28 Data access processing method, device and equipment

Country Status (1)

Country Link
CN (1) CN117857642A (en)

Similar Documents

Publication Publication Date Title
US11582119B2 (en) Monitoring enterprise networks with endpoint agents
US11831611B2 (en) Virtual private gateway for encrypted communication over dedicated physical link
EP2056559B1 (en) Method and system for network simulation
JP4498179B2 (en) Network traffic assessment and management
CN109639572A (en) Route management method, device and micro services system
CN101202751B (en) System and method for providing SNMP data for virtual networking devices
US8341285B2 (en) Method and system for transferring files
CN112202940B (en) Pod service mode for external exposure of kubernets
US20220200957A1 (en) Managing Application Access Controls And Routing In Cloud Computing Platforms
CN108427619B (en) Log management method and device, computing equipment and storage medium
CN101018227A (en) Data management device, storage medium having data management program, protocol switching device and method
TW201541919A (en) Scalable address resolution
US11675638B1 (en) Webhooks use for a microservice architecture application
CN112564994A (en) Flow monitoring method and device, cloud server and storage medium
CN114036236A (en) Multi-gateway cluster system
CN108737586B (en) Disaster recovery switching method and device for domain name query service
CN116112175A (en) Service processing method, device and medium of digital twin network based on block chain
AU2006299461A1 (en) Peer name resolution protocol simple application program interface
JP5649840B2 (en) SIP servlet application cohosting
US8671180B2 (en) Method and system for generic application liveliness monitoring for business resiliency
US20220200954A1 (en) Managing Access To Cloud-Hosted Applications Using Domain Name Resolution
US11595471B1 (en) Method and system for electing a master in a cloud based distributed system using a serverless framework
US9032079B2 (en) Management and diagnosis of telephonic devices
CN117857642A (en) Data access processing method, device and equipment
US11924085B2 (en) Estimation of latency across regional clouds

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication