WO2013071890A1 - Resource access system and method based on identity and session - Google Patents
Resource access system and method based on identity and session Download PDFInfo
- Publication number
- WO2013071890A1 WO2013071890A1 PCT/CN2012/084810 CN2012084810W WO2013071890A1 WO 2013071890 A1 WO2013071890 A1 WO 2013071890A1 CN 2012084810 W CN2012084810 W CN 2012084810W WO 2013071890 A1 WO2013071890 A1 WO 2013071890A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- session
- identity
- manager
- resource
- service
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
- H04L65/1066—Session management
- H04L65/1069—Session establishment or de-establishment
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
- H04L65/60—Network streaming of media packets
- H04L65/61—Network streaming of media packets for supporting one-way streaming services, e.g. Internet radio
- H04L65/613—Network streaming of media packets for supporting one-way streaming services, e.g. Internet radio for the control of the source by the destination
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/14—Session management
- H04L67/141—Setup of application sessions
Definitions
- the present invention relates to the field of computer system applications, and more particularly to a system scenario including multiple servers, networks, and storage, and proposes an identity-based and session-based resource access system. Background technique
- 7,953,918 entitled “Service Bus linking method and service bus for linking multiple of service buses together” proposes a service bus linking method and a method of linking a large number of service buses together.
- the method uses the node identifier to mark the service bus, adds the identity and service bus locations to the bus node table, and updates the table.
- This method is designed to address the identity management of the service bus itself, without mentioning resources (various hardware and software resources) and application identity management.
- resources variable hardware and software resources
- application identity management There are also some telecommunications companies that separate control sessions from streaming sessions, but their protocol stacks only include communication resources, not computing resources, and even virtual computing resources. Summary of invention
- the present invention addresses these problems, especially in the network instance environment of a data center, introducing the idea of separating service providers and resource providers in traditional telecommunications into the access of enterprise data center resources, thereby realizing the separation of load and control sessions. And use identity management methods to manage the identity of these resources.
- the technical solution of the present invention is as follows:
- the present invention discloses an identity and session based resource access system, including:
- the client sends a service request and defines resource information required to execute the service request;
- the session management center receives a service request sent by the client, creates a flow session according to the service request, and creates a control session according to the flow session, and negotiates The resources required to stream the session and the service providers required to control the session, and route the request to the resource center;
- a resource center including an entity server, a network, and a storage, where the virtual server runs one or more virtual machines, the resource center receives the service request, and manages the running of the request, the virtual machine runs the service request and runs The results are fed back to the client;
- Identity manager which communicates with the session management center and the resource center, and the identity manager manages resources, The service provider, the session, the identity information of the applied object, and the identity manager also manages the lifecycle of the identity information.
- the session management center includes:
- a stream session manager receiving a service request sent by the client, creating a stream session according to the service request, and negotiating resources required for the stream session, and the stream session manager forwarding the service request;
- proxy server in communication with the streaming session manager, the proxy server receives the service request forwarded by the streaming session manager and maintains the connection, the proxy server obtains the streaming session information created by the streaming session manager, and the proxy server schedules the concurrent service request;
- Controlling the session manager communicating with the proxy server, obtaining flow session information from the proxy server, and creating a control session according to the flow session information and negotiating a service provider required to control the session, and controlling the session manager to forward the service request;
- a service bus connected to the control session manager, and connected to a plurality of service providers to transfer requests and control session identity information between service providers;
- the session database saves the service request from the client to the virtual machine running on the virtual machine and the result of running the flow session, control session and user session in the process of feeding back the result from the resource center to the client
- the streaming session manager includes:
- the stream session generator creates a stream session for the received service request and manages the life cycle of the stream session, and the stream session generator also negotiates resources required for the stream session;
- the flow signaling plane is formed in communication with the flow session generator, and is formed by a communication protocol stack between resources involved in the flow session, and separates physical resources and dynamic resources in the resource.
- the flow signaling plane includes:
- the protocol stack formed by the I/O link resource, the local network port resource and the computing resource, wherein the computing resource protocol stack includes a local physical computing working stack, a virtual machine manager, and a local logical computing working stack.
- the proxy server comprises:
- the application container saves request information related to the service request, including an IP address, a port number, and a protocol.
- control session manager comprises:
- a session controller creating a control session according to the flow session and managing a life cycle of the control session, the session controller also negotiating a service provider required to execute the control session;
- the control signaling plane is formed by a communication protocol stack between service providers involved in the control session, and the control signaling plane separates the service provider from the resource provider.
- the entity server includes a server resource manager, a hardware architecture, a virtual machine manager, and a plurality of virtual machines, and the server resource manager manages service requests at Running on the virtual machine, the virtual machine manager manages the virtual machine;
- the network includes a network resource manager, and the network resource manager manages network resources and groups virtual machines in the physical server;
- the memory includes a storage resource manager, and the storage resource manager manages storage resources.
- the identity manager comprises:
- the shank solving system determines the location of the resource and the relationship between the objects involved in the service request through the tree structure and the graphical structure solution;
- a generator that generates unique identity information for each defined resource and service provider, and generates identity information for each session, application;
- the registrar registers each object with an identity manager, and the registrar invokes the generator to generate an identity for the object;
- An identity store that stores identity information for various objects, including sessions, service providers, resources, and applications.
- the invention also discloses an identity and session based resource access method, the method comprising: an upstream stream session manager receiving a resource request of a client;
- the stream session manager creates a stream session for the request to negotiate the resources required to perform the client load, and sends the request and stream session information to the upstream proxy server;
- the proxy server acts as a relay agent for multiple requests, and sends request and stream session information to the upstream control.
- Session manager acts as a relay agent for multiple requests, and sends request and stream session information to the upstream control.
- the control session manager generates, for the request, a control session of the service provider associated with the streaming session for negotiating the control service request;
- the control session manager interacts with the upstream service bus, the service bus is connected to a plurality of service providers, requesting and controlling session identity information is passed between the plurality of service providers over the service bus, and the request is routed to the downstream resources by the service provider Central entity server;
- the resource manager manages the running of the request on the virtual machine.
- the virtual machine runs the request and feeds back the result of the running to the client.
- the method further comprises:
- the streaming session manager creates a streaming session and accesses the identity manager to obtain the streaming session identity;
- the proxy server creates the virtual application and accesses the identity manager, and obtains the virtual application identity associated with the streaming session identity through the relationship solving service;
- the control session manager creates a control session associated with the streaming session, accesses the identity manager, and obtains the control session identity associated with the stream session identity described above by the relationship solving service.
- the resource manager accesses the identity manager, obtains the unique identity of the resource, and can find the location of the resource through the address solving service according to the unique identity of the resource.
- the method further comprises:
- the proxy server After receiving the request and the stream session information sent by the stream session controller, the proxy server continues to maintain the TCP/UDP connection with the stream session controller;
- the method further comprises:
- the stream session manager creates a stream session, generates a stream signaling plane, separates physical resources and dynamic resource requirements, and controls the logical core network generated on demand.
- the method further includes: The control session manager creates a control session, generates a control session plane, and arbitrarily dynamically combines the service providers according to the request to generate multiple service provider planes.
- the method further comprises:
- the bridging is used to establish the identity correspondence between the virtual machine and various virtual resources on it.
- the method further comprises:
- the identity and session-based resource access system of the present invention can introduce the idea of separating the service provider and the resource provider in the traditional telecommunication into the access of the enterprise data center resource in the network instance environment of the data center, and realize the load and control session. Separation, and use identity management methods to manage the identity of these resources.
- FIG. 2 is a general flow diagram of the operation of an identity-based and session-based resource access system, describing the entire process from an application request by a user to an application instance returning to the client, in accordance with one embodiment of the present invention.
- FIG. 3 is a flow plan diagram of an identity and session based resource access system in accordance with an embodiment of the present invention, embodying communication resources and computing resource protocol stacks through which client loads are required.
- FIG. 4 is a block diagram of interaction of a proxy server with control session management and control session manager in an identity and session based resource access system, in accordance with one embodiment of the present invention.
- 5 is a flow diagram of interaction of a proxy server with control session management in an identity and session based resource access system, in accordance with one embodiment of the present invention.
- 6 is a partial storage structure of a session database storing session relationships in an identity-based and session-based resource access system, in accordance with one embodiment of the present invention.
- Figure 7 is a block diagram showing the structure of an identity manager in an identity and session based resource access system in accordance with one embodiment of the present invention.
- Figure 8 is the relationship resolution service implementation in the identity manager of Figure 7 (Relationship Resolution
- Figure 9 is a relational diagram of address resolution in the identity manager of Figure 7.
- Figure 10 is a flow diagram of the use of an identity manager in an identity and session based resource access system in accordance with one embodiment of the present invention.
- Figure 1 is a block diagram showing the structure of an identity and session based resource access system in accordance with one embodiment of the present invention. Referring to FIG. 1, the present invention discloses an identity and session based resource access system, including: a client 1 1 , a session management center 12 , a resource center 14 , and an identity manager 13 .
- the client 1 1 issues a service request and defines the resource information needed to execute the service request.
- the session management center 12 receives the service request issued by the client 11, and in the present invention, the service request may also be referred to as an application request.
- the session management center 12 creates a streaming session according to the service request and creates a control session according to the streaming session.
- the session management center 12 negotiates the resources required for the streaming session and the service providers required to control the session, and routes the request to the resource center.
- Resource Center 14 includes physical servers, networks, and storage, and one or more virtual machines are running on the physical servers.
- the resource center 14 receives the service request and manages the running of the request, and the virtual machine runs the service request and feeds back the result of the running to the client 1 1.
- the identity manager 13 is in communication with the session management center and the resource center.
- the identity manager 13 manages the identity information of objects such as resources, service providers, sessions, applications, etc.
- the identity manager 13 also manages the lifecycle of the identity information.
- the session management center 12 includes: a stream session manager 121, a proxy server 122, a control session manager 123, and a session database 125.
- Stream session manager 121 manages real time The network session manager, the stream session manager 121 receives the service request sent by the client 11, and creates a stream session according to the service request and negotiates resources required for the stream session, and the stream session manager 121 forwards the service request.
- the stream session manager 121 includes a stream session generator 121 1 and a stream signaling plane 1212.
- the stream session generator 121 1 creates a stream session for the received service request and manages the life cycle of the stream session, and the stream session generator 121 1 also negotiates the resources required for the stream session, that is, the resources required to run the user load.
- the flow signaling plane 1212 is in communication with the flow session generator 121 1 , and the flow signaling plane 1212 separates the physical resources and the dynamic resources in the resource by the communication protocol stack between the resources involved in the flow session.
- the proxy server 122 is in communication with the streaming session manager 121, which is an intermediary or broker between the user and the resource, the proxy server can identify the user's request, and the proxy server 122 receives the service request forwarded by the streaming session manager 121 and maintains Connected, the proxy server 122 obtains the stream session information created by the stream session manager, and the proxy server 122 schedules the concurrent service request.
- the proxy server 122 includes an application container 1221 that stores request information related to the service request, including an IP address, a port number, and a protocol.
- the control session manager 123 is in communication with the proxy server 122, and the control session manager 123 obtains streaming session information from the proxy server 122 and creates a corresponding control session and negotiates the service provider required to control the session, ie, the service provider that controls the user request. .
- the control session manager 123 forwards the service request.
- the control session manager 123 includes a session controller 123 1 and a control signaling plane 1232.
- the session controller 123 1 creates a control session according to the flow session and manages the life cycle of the control session, and the session controller 1231 also negotiates the service provider required to control the session.
- the control signaling plane 1232 is formed by a communication protocol stack between service providers participating in the control session, and the control signaling plane 1232 separates the service provider from the resource provider.
- the service bus 124 is coupled to a control session manager 123, which is implemented by a middleware infrastructure that includes an event driven and messaging engine and is coupled to a plurality of service providers.
- the session database saves the streaming session, control session, and user session information in the process of the service request from the client to the virtual machine running in the resource center and running the result from the resource center to the client.
- the session database 125 stores the streaming session, control session, and user session information in the process of the service request being transmitted from the client 11 to the virtual machine of the resource center 14 and the result of the operation being fed back from the resource center 14 to the client 11. Session database 125 can run on one or more servers.
- the entity server 141 in the resource center 14 includes a server resource manager. 141 1. Hardware architecture 1412, virtual machine manager 1413, and several virtual machines 1414.
- the server resource manager 141 1 manages the operation of the service request on the virtual machine, and the virtual machine manager 1413 manages the virtual machine 1414.
- the network 142 includes a network resource manager 1421 that manages network resources and networkes the virtual machines 1414 in the entity server 141.
- the memory 143 includes a storage resource manager 143 1.
- the storage resource manager 143 1 manages storage resources and provides storage services for various information such as a virtual machine image.
- the identity manager 13 includes a handle solving system 131, a generator 132, a register 133, and an identity store 134.
- the shank solving system 13 1 solves the relationship between the location of the resource and the objects involved in the service request by solving the tree structure and the graphic structure.
- the generator 132 generates unique identity information for each defined resource and service provider, and the generator 132 also generates identity information for each real-time session.
- the Registrar 133 registers the object with the Identity Manager, which invokes the generator to generate an identity for the object.
- the identity store 134 stores identity information for various objects, including sessions, service providers, resources, applications, and the like.
- Client 11 can be a user, client 11 issues a service request, such as requesting to create a lamp, and defining the resource information needed to create the lamp. .
- the service request first arrives at a streaming session manager 121 in the session management center 12, and a session creator 121 1 in the streaming session manager 121 creates a streaming session for the service request, negotiating The resources required to perform user loads and manage the lifecycle of the session.
- the communication protocol stack between the resources involved in the flow session forms a flow signaling plane 1212, which can separate physical resources and dynamic resource requirements, and control the logical core network generated on demand.
- the stream session manager 121 herein may be a four- to seven-layer switch or an application delivery controller, and may specifically be a device such as an F5 LTM or a Cisco ACE.
- the streaming session manager 12 passes the request to the broker 122 via the TCP/UDP protocol and maintains the TCP/UDP connection.
- the proxy server 122 is an intermediary or broker between the user and the resource, receives the application request from the client, and stores the user's request information including IP, port, protocol, etc. in the application container 1221, and the proxy server 122 performs the concurrent request. Scheduling.
- the proxy server 122 then sends the request to the control session manager 123, which consists of the session controller 1231 and the control signaling plane 1232.
- the session controller 123 1 creates an associated control session according to the flow session, negotiates the service provider required to control the session, that is, controls the service provider requested by the user, and manages the life cycle of the session. Control the communication protocol stack between service providers involved in the session Forming a control signaling plane 1232, the service provider can be separated from the resource provider, providing any dynamic combination of service providers as needed. Control session manager 123 is coupled to service bus 124, which is implemented by middleware infrastructure technology, a software architecture architecture provided for service oriented architecture through event driven and messaging engines. In the present invention, each service provider is connected to a service bus 124, and user requests and session identities are propagated between service providers over the service bus.
- the request is finally routed to the server 141 in the resource center 14, and the entity server 141 is the hardware device that finally runs the request with respect to the intermediary role of the previous proxy server 122.
- Each physical server 141 has a hardware architecture 1412, a virtual machine manager 1413, and a plurality of virtual machines 1414, and a server resource manager 141 1 .
- the network resource manager 1421 in the network 142 manages network resources and the networking of the virtual machines, and the storage resource manager 143 1 in the memory 143 manages the storage resources.
- the service request is finally run by the server resource manager 141 1 on a plurality of virtual machines 1414 on the entity server 141.
- the operation of a virtual machine instance requires the use of both network resources and storage resources.
- the service request is run, the result is directly returned to the client 1 1.
- This is the transfer process of the payload, and the TCP/UDP connection between the stream session manager 12 and the broker 122 is broken, and the control signaling is The process ends.
- Information such as streaming sessions, control sessions, user sessions, and the like are stored in the session database 125, and the data in the session database 125 can be stored in memory or on disk.
- the session manager interacts with the identity manager to obtain the identity of the session and store session related information in the session database.
- the identity manager 13 manages the life cycle of the identity information (ID), that is, the generation, maintenance, and deletion of the identity information, the identity manager 13 by the handle resolution system 131, the generator 132, the registry (Registry) 133, the identity storage (Store) 134 is composed, the handle solving system 13 1 is the core of the identity manager 13, and the location and application relationship of the resource are mainly solved by the tree structure and the graphic structure.
- the registrar 133 manages the resources to register with the identity manager 13, and the generator 132 generates identifiers for each of the defined objects in accordance with certain rules.
- the identity store 134 is a data storage center in the identity manager 13, which stores identity information of objects such as resources, service providers, sessions, applications, etc., solves information, configures services, and the like.
- the host resource manager 141 1 when the request to the host resource manager 141 1 is a start VM (starting the virtual machine), the host resource manager 141 1 needs to obtain the virtual machine from the identity manager 13. URL.
- the virtual machine image is stored in the shared storage 143.
- the request is create Vm (create virtual machine)
- the URL of the virtual machine template needs to be obtained from the storage 143.
- the storage resource manager 1431 on the storage 143 is used.
- . 2 is a general flow diagram of the operation of an identity-based and session-based resource access system, describing the entire process from an application request by a user to an application instance returning to the client, in accordance with an embodiment of the present invention. Specific steps are as follows:
- Step 201 The user sends an application request (the user requests the application, including IP, port, protocol, etc.), where the application request is a service request, for example, creating a lamp, requesting a resource;
- Step 202 Determine whether the user passes the authentication and authorization. If yes, the request is transferred to 203, otherwise the request is transferred to 201;
- Step 203 the request arrives at the stream session manager, the stream session manager generates a session for the request, accesses the identity manager, obtains a streaming session ID, and stores the stream session identity into the stream session table.
- the stream session manager In a record;
- Step 204 the streaming session manager transfers the request and the streaming session ID to the proxy server as a fake server, and maintains the TCP/UDP connection.
- the purpose of the connection is to transfer the request.
- the proxy server can identify the user's request, and transfer the request.
- Step 205 The proxy server accesses the identity manager, obtains the virtual application identity associated with the flow session identity by using the relationship solving service, and sends the request and the streaming session ID to the control session manager, where the entire
- the system is regarded as an application that executes the request, and the request is regarded as an application request (APP) issued by the user to the application, and the request is sent by the user, and when the proxy server is reached, the application request at this time is a user-oriented application described by the user. Also known as a virtual application request;
- Step 206 The control session manager creates an associated controlling session for the request according to the streaming session, and accesses the identity manager to obtain a Controlling Session ID related to the streaming session identity through the relationship solving service.
- Step 207 The control session manager invokes a service bus, and the service bus converts the virtual application into an application through a plurality of service providers connected thereto, controls the request direction, and controls the session to be transmitted between the service providers through the service bus, and The request is routed to the physical server of the resource center;
- Step 208 the resource manager on the server manages the execution of the application request, by accessing the identity tube The processor obtains the resources required to execute the application request;
- Step 209 determining whether the resource is ready, if the resource is ready, then proceeds to step 21 1, otherwise proceeds to step 210;
- Step 210 wait until the resources are ready
- Step 21 Execute the request to generate an application instance (APP INSTANT);
- Step 212 the stream session manager manages the running data load, and disconnects the TCP/UDP connection established with the proxy server for the request;
- Step 213 The result of the request execution is directly returned to the client by redirecting, and after the session ends, the resource information related thereto is released.
- FIG. 3 is a flow plan diagram of an identity and session based resource access system in accordance with an embodiment of the present invention, embodying communication resources and computing resource protocol stacks through which client loads are required.
- the execution of a client load 38 first requires computing resources.
- computing resources can be divided into virtual computing resources and physical computing resources.
- Virtual computing resources are what we usually call virtual machines, which are provided in the form of virtual machine files. It is in the local logical computing work stack 37 in the protocol stack. Below the local logical computing work stack 37 is a virtual machine manager VMM 36 that manages and controls the virtual machine.
- the VMM 36 provides exchange and arbitration of computing resources and maps the local logical working stack 37 to the local physical computing work stack.
- the physical resources on the server specifically the CPU, memory, disk, I/O, etc. on the server.
- the local physical computing work stack 35 can also be mapped to the local logical work stack 37.
- the customer load 38 gets the physical resources and can actually run. The load needs to be exchanged and transmitted.
- network resources for communication including local network port resources and IO link resources, are required.
- the communication between the loads is first communicated through the local port resource and the TCP/UDP port 34, and mapped to the network communication of the IP layer 33 in the IO link layer by layer according to the hierarchy of the communication protocol stack, the data link of the data link layer 32 Road communication, until the transmission of the lowest physical medium 31, completes the entire communication process.
- This flow session plane (signaling network) can separate physical resources and dynamic resource requirements to achieve on-demand provisioning of resources.
- Stream session manager 41 (or application delivery controller) to generate a streaming session, the address and server pool in the streaming session manager 41 can dynamically configure the resources required for the streaming session, due to the user's request (user-oriented application request) is the user's attention
- Application information such as IP, port, protocol, etc., does not accurately provide resource-oriented application descriptions.
- Stream session manager 41 cannot route requests to specific servers for execution based on this information, so first redirect the request to a A fake server, that is, a proxy server 42.
- the proxy server 42 is equivalent to a broker between the user and the resource, and includes an application container 421, which stores application information requested by the user, that is, a virtual application, from the virtual application 1 to the virtual application n.
- an application container 421 which stores application information requested by the user, that is, a virtual application, from the virtual application 1 to the virtual application n.
- the whole system is regarded as an application that executes the request, and the request is regarded as an application request (APP) issued by the user to the application, and the request is sent by the user.
- APP application request
- the application request at this time is the user-oriented user description.
- An application also called a virtual application; when a request arrives at a resource through the service provider's processing, the application request becomes a resource-oriented application that describes the resource requirement, also known as an application.
- the proxy server 42 forwards the request to the control session manager 43 (to control the direction of the request), and the session controller 43 1 in the control session manager 43 creates a control session associated with the streaming session for the request, negotiating to perform the service requested by the user.
- the communication protocol stack between the service providers involved in the control session forms a control signaling plane 432, which can separate the service provider from the resource provider, and provide any dynamic combination of service providers as needed, that is, dynamically generate multiple services.
- the provider plane from the service provider plane 4321, the service provider plane 4322, to the service provider plane 432n.
- Control session manager 43 is coupled to service bus 44, which is implemented by middleware infrastructure technology, a software architecture architecture provided for service oriented architecture through event driven and messaging engines.
- service bus 44 is implemented by middleware infrastructure technology, a software architecture architecture provided for service oriented architecture through event driven and messaging engines.
- each service provider in the service provider set 441 is connected to the service bus 44 and registered under the service bus 44.
- the service bus 44 controls and manages the interaction between these service providers, service routing, protocol conversion. Wait. User requests and session identities are propagated between service providers through the service bus.
- the service provider here is a plurality of functional modules for providing application services to support and optimize resource access, such as service enabler, service factory; functional modules of virtual resource management, such as virtual machine manager 441 1, storage manager 4412, network management 4413, etc.; and some functional modules that improve performance, such as monitor, NMS, etc.
- the control session manager 43 runs on a central server.
- the access to the service provider is implemented by the agent 45, and each service provider has an agent 45.
- the agent 45 monitors the request, dispatches the request, and sends the request to the corresponding service provider. 45
- the processing of concurrent requests can be implemented. Through the service provider's process and certain policies, the request is finally routed to the physical server in the resource center, which is relative to the previous proxy server.
- FIG. 5 is a flow diagram of the interaction of a proxy server with a control session manager in an identity and session based resource access system, in accordance with one embodiment of the present invention.
- the specific process is as follows:
- Step 501 the stream session manager sends the request to the proxy server
- Step 502 Determine whether the authentication authorization is passed. If the authentication authorization is passed, the process proceeds to step 503, otherwise, the process returns to step 502 to determine;
- Step 503 determining whether it is a concurrent request, and if so, proceeding to step 504, otherwise proceeding to step 505;
- Step 504 The application container in the proxy server schedules the request.
- Step 505 the proxy server sends the request to the control session manager
- Step 506 The session controller creates a control session related to the streaming session for the request.
- Step 507 Controlling session ID is transmitted between the multiple service providers through the service bus, thereby forming a control message.
- Service provider plane Service provider plane ;
- Step 508 determining whether multiple requests simultaneously request to use a service (service), and if so, proceeding to step 510, otherwise proceeding to step 509;
- Step 509 the service bus allocates a service provider for the request
- Step 510 an agent on a service provider registered under the service bus allocates a service (service) for the request.
- a service service
- session database 6 is a partial storage structure of a session database storing session relationships in an identity-based and session-based resource access system, in accordance with one embodiment of the present invention.
- Stored in the session database 6 are a plurality of session relationship tables, which are composed of a stream session table 61, a control session table 62, a user session table 63, and a session relationship table 64.
- the user sends an application request.
- the application requested by the user is a resource, in order to implement a user corresponding to multiple requests, resource multiplexing, service (service) multiplexing, and separating the user-requested session into a streaming session. Control session, user session.
- the stream session table 61 mainly stores a stream session and a network address and network addressing identity information bound to the stream session. Specifically, there are streaming session ID, network ID, and I/O ID, where the ID is obtained by accessing the identity manager.
- the Network ID includes the identity of the network device switch, router, etc.
- the I/O ID refers to the identity of the port, and the address of these resources can be found by identity.
- the flow session table corresponds to the I/O link resource and local network port resource portion in the flow session plane.
- the control session is a session about the control plane, and the control session table 62 mainly stores the control session and the service provider identity information bound to the control session, specifically
- the control session table corresponds to the control signaling plane.
- a user session is a session in which a user requests an application (app), indicating the relationship between the user (user) and the application (app), and the component relationship of the application (app).
- the user session table 63 mainly stores the identity information of these objects, including User Session ID, User ID, App ID, vApp ID, Domain ID, Component ID, VM ID, Server ID, and Storage ID. The relationship between them is a dynamic relationship. These IDs are obtained through the Identity Manager and are represented by the handle system in the Identity Manager, as detailed in the following figures.
- Streaming sessions, controlling sessions, user sessions are three aspects of a request, and there is a close relationship between them.
- a session relationship table 64 is needed to represent the relationship between them. Since we can consider the application (app) requested by the user as the service request, the service session ID is used as the primary key of the relational table. The other attribute fields are User session Id, streaming session ID, controlling session ID, and these attributes. Both are the primary keys of the previous tables, thus associating these separate sessions in one request.
- session-related data is stored in the Session Store.
- the corresponding resources need to be released.
- the session ID is created temporarily.
- Other resource identities (IDs) including data center resources and service provider identities (IDs), are unchanged.
- IDs including data center resources and service provider identities (IDs)
- the core of the identity manager 7 is a handle solving system 71 and an ID store 72 for storing identity information and various management configuration information, which are marked by an identifier, wherein the invariant objects such as resources and the service provider have a unique identifier. Invariant identifiers, dynamic objects such as sessions have a temporary identifier. Invariance (handle resolution) System) 71 to guarantee. Handle resolution system 71 Reference implementation 711, protocol 712, namespace (Namaspace)
- Administrative Service 714 is composed of four parts, of which Reference Implementation 711 is the core of the handle resolution system 71, providing solution services and distributed category services.
- the distributed class service 7113 receives different types of concurrent requests, and according to the type of the request, the request is dispatched and sent to the Address Resolution service 7111 or the relationship resolution service 7112.
- the Address Resolution Service 7111 has a tree structure of address relationships through which the location of the resource is found based on the resource identity.
- Relationship Resolution Service 7112 uses a relational solution service that stores users
- Namespace 713 is a type name of a large number of different types of identifiers. It also includes grammar rules for specific object names. Different namespaces can be divided according to types. Each namespace 713 has multiple different specifics. name. Management service
- the ID Store 72 is a storage device for storing various pieces of information such as identity information, management configuration information, and the like in the Identity Manager 7, and various assets, processes, applications, services, and the like are stored in the ID Warehouse 72.
- the identity manager provides an identity service, a relationship solving service, and an address solving service for the session manager and the resource manager, and provides a resource location for solving the relationship between the objects. support.
- the Identity Manager runs on an ID server.
- the relationship solving embodiment 81 of the present invention is composed of three parts: an object identifier 811, an object description 812, and a solution service 813.
- the object identifier 811 represents the identity of the object, and the object here may be a resource of the data center, such as a virtual machine, a server, etc., or may be a user request such as an application (app), a domain, or a component.
- Application relationships, etc. can also be various sessions, or can be a management program in the system (also known as For the service provider).
- the object description 812 represents a description of the attributes, characteristics, and the like of the respective objects.
- the solution service 813 is composed of a data type 8131, a structural metadata 8132, and a meta-objects 8133.
- the structure metadata 8132 describes the structural relationship between the objects, because the relationship is complicated. There are many-to-many situations, such as a user can use multiple applications (app) at the same time, an application (app) can be used by multiple users at the same time, so it is represented by a graph structure, which can guarantee the reference from the above object. To the following object, you can also refer to the many-to-many reference relationship of the above object from the following object.
- Metadata refers to objects about objects, and data types are categories of data.
- the main objects that need to be solved are listed in 82, including user 821, application (app) 822, domain 823, component 824, virtual resource 825, physical resource (physical resource). 826 and so on.
- the relationship between these objects is also a user session relationship.
- one user 821 can use multiple applications (app) 822 at the same time, and one application (app) can be used simultaneously by multiple users 821, one application.
- (app) 822 corresponds to a domain 823, and a domain 823 is composed of a plurality of components 824, since the component 824 is a special domain containing only one virtual machine instance (VM instance)
- VM instance virtual machine instance
- a domain component 823 corresponds to a virtual machine VM
- a virtual machine VM can be referenced by multiple domains 823
- one VM corresponds to multiple physical resources, such as cpu, memory, nic, and the like.
- There are two IDs in the VM one is Vm's own, and the other is the Reference ID, which points to the above component 824, establishing an identity correspondence with the component 824.
- 83 is the main resource required for a user to request to run, including the relationship between VM 831, LUN 832, Raid 833, vswitch 834, Nic 835 and the like by ID.
- FIG 9 is a diagram showing the relationship of address resolution in the identity manager of Figure 7.
- each resource is uniquely tagged.
- Each resource has a unique identity tag and a variable logical ID to establish a logical relationship between resources.
- the domain name system corresponds to IP, and each ID is unique and constant, so no matter where the resource is moved, it can be found by ID.
- the address solution is implemented by a tree structure, which is an inheritance relationship from root to leaf in identity. Taking the data center as an example, one data center 91 can be divided into multiple groups 92, one group 92 has multiple hosts 93, one host 93 has multiple virtual machines 94, and one virtual machine 94 uses vCPU 951, vMemory 952.
- vNic 953, VHBA 954 and other virtual hardware resources virtual hardware resources are mapped to the corresponding physical hardware resources CPU 971, Memory 972, Nic 973, HBA974 through the virtual machine manager VMM, a physical hardware device can correspond to multiple virtual hardware devices, wherein, vNic 953 Connect to the vSwitch 96 in the Virtual Machine Manager VMM.
- vSwitches 96 there may be one or more vSwitches 96 in the VMM, one vSwitch 96 connected to multiple vnic 953, vswitch 953 connected to the physical Nic 973, and Nic 973 connected to the Switch (switch)
- a Switch 98 can be connected to multiple Nic 973s, that is, multiple hosts 93, and can also be connected to a shared storage 99 via Switch 98.
- a virtual machine can have multiple vSwitches 96, which respectively manage different vlans and are connected to different vswitches.
- the virtual machines are divided into different vlans, and one vswitch can connect different virtual machines on different hosts.
- the address of the resource is requested by the ID of the resource, the request arrives at the address solving service, and the address solving service solves the location of the resource by the identity of the resource.
- FIG. 10 is a flow diagram of the use of an identity manager in an identity and session based resource access system, in accordance with one embodiment of the present invention. Specifically, the following steps are included:
- Step 1001 the client sends a request, and proceeds to step 1002;
- Step 1002 the request arrives at the identity manager, and proceeds to step 1003;
- Step 1003 Determine whether the requested object is registered in the identity manager. If registered, go to step 1004, otherwise proceed to step 1008;
- Step 1004 Solving the system according to the ID to the query manager in the identity manager, and proceeding to step 1005; Step 1005, determining whether to query the resource address, and if yes, proceeding to step 1006, otherwise proceeding to step 1010;
- Step 1006 Find the location of the resource by using the address solving service, and proceed to step 1007;
- Step 1007 return the location information to the requesting party, and end;
- Step 1008 registering the object using the registrar, and proceeding to step 1009;
- Step 1009 the generator creates a delete identifier for the object according to the object type and the string rule.
- Step 1010 The relationship finding service finds the object of the relationship, and proceeds to step 101 1; Step 101, returns the relationship object information to the requesting party, and ends.
- the identity and session based resource access system of the present invention can be in a network instance environment of a data center Next, the idea of separating service providers and resource providers in traditional telecommunications is introduced into the access of enterprise data center resources, realizing the separation of load and control sessions, and using identity management methods to manage the identity of these resources.
Landscapes
- Engineering & Computer Science (AREA)
- Multimedia (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Business, Economics & Management (AREA)
- General Business, Economics & Management (AREA)
- Hardware Redundancy (AREA)
- Computer And Data Communications (AREA)
Abstract
Disclosed are a resource access system and method based on identity and session, the system comprising a client-side, a session management center, a resource center and an identity manager; the client-side sends a service request and defines the resource information required for executing the service request; the session management center receives the service request, creates a streaming session according to the service request, creates a controlled session according to the streaming session, negotiates about the resources required for the streaming session and the service provider required for session control, and routes the request to the resource center; the resource center comprises an entity server, a network and a memory unit; the resource center receives the service request and manages the operation of the request; a virtual machine on the entity server runs the service request and feeds back the running result to the client-side; and the identity manager manages the identity information of the objects such as resource, service provider, session, applications and the like, and also manages the life cycle of the identity information.
Description
发明领域 Field of invention
本发明涉及计算机系统应用领域, 更具体地说, 涉及包括多个服务器, 网 络, 存储的系统场景, 提出一种基于身份和会话的资源访问系统。 背景技术 The present invention relates to the field of computer system applications, and more particularly to a system scenario including multiple servers, networks, and storage, and proposes an identity-based and session-based resource access system. Background technique
如何利用数据中心资源支撑企业的业务运行是数据中心管理考虑的首要 问题。 尤其是在技术发展日新月异, 应用模式层出不穷的情况下, 数据中心的 各种设备, 包括服务器, 存储, 网络等设备越买越多, 呈现爆炸趋势, 可是一 个业务一套设备的规划方式, 形成了众多的设备孤岛, 使得这些设备很少得到 充分利用, 造成了资源的严重浪费; 另一方面, 资源规划和业务运行相分离, 资源规划以离线 (off-line ) 的方式, 业务运行则以在线 (on-line ) 的方式, 业 务之间不断不能共享资源, 传统的手动方式也使得业务的部署周期变长, 影响 企业的效率。 此时, 如何有效地提供资源供应业务, 即实现资源的共享、 动态 供给及业务流程的自动化就显得尤为重要。 这时就需要一个功能强大、 与时倶 进的管理方法和系统, 更好地应对 "新问题" , 对数据中心加以有效、 全面的 管理。 How to use data center resources to support the business operations of enterprises is the primary issue considered in data center management. Especially in the case of rapid development of technology and the emergence of application models, the various devices in the data center, including servers, storage, and networks, are buying more and more, showing an explosive trend. However, a business planning method for a set of devices has formed. Numerous equipment islands make these devices rarely utilized, resulting in serious waste of resources. On the other hand, resource planning and business operations are separated, resource planning is off-line, and business operations are online. In the on-line mode, resources cannot be shared between services. The traditional manual mode also makes the service deployment cycle longer and affects the efficiency of the enterprise. At this time, how to effectively provide resource provisioning services, that is, to realize resource sharing, dynamic provisioning, and automation of business processes, is particularly important. At this time, a powerful and timely management method and system is needed to better cope with "new problems" and to effectively and comprehensively manage the data center.
当前, 虚拟化几乎成为了数据中心不可缺少的一种应用, 越来越多的用户 开始将数据中心转移到虚拟化环境中。 据权威机构最新一项研究表明, 90%的 企业已在某种程度上实施了虚拟化技术。 这也给数据中心管理工具带来了新的 命题。 如何在虚拟化 "大行其道" 的时代设计有效的资源供给方法和体系, 保 持和提升数据中心管理的效能? At present, virtualization is almost an indispensable application in the data center, and more and more users are beginning to transfer data centers to virtualized environments. According to a recent study by an authoritative organization, 90% of enterprises have implemented virtualization technology to some extent. This also brings new propositions to data center management tools. How to design an effective resource supply method and system in the era of virtualization "prevailing" to maintain and improve the efficiency of data center management?
在按需动态供给数据中心资源时, 服务质量保证是需要解决的首要问题, 并发性请求的处理, 资源的复用, 服务的复用是提升效率的关键, 这就需要用 到身份和会话管理。 针对这些问题, 有诸多解决方法被提出, 专专利号为 US 7,860,975, 题为 " System and method for secure sticky routing of requests within a server farm" 的美国专利提出了一种釆用服务器农场中的上游设备, 如负载均 衡器或路由器, 来路由请求到服务器的方法。 其中服务器釆用一种安全且唯一 的 ID 或从请求中得到的确定请求如何通过服务器农场路由的网络地址来处理
那些请求的会话 (session) 。 该方法可以解决将请求路由到数据中心的服务器 的问题, 但是并没有解决通过控制会话层面路由请求的问题, 也未有涉及虚拟 资源的访问。 专利号为 US 7,930,734 , 题为 " Method and system for creating and tracking network session" 的美国专利提出了一种创建和跟踪网络会话的方法, 通过收集认证的身份信息, 网络地址信息, 以及网络寻址信息, 并绑定这些信 息在会话管理器的中心数据库中, 构成一条反应用户访问网络的会话记录, 用 于实时检测入侵等异常的发生。 该方法也是网络会话的通信层面, 未有涉及控 制层面。专利号为 US 7,953,918,题为" Service Bus linking method and service bus for linking plurality of service buses together"的美国专利提出了一种服务总线链 接方法以及一种把大量的服务总线链接在一起的方法。 该方法使用节点身份符 标记服务总线, 将身份符和服务总线的位置加入到总线节点表格中, 并更新表 格。 该方法旨在解决服务总线本身的身份管理, 而未有提到资源 (各种软硬件 资源) 和应用程序的身份管理。 也有一些电信公司将控制会话和流会话分离, 但其协议栈只包括通信资源, 未有涉及到计算资源, 甚而虚拟计算资源。 发明概述 When the data center resources are dynamically supplied on demand, quality of service guarantee is the primary problem to be solved. The processing of concurrent requests, the reuse of resources, and the reuse of services are the key to improving efficiency. This requires identity and session management. . In response to these problems, a number of solutions have been proposed, the US Patent No. US 7,860,975, entitled "System and method for secure sticky routing of requests within a server farm", which proposes an upstream device in a server farm. , such as a load balancer or router, to route requests to the server. The server uses a secure and unique ID or a deterministic request from the request to process the network address of the server farm route. Those requested sessions. This method can solve the problem of routing requests to servers in the data center, but does not solve the problem of routing requests through control session level, nor does it involve access to virtual resources. US Patent No. 7,930,734, entitled "Method and system for creating and tracking network session", proposes a method of creating and tracking a network session by collecting authenticated identity information, network address information, and network addressing information. And bind this information in the central database of the session manager to form a session record that reflects the user's access to the network, and is used to detect the occurrence of anomalies such as intrusions in real time. This method is also the communication level of the network session, and does not involve the control plane. U.S. Patent No. 7,953,918 entitled "Service Bus linking method and service bus for linking multiple of service buses together" proposes a service bus linking method and a method of linking a large number of service buses together. The method uses the node identifier to mark the service bus, adds the identity and service bus locations to the bus node table, and updates the table. This method is designed to address the identity management of the service bus itself, without mentioning resources (various hardware and software resources) and application identity management. There are also some telecommunications companies that separate control sessions from streaming sessions, but their protocol stacks only include communication resources, not computing resources, and even virtual computing resources. Summary of invention
本发明针对这些问题, 尤其是在数据中心的网络实例环境下, 将传统电信 中服务提供者和资源提供者分离的思想引入到企业数据中心资源的访问中来, 实现荷载和控制会话的分离, 并釆用身份管理方法管理这些资源的身份。 The present invention addresses these problems, especially in the network instance environment of a data center, introducing the idea of separating service providers and resource providers in traditional telecommunications into the access of enterprise data center resources, thereby realizing the separation of load and control sessions. And use identity management methods to manage the identity of these resources.
本发明的技术方案为: 本发明揭示了一种基于身份和会话的资源访问系 统, 包括: The technical solution of the present invention is as follows: The present invention discloses an identity and session based resource access system, including:
客户端, 客户端发出服务请求并定义执行该服务请求所需要的资源信息; 会话管理中心, 接收所述客户端发出的服务请求, 根据该服务请求创建流 会话并根据流会话创建控制会话, 协商流会话所需的资源和控制会话所需的服 务提供者, 并将请求路由到资源中心; a client, the client sends a service request and defines resource information required to execute the service request; the session management center receives a service request sent by the client, creates a flow session according to the service request, and creates a control session according to the flow session, and negotiates The resources required to stream the session and the service providers required to control the session, and route the request to the resource center;
资源中心, 包括实体服务器、 网络和存储器, 所述实体服务器上运行一个 或多个虚机, 资源中心接收所述服务请求、 并管理请求的运行, 所述虚机运行 所述服务请求并将运行的结果反馈给客户端; a resource center, including an entity server, a network, and a storage, where the virtual server runs one or more virtual machines, the resource center receives the service request, and manages the running of the request, the virtual machine runs the service request and runs The results are fed back to the client;
身份管理器,与会话管理中心及资源中心通信连接,身份管理器管理资源、
服务提供者、 会话、 应用的对象的身份信息, 身份管理器还管理所述身份信息 的生命周期。 Identity manager, which communicates with the session management center and the resource center, and the identity manager manages resources, The service provider, the session, the identity information of the applied object, and the identity manager also manages the lifecycle of the identity information.
根据本发明的基于身份和会话的资源访问系统的一实施例, 所述会话管理 中心包括: According to an embodiment of the identity and session based resource access system of the present invention, the session management center includes:
流会话管理器, 接收所述客户端发送的服务请求, 根据该服务请求创建流 会话并协商流会话所需的资源, 流会话管理器转发所述服务请求; a stream session manager, receiving a service request sent by the client, creating a stream session according to the service request, and negotiating resources required for the stream session, and the stream session manager forwarding the service request;
代理服务器, 与流会话管理器通信连接, 代理服务器接收由流会话管理器 转发的服务请求并保持连接, 代理服务器获取流会话管理器创建的流会话信 息, 代理服务器调度并发的服务请求; a proxy server, in communication with the streaming session manager, the proxy server receives the service request forwarded by the streaming session manager and maintains the connection, the proxy server obtains the streaming session information created by the streaming session manager, and the proxy server schedules the concurrent service request;
控制会话管理器, 与代理服务器通信连接, 从代理服务器获取流会话信息 并根据流会话信息创建控制会话并协商控制会话所需的服务提供者, 控制会话 管理器转发所述服务请求; Controlling the session manager, communicating with the proxy server, obtaining flow session information from the proxy server, and creating a control session according to the flow session information and negotiating a service provider required to control the session, and controlling the session manager to forward the service request;
服务总线, 连接到所述控制会话管理器, 并与多个服务提供者相连, 在服 务提供者之间传递请求和控制会话身份信息; a service bus, connected to the control session manager, and connected to a plurality of service providers to transfer requests and control session identity information between service providers;
会话数据库保存服务请求从客户端传送至资源中心的虚机上运行以及运 行的结果从资源中心反馈给客户端的过程中的流会话、 控制会话和用户会话信 白 The session database saves the service request from the client to the virtual machine running on the virtual machine and the result of running the flow session, control session and user session in the process of feeding back the result from the resource center to the client
根据本发明的基于身份和会话的资源访问系统的一实施例, 所述流会话管 理器包括: According to an embodiment of the identity and session based resource access system of the present invention, the streaming session manager includes:
流会话生成器, 为接收到的服务请求创建流会话并管理流会话的生命周 期, 流会话生成器还协商流会话所需要的资源; The stream session generator creates a stream session for the received service request and manages the life cycle of the stream session, and the stream session generator also negotiates resources required for the stream session;
流信令平面, 与流会话生成器通信连接, 由流会话过程中所参与的资源间 的通信协议栈形成, 分离所述资源中的物理资源与动态资源。 The flow signaling plane is formed in communication with the flow session generator, and is formed by a communication protocol stack between resources involved in the flow session, and separates physical resources and dynamic resources in the resource.
根据本发明的基于身份和会话的资源访问系统的一实施例, 所述流信令平 面包括: According to an embodiment of the identity and session based resource access system of the present invention, the flow signaling plane includes:
I/O链路资源, 本地网络端口资源和计算资源形成的协议栈, 其中计算资 源协议栈包括本地物理计算工作栈、 虚机管理器, 本地逻辑计算工作栈。 The protocol stack formed by the I/O link resource, the local network port resource and the computing resource, wherein the computing resource protocol stack includes a local physical computing working stack, a virtual machine manager, and a local logical computing working stack.
根据本发明的基于身份和会话的资源访问系统的一实施例, 所述代理服务 器包括:
应用容器, 保存与所述服务请求相关的请求信息, 包括 IP地址、 端口号、 协议。 According to an embodiment of the identity and session based resource access system of the present invention, the proxy server comprises: The application container saves request information related to the service request, including an IP address, a port number, and a protocol.
根据本发明的基于身份和会话的资源访问系统的一实施例, 所述控制会话 管理器包括: According to an embodiment of the identity and session based resource access system of the present invention, the control session manager comprises:
会话控制器, 根据所述流会话创建控制会话并管理控制会话的生命周期, 会话控制器还协商执行该控制会话所需要的服务提供者; a session controller, creating a control session according to the flow session and managing a life cycle of the control session, the session controller also negotiating a service provider required to execute the control session;
控制信令平面, 由控制会话过程中所参与的服务提供者间的通信协议栈形 成, 控制信令平面将服务提供者与资源提供者分离。 The control signaling plane is formed by a communication protocol stack between service providers involved in the control session, and the control signaling plane separates the service provider from the resource provider.
根据本发明的基于身份和会话的资源访问系统的一实施例, 所述实体服务 器包括服务器资源管理器、 硬件架构、 虚机管理器和数个虚机, 所述服务器资 源管理器管理服务请求在虚机上的运行, 虚机管理器管理所述虚机; According to an embodiment of the identity-based and session-based resource access system of the present invention, the entity server includes a server resource manager, a hardware architecture, a virtual machine manager, and a plurality of virtual machines, and the server resource manager manages service requests at Running on the virtual machine, the virtual machine manager manages the virtual machine;
所述网络包括网络资源管理器, 网络资源管理器管理网络资源并对实体服 务器中的虚机进行组网; The network includes a network resource manager, and the network resource manager manages network resources and groups virtual machines in the physical server;
所述存储器包括存储资源管理器, 存储资源管理器管理存储资源。 The memory includes a storage resource manager, and the storage resource manager manages storage resources.
根据本发明的基于身份和会话的资源访问系统的一实施例, 所述身份管理 器包括: According to an embodiment of the identity and session based resource access system of the present invention, the identity manager comprises:
柄求解系统, 通过树形结构和图形结构求解确定资源的位置和服务请求涉 及的各对象间的关系; The shank solving system determines the location of the resource and the relationship between the objects involved in the service request through the tree structure and the graphical structure solution;
生成器, 为每个定义的资源和服务提供者生成唯一的身份信息, 为每一个 会话、 应用生成身份信息; a generator that generates unique identity information for each defined resource and service provider, and generates identity information for each session, application;
注册器, 为每个对象向身份管理器注册, 注册器调用生成器为对象生成身 份; The registrar registers each object with an identity manager, and the registrar invokes the generator to generate an identity for the object;
身份存储器, 存储各种对象的身份信息, 包括会话、 服务提供者、 资源、 应用。 An identity store that stores identity information for various objects, including sessions, service providers, resources, and applications.
本发明还揭示了一种基于身份和会话的资源访问方法, 所述方法包括: 一个上游流会话管理器接收客户端的资源请求; The invention also discloses an identity and session based resource access method, the method comprising: an upstream stream session manager receiving a resource request of a client;
该流会话管理器为请求创建一个用于协商执行客户荷载所需资源的流会 话, 并将请求和流会话信息发送到上游代理服务器; The stream session manager creates a stream session for the request to negotiate the resources required to perform the client load, and sends the request and stream session information to the upstream proxy server;
该代理服务器作为中转代理多个请求, 并将请求和流会话信息发往上游控
制会话管理器; The proxy server acts as a relay agent for multiple requests, and sends request and stream session information to the upstream control. Session manager
该控制会话管理器为该请求生成一个与上述流会话相关联的用于协商控 制服务请求的服务提供者的控制会话; The control session manager generates, for the request, a control session of the service provider associated with the streaming session for negotiating the control service request;
控制会话管理器与上游服务总线交互, 服务总线与多个服务提供者相连, 请求和控制会话身份信息通过服务总线在多个服务提供者之间传递, 并通过服 务提供者将请求路由到下游资源中心的实体服务器; The control session manager interacts with the upstream service bus, the service bus is connected to a plurality of service providers, requesting and controlling session identity information is passed between the plurality of service providers over the service bus, and the request is routed to the downstream resources by the service provider Central entity server;
实体服务器上有一个或多个虚机, 资源管理器管理请求在虚机上的运行, 虚机运行所述请求并将运行的结果反馈给客户端。 There are one or more virtual machines on the physical server. The resource manager manages the running of the request on the virtual machine. The virtual machine runs the request and feeds back the result of the running to the client.
根据本发明的基于身份和会话的资源访问方法的一实施例, 所述方法进一 步包括: According to an embodiment of the identity and session based resource access method of the present invention, the method further comprises:
流会话管理器创建流会话, 并访问身份管理器, 获得流会话身份; 代理服务器创建虚拟应用, 并访问身份管理器, 通过关系求解服务, 获得 与上述流会话身份相关联的虚拟应用身份; The streaming session manager creates a streaming session and accesses the identity manager to obtain the streaming session identity; the proxy server creates the virtual application and accesses the identity manager, and obtains the virtual application identity associated with the streaming session identity through the relationship solving service;
控制会话管理器创建与流会话相关联的控制会话, 访问身份管理器, 通过 关系求解服务, 获得与上述流会话身份相关联的控制会话身份。 The control session manager creates a control session associated with the streaming session, accesses the identity manager, and obtains the control session identity associated with the stream session identity described above by the relationship solving service.
资源管理器访问身份管理器, 获得资源的唯一身份, 并可根据资源的唯一 身份通过地址求解服务找到资源的位置。 The resource manager accesses the identity manager, obtains the unique identity of the resource, and can find the location of the resource through the address solving service according to the unique identity of the resource.
根据本发明的基于身份和会话的资源访问方法的一实施例, 所述方法进一 步包括: According to an embodiment of the identity and session based resource access method of the present invention, the method further comprises:
代理服务器接收到流会话控制器发送的请求和流会话信息后, 继续保持与 流会话控制器之间的 TCP/UDP连接; After receiving the request and the stream session information sent by the stream session controller, the proxy server continues to maintain the TCP/UDP connection with the stream session controller;
请求在资源中心的实体服务器上的虚机上运行起来后, 断开代理服务器与 流会话控制器之间的 TCP/UDP连接, 并通过重定向直接将运行结果返回客户端。 After requesting to run on the virtual machine on the physical server in the resource center, disconnect the TCP/UDP connection between the proxy server and the streaming session controller, and directly return the running result to the client through redirection.
根据本发明的基于身份和会话的资源访问方法的一实施例, 所述方法进一 步包括: According to an embodiment of the identity and session based resource access method of the present invention, the method further comprises:
流会话管理器创建流会话, 生成流信令平面, 分离物理资源和动态资源需 求, 并控制按需生成的逻辑核心网。 The stream session manager creates a stream session, generates a stream signaling plane, separates physical resources and dynamic resource requirements, and controls the logical core network generated on demand.
根据本发明的基于身份和会话的资源访问方法的一实施例, 所述方法进一 步包括:
控制会话管理器创建控制会话, 生成控制会话平面, 根据请求需要对服务 提供者进行任意动态组合, 生成多个服务提供者平面。 According to an embodiment of the identity and session-based resource access method of the present invention, the method further includes: The control session manager creates a control session, generates a control session plane, and arbitrarily dynamically combines the service providers according to the request to generate multiple service provider planes.
根据本发明的基于身份和会话的资源访问方法的一实施例, 所述方法进一 步包括: According to an embodiment of the identity and session based resource access method of the present invention, the method further comprises:
使用桥接建立虚机和其上的各种虚拟资源的身份对应关系。 The bridging is used to establish the identity correspondence between the virtual machine and various virtual resources on it.
根据本发明的基于身份和会话的资源访问方法的一实施例, 所述方法进一 步包括: According to an embodiment of the identity and session based resource access method of the present invention, the method further comprises:
为虚机设置两个身份, 一个是虚机自身的, 另一个是引用身份, 指向上面 的组件, 建立虚机与组件间的身份对应关系。 本发明的基于身份和会话的资源访问系统能在数据中心的网络实例环境 下, 将传统电信中服务提供者和资源提供者分离的思想引入到企业数据中心资 源的访问中, 实现荷载和控制会话的分离, 并釆用身份管理方法管理这些资源 的身份。 附图说明 Set two identities for the virtual machine, one is the virtual machine itself, the other is the reference identity, pointing to the above components, establishing the identity relationship between the virtual machine and the component. The identity and session-based resource access system of the present invention can introduce the idea of separating the service provider and the resource provider in the traditional telecommunication into the access of the enterprise data center resource in the network instance environment of the data center, and realize the load and control session. Separation, and use identity management methods to manage the identity of these resources. DRAWINGS
本发明上述的以及其他的特征、 性质和优势将通过下面结合附图和实施例 的描述而变的更加明显,在附图中相同的附图标记始终表示相同的特征,其中: 图 1是根据本发明的一个实施例的基于身份和会话的资源访问系统的结构 框图。 The above and other features, aspects and advantages of the present invention will become more apparent from the description of the appended claims appended claims A block diagram of the identity and session based resource access system of one embodiment of the present invention.
图 2是根据本发明的一个实施例的基于身份和会话的资源访问系统的工作 过程的总流程图, 描述从用户发出应用请求, 到应用实例运行起来返回客户端 的整个过程。 2 is a general flow diagram of the operation of an identity-based and session-based resource access system, describing the entire process from an application request by a user to an application instance returning to the client, in accordance with one embodiment of the present invention.
图 3是根据本发明的一个实施例的基于身份和会话的资源访问系统中流会 话平面图, 体现了客户荷载需要经过的通信资源和计算资源协议栈。 3 is a flow plan diagram of an identity and session based resource access system in accordance with an embodiment of the present invention, embodying communication resources and computing resource protocol stacks through which client loads are required.
图 4是根据本发明的一个实施例的基于身份和会话的资源访问系统中代理 服务器与控制会话管理的交互, 以及控制会话管理器的框图。 4 is a block diagram of interaction of a proxy server with control session management and control session manager in an identity and session based resource access system, in accordance with one embodiment of the present invention.
图 5是根据本发明的一个实施例的基于身份和会话的资源访问系统中代理 服务器与控制会话管理的交互的流程图。
图 6是根据本发明的一个实施例的基于身份和会话的资源访问系统中存储 会话关系的会话数据库的部分存储结构。 5 is a flow diagram of interaction of a proxy server with control session management in an identity and session based resource access system, in accordance with one embodiment of the present invention. 6 is a partial storage structure of a session database storing session relationships in an identity-based and session-based resource access system, in accordance with one embodiment of the present invention.
图 7是根据本发明的一个实施例的基于身份和会话的资源访问系统中身份 管理器的结构框图。 Figure 7 is a block diagram showing the structure of an identity manager in an identity and session based resource access system in accordance with one embodiment of the present invention.
图 8是图 7的身份管理器中的关系求解服务实施 (Relationship Resolution Figure 8 is the relationship resolution service implementation in the identity manager of Figure 7 (Relationship Resolution
Service Implementation) 的描述框图。 A description block diagram of the Service Implementation).
图 9是图 7中的身份管理器中的地址解析 (Address Resolution) 的关系表 述图。 Figure 9 is a relational diagram of address resolution in the identity manager of Figure 7.
图 10 是根据本发明的一个实施例的基于身份和会话的资源访问系统中使 用身份管理器的流程图。 发明的详细说明 图 1是根据本发明的一个实施例的基于身份和会话的资源访问系统的结构 框图。 参考图 1所示, 本发明揭示了一种基于身份和会话的资源访问系统, 包 括: 客户端 1 1、 会话管理中心 12、 资源中心 14、 身份管理器 13。 Figure 10 is a flow diagram of the use of an identity manager in an identity and session based resource access system in accordance with one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION Figure 1 is a block diagram showing the structure of an identity and session based resource access system in accordance with one embodiment of the present invention. Referring to FIG. 1, the present invention discloses an identity and session based resource access system, including: a client 1 1 , a session management center 12 , a resource center 14 , and an identity manager 13 .
客户端 1 1发出服务请求并定义执行该服务请求所需要的资源信息。 The client 1 1 issues a service request and defines the resource information needed to execute the service request.
会话管理中心 12接收客户端 1 1发出的服务请求, 在本发明中, 服务请求 也可以称之为应用请求。 会话管理中心 12根据该服务请求创建流会话并根据 流会话创建控制会话, 会话管理中心 12协商流会话所需的资源和控制会话所 需的服务提供者, 并将请求路由到资源中心。 The session management center 12 receives the service request issued by the client 11, and in the present invention, the service request may also be referred to as an application request. The session management center 12 creates a streaming session according to the service request and creates a control session according to the streaming session. The session management center 12 negotiates the resources required for the streaming session and the service providers required to control the session, and routes the request to the resource center.
资源中心 14包括实体服务器、 网络和存储器, 实体服务器上运行一个或 多个虚机。 资源中心 14接收服务请求、 并管理请求的运行, 虚机运行服务请 求并将运行的结果反馈给客户端 1 1。 Resource Center 14 includes physical servers, networks, and storage, and one or more virtual machines are running on the physical servers. The resource center 14 receives the service request and manages the running of the request, and the virtual machine runs the service request and feeds back the result of the running to the client 1 1.
身份管理器 13与会话管理中心及资源中心通信连接, 身份管理器 13管理 资源、 服务提供者、 会话、 应用等对象的身份信息, 身份管理器 13还管理身 份信息的生命周期。 The identity manager 13 is in communication with the session management center and the resource center. The identity manager 13 manages the identity information of objects such as resources, service providers, sessions, applications, etc. The identity manager 13 also manages the lifecycle of the identity information.
参考图 1所示, 会话管理中心 12包括: 流会话管理器 121、 代理服务器 122、 控制会话管理器 123、 和和会话数据库 125。 流会话管理器 121管理实时
的网络会话, 流会话管理器 121接收客户端 1 1发送的服务请求, 根据该服务 请求创建流会话并协商流会话所需的资源, 流会话管理器 121转发服务请求。 在图 1所示的实施例中, 流会话管理器 121包括流会话生成器 121 1和流信令 平面 1212。 流会话生成器 121 1为接收到的服务请求创建流会话并管理流会话 的生命周期, 流会话生成器 121 1还协商流会话所需要的资源, 即运行用户荷 载所需的资源。 流信令平面 1212与流会话生成器 121 1通信连接, 由流会话过 程中所参与的资源间的通信协议栈形成流信令平面 1212分离资源中的物理资 源与动态资源。代理服务器 122与流会话管理器 121通信连接,代理服务器 122 是用户和资源间的中间人或经纪人, 代理服务器可以识别用户的请求, 代理服 务器 122接收由流会话管理器 121转发的服务请求并保持连接,代理服务器 122 获取流会话管理器创建的流会话信息, 代理服务器 122调度并发的服务请求。 在图 1所示的实施例中, 代理服务器 122包括应用容器 1221, 应用容器 1221 保存与服务请求相关的请求信息, 包括 IP地址、 端口号、 协议。 控制会话管理 器 123与代理服务器 122通信连接, 控制会话管理器 123从代理服务器 122获 取流会话信息并创建相应的控制会话并协商控制会话所需的服务提供者, 即控 制用户请求的服务提供者。 控制会话管理器 123转发服务请求。 在图 1所示的 实施例中, 控制会话管理器 123包括会话控制器 123 1和控制信令平面 1232。 会话控制器 123 1根据流会话创建控制会话并管理控制会话的生命周期, 会话 控制器 123 1还协商控制会话所需要的服务提供者。 控制信令平面 1232由控制 会话过程中所参与的服务提供者间的通信协议栈形成, 控制信令平面 1232将 服务提供者与资源提供者分离。 服务总线 124连接到控制会话管理器 123, 服 务总线 124由中间件基础架构实现, 服务总线包含事件驱动和消息引擎, 并与 多个服务提供者相连。 会话数据库保存服务请求从客户端传送至资源中心的虚 机上运行以及运行的结果从资源中心反馈给客户端的过程中的流会话、 控制会 话和用户会话信息。 会话数据库 125保存服务请求从客户端 1 1传送至资源中 心 14的虚机上运行以及运行的结果从资源中心 14反馈给客户端 1 1的过程中 的流会话、 控制会话和用户会话信息。 会话数据库 125可以运行在一个或多个 服务器上。 Referring to FIG. 1, the session management center 12 includes: a stream session manager 121, a proxy server 122, a control session manager 123, and a session database 125. Stream session manager 121 manages real time The network session manager, the stream session manager 121 receives the service request sent by the client 11, and creates a stream session according to the service request and negotiates resources required for the stream session, and the stream session manager 121 forwards the service request. In the embodiment shown in FIG. 1, the stream session manager 121 includes a stream session generator 121 1 and a stream signaling plane 1212. The stream session generator 121 1 creates a stream session for the received service request and manages the life cycle of the stream session, and the stream session generator 121 1 also negotiates the resources required for the stream session, that is, the resources required to run the user load. The flow signaling plane 1212 is in communication with the flow session generator 121 1 , and the flow signaling plane 1212 separates the physical resources and the dynamic resources in the resource by the communication protocol stack between the resources involved in the flow session. The proxy server 122 is in communication with the streaming session manager 121, which is an intermediary or broker between the user and the resource, the proxy server can identify the user's request, and the proxy server 122 receives the service request forwarded by the streaming session manager 121 and maintains Connected, the proxy server 122 obtains the stream session information created by the stream session manager, and the proxy server 122 schedules the concurrent service request. In the embodiment shown in FIG. 1, the proxy server 122 includes an application container 1221 that stores request information related to the service request, including an IP address, a port number, and a protocol. The control session manager 123 is in communication with the proxy server 122, and the control session manager 123 obtains streaming session information from the proxy server 122 and creates a corresponding control session and negotiates the service provider required to control the session, ie, the service provider that controls the user request. . The control session manager 123 forwards the service request. In the embodiment shown in FIG. 1, the control session manager 123 includes a session controller 123 1 and a control signaling plane 1232. The session controller 123 1 creates a control session according to the flow session and manages the life cycle of the control session, and the session controller 1231 also negotiates the service provider required to control the session. The control signaling plane 1232 is formed by a communication protocol stack between service providers participating in the control session, and the control signaling plane 1232 separates the service provider from the resource provider. The service bus 124 is coupled to a control session manager 123, which is implemented by a middleware infrastructure that includes an event driven and messaging engine and is coupled to a plurality of service providers. The session database saves the streaming session, control session, and user session information in the process of the service request from the client to the virtual machine running in the resource center and running the result from the resource center to the client. The session database 125 stores the streaming session, control session, and user session information in the process of the service request being transmitted from the client 11 to the virtual machine of the resource center 14 and the result of the operation being fed back from the resource center 14 to the client 11. Session database 125 can run on one or more servers.
继续参考图 1, 资源中心 14中的实体服务器 141包括服务器资源管理器
141 1、 硬件架构 1412、 虚机管理器 1413和数个虚机 1414。 服务器资源管理器 141 1管理服务请求在虚机上的运行,虚机管理器 1413管理虚机 1414。网络 142 包括网络资源管理器 1421, 网络资源管理器 1421管理网络资源并对实体服务 器 141中的虚机 1414进行组网。 存储器 143包括存储资源管理器 143 1, 存储 资源管理器 143 1管理存储资源并为虚机 image等各种信息提供存储服务。 With continued reference to FIG. 1, the entity server 141 in the resource center 14 includes a server resource manager. 141 1. Hardware architecture 1412, virtual machine manager 1413, and several virtual machines 1414. The server resource manager 141 1 manages the operation of the service request on the virtual machine, and the virtual machine manager 1413 manages the virtual machine 1414. The network 142 includes a network resource manager 1421 that manages network resources and networkes the virtual machines 1414 in the entity server 141. The memory 143 includes a storage resource manager 143 1. The storage resource manager 143 1 manages storage resources and provides storage services for various information such as a virtual machine image.
参考图 1所示, 身份管理器 13包括柄求解系统 131、 生成器 132、 注册器 133和身份存储器 134。 柄求解系统 13 1通过树形结构和图形结构求解确定资 源的位置和服务请求涉及的各对象间的关系。 生成器 132为每个定义的资源和 服务提供者生成唯一的身份信息, 生成器 132还为每一个实时的会话, 应用生 成身份信息。 注册器 133为对象向身份管理器注册, 注册器调用生成器为对象 生成身份。 身份存储器 134存储各种对象的身份信息, 包括会话、服务提供者、 资源、 应用等。 Referring to FIG. 1, the identity manager 13 includes a handle solving system 131, a generator 132, a register 133, and an identity store 134. The shank solving system 13 1 solves the relationship between the location of the resource and the objects involved in the service request by solving the tree structure and the graphic structure. The generator 132 generates unique identity information for each defined resource and service provider, and the generator 132 also generates identity information for each real-time session. The Registrar 133 registers the object with the Identity Manager, which invokes the generator to generate an identity for the object. The identity store 134 stores identity information for various objects, including sessions, service providers, resources, applications, and the like.
继续参考图 1所示, 该基于身份和会话的资源访问系统运行如下: 客户端 1 1可以是用户, 客户端 1 1发出一个服务请求, 比如请求创建 lamp, 并定义创 建 lamp所需的资源信息。 服务请求先到达会话管理中心 12中的流会话管理器 ( streaming session manager) 121, 流会话管理器 121中的会话生成器 ( session creator) 121 1为该服务请求创建一个流会话 (session) , 协商执行用户荷载所 需的资源, 并管理会话的生命周期。 流会话过程中所参与的资源间的通信协议 栈形成流信令平面 1212, 可以分离物理资源和动态资源需求, 控制按需生成的 逻辑核心网。 这里的流会话管理器 121可以是四至七层交换机或应用交付控制 器, 具体可以是 F5 LTM、 Cisco ACE等设备。 流会话管理器 12通过 TCP/UDP 协议将请求传送到代理服务器 (broker) 122, 并保持该 TCP/UDP连接。 代理 服务器 122是用户和资源间的中间人或经纪人, 接收面向客户的应用请求, 将 用户的请求信息包括 IP, port, protocol等信息存放起来在应用容器 1221中, 代 理服务器 122对并发性请求进行调度。 代理服务器 122接着把请求发往控制会 话管理器 (controlling session manager) 123, 控制会话管理器 123由会话控制 器 1231和控制信令平面 1232组成。 会话控制器 123 1根据流会话创建相关的 控制会话, 协商控制会话所需的服务提供者, 即控制用户请求的服务提供者, 并管理会话的生命周期。 控制会话过程中所参与的服务提供者间的通信协议栈
形成控制信令平面 1232, 可以将服务提供者与资源提供者分离, 根据需要提供 服务提供者的任意动态组合。 控制会话管理器 123与服务总线 124相连, 服务 总线 124是由中间件基础架构技术实现的, 通过事件驱动和消息引擎, 为面向 服务的架构提供的软件架构的构造物。 在本发明中, 各服务提供者都与服务总 线 124相连, 用户请求和会话身份通过服务总线在服务提供者之间传播。 通过 服务提供者的处理 (process ) 和一定的策略, 最终将请求路由到资源中心 14 中的服务器 141, 相对于前面的代理服务器 122的中介作用而言, 实体服务器 141是最终运行请求的硬件设备。 每个实体服务器 141上有硬件架构 1412、 虚 机管理器 1413和数个虚机 1414, 还有服务器资源管理器 141 1。 网络 142中的 网络资源管理器 1421管理网络资源以及对虚机的组网, 存储器 143中的存储 资源管理器 143 1管理存储资源。 服务请求最终通过服务器资源管理器 141 1在 实体服务器 141上的数个虚机 1414上运行, 一个虚机实例的运行需要同时用 到网络资源和存储资源。当服务请求运行起来后,将结果直接返回到客户端 1 1, 这是荷载的传输过程, 同时断掉流会话管理器 12与代理服务器 (broker) 122 之间的 TCP/UDP连接, 控制信令过程结束。 流会话, 控制会话, 用户会话等信 息都存储在会话数据库 125中, 会话数据库 125中的数据可以存在内存中或磁 盘上。 会话管理器与身份管理器交互以获得会话的身份并将会话相关的信息存 储在会话数据库中。 身份管理器 13管理身份信息 (ID ) 的生命周期, 即身份 信息的生成,维持,删除,身份管理器 13由柄求解系统(handle resolution system) 131 , 生成器 ( Generator) 132, 注册器 ( Registry) 133, 身份存储器 ( Store ) 134 组成, 柄求解系统 13 1是身份管理器 13的核心, 主要通过树形结构和图形结 构求解出资源的位置和应用关系。 注册器 133管理资源向身份管理器 13注册, 生成器 132按照一定的规则为每个定义的对象生成身份符。 身份存储器 134是 身份管理器 13中的数据存储中心, 存储资源、 服务提供者、 会话、 应用等对 象的身份信息, 求解信息, 配置服务等信息。 在本发明的一个或多个较佳实施 例中, 当到达主机资源管理器 141 1的请求为 start VM (启动虚机) 时, 主机资 源管理器 141 1需要从身份管理器 13中得到虚机的 URL。虚机镜像存放在存储 ( shared storage ) 143中, 当请求为 create Vm (创建虚机) 时, 需要从存储 143 中获得虚机模板的 URL, 这里要用到存储 143上的存储资源管理器 1431。
图 2是根据本发明的一个实施例的基于身份和会话的资源访问系统的工作 过程的总流程图, 描述从用户发出应用请求, 到应用实例运行起来返回客户端 的整个过程。 具体步骤如下: With continued reference to Figure 1, the identity and session based resource access system operates as follows: Client 11 can be a user, client 11 issues a service request, such as requesting to create a lamp, and defining the resource information needed to create the lamp. . The service request first arrives at a streaming session manager 121 in the session management center 12, and a session creator 121 1 in the streaming session manager 121 creates a streaming session for the service request, negotiating The resources required to perform user loads and manage the lifecycle of the session. The communication protocol stack between the resources involved in the flow session forms a flow signaling plane 1212, which can separate physical resources and dynamic resource requirements, and control the logical core network generated on demand. The stream session manager 121 herein may be a four- to seven-layer switch or an application delivery controller, and may specifically be a device such as an F5 LTM or a Cisco ACE. The streaming session manager 12 passes the request to the broker 122 via the TCP/UDP protocol and maintains the TCP/UDP connection. The proxy server 122 is an intermediary or broker between the user and the resource, receives the application request from the client, and stores the user's request information including IP, port, protocol, etc. in the application container 1221, and the proxy server 122 performs the concurrent request. Scheduling. The proxy server 122 then sends the request to the control session manager 123, which consists of the session controller 1231 and the control signaling plane 1232. The session controller 123 1 creates an associated control session according to the flow session, negotiates the service provider required to control the session, that is, controls the service provider requested by the user, and manages the life cycle of the session. Control the communication protocol stack between service providers involved in the session Forming a control signaling plane 1232, the service provider can be separated from the resource provider, providing any dynamic combination of service providers as needed. Control session manager 123 is coupled to service bus 124, which is implemented by middleware infrastructure technology, a software architecture architecture provided for service oriented architecture through event driven and messaging engines. In the present invention, each service provider is connected to a service bus 124, and user requests and session identities are propagated between service providers over the service bus. Through the service provider's process and certain policies, the request is finally routed to the server 141 in the resource center 14, and the entity server 141 is the hardware device that finally runs the request with respect to the intermediary role of the previous proxy server 122. . Each physical server 141 has a hardware architecture 1412, a virtual machine manager 1413, and a plurality of virtual machines 1414, and a server resource manager 141 1 . The network resource manager 1421 in the network 142 manages network resources and the networking of the virtual machines, and the storage resource manager 143 1 in the memory 143 manages the storage resources. The service request is finally run by the server resource manager 141 1 on a plurality of virtual machines 1414 on the entity server 141. The operation of a virtual machine instance requires the use of both network resources and storage resources. When the service request is run, the result is directly returned to the client 1 1. This is the transfer process of the payload, and the TCP/UDP connection between the stream session manager 12 and the broker 122 is broken, and the control signaling is The process ends. Information such as streaming sessions, control sessions, user sessions, and the like are stored in the session database 125, and the data in the session database 125 can be stored in memory or on disk. The session manager interacts with the identity manager to obtain the identity of the session and store session related information in the session database. The identity manager 13 manages the life cycle of the identity information (ID), that is, the generation, maintenance, and deletion of the identity information, the identity manager 13 by the handle resolution system 131, the generator 132, the registry (Registry) 133, the identity storage (Store) 134 is composed, the handle solving system 13 1 is the core of the identity manager 13, and the location and application relationship of the resource are mainly solved by the tree structure and the graphic structure. The registrar 133 manages the resources to register with the identity manager 13, and the generator 132 generates identifiers for each of the defined objects in accordance with certain rules. The identity store 134 is a data storage center in the identity manager 13, which stores identity information of objects such as resources, service providers, sessions, applications, etc., solves information, configures services, and the like. In one or more preferred embodiments of the present invention, when the request to the host resource manager 141 1 is a start VM (starting the virtual machine), the host resource manager 141 1 needs to obtain the virtual machine from the identity manager 13. URL. The virtual machine image is stored in the shared storage 143. When the request is create Vm (create virtual machine), the URL of the virtual machine template needs to be obtained from the storage 143. Here, the storage resource manager 1431 on the storage 143 is used. . 2 is a general flow diagram of the operation of an identity-based and session-based resource access system, describing the entire process from an application request by a user to an application instance returning to the client, in accordance with an embodiment of the present invention. Specific steps are as follows:
步骤 201, 用户发出应用请求(用户请求应用, 包含 IP, port, protocol等), 这里的应用请求即服务请求, , 比如创建一个 lamp, 请求资源; Step 201: The user sends an application request (the user requests the application, including IP, port, protocol, etc.), where the application request is a service request, for example, creating a lamp, requesting a resource;
步骤 202, 判断用户是否通过认证授权, 若通过, 请求转移到 203, 否则 请求转移到 201 ; Step 202: Determine whether the user passes the authentication and authorization. If yes, the request is transferred to 203, otherwise the request is transferred to 201;
步骤 203, 请求到达流会话管理器, 流会话管理器为请求生成一个会话 ( session) , 访问身份管理器, 获得一个流会话身份 ( streaming session ID ) , 将流会话身份存入到流会话表格的一条记录中; Step 203, the request arrives at the stream session manager, the stream session manager generates a session for the request, accesses the identity manager, obtains a streaming session ID, and stores the stream session identity into the stream session table. In a record;
步骤 204, 流会话管理器将请求和流会话身份 (streaming session ID ) 转入 到作为虚拟服务器 (fake server) 的代理服务器, 并保持 TCP/UDP连接, 保持 该连接的目的是为了将请求转入到控制信令过程,实现请求的有效控制,路由, 以及服务质量保证等, 关于代理服务器, 可以看做用户和资源间的中间人或经 纪人, 代理服务器可以识别用户的请求, 并将请求转入到后面的处理系统, 将 会在图 4中详细说明; Step 204, the streaming session manager transfers the request and the streaming session ID to the proxy server as a fake server, and maintains the TCP/UDP connection. The purpose of the connection is to transfer the request. To the control signaling process, to achieve effective control of the request, routing, and quality of service assurance, regarding the proxy server, can be seen as a middleman or broker between the user and the resource, the proxy server can identify the user's request, and transfer the request The processing system to the back will be described in detail in Figure 4;
步骤 205, 代理服务器访问身份管理器, 通过关系求解服务, 获得与上述 流会话身份相关联的虚拟应用身份, 同时将请求和流会话身份 (streaming session ID )发送到控制会话管理器, 这里把整个系统看成执行请求的一个应用 程序, 把请求看作用户向应用程序发出的应用请求 (APP) , 请求由用户发出, 到达代理服务器时, 此时的应用请求是用户描述的面向用户的应用, 也称之为 虚拟应用请求; Step 205: The proxy server accesses the identity manager, obtains the virtual application identity associated with the flow session identity by using the relationship solving service, and sends the request and the streaming session ID to the control session manager, where the entire The system is regarded as an application that executes the request, and the request is regarded as an application request (APP) issued by the user to the application, and the request is sent by the user, and when the proxy server is reached, the application request at this time is a user-oriented application described by the user. Also known as a virtual application request;
步骤 206, 控制会话管理器根据流会话为请求创建一个相关的控制会话 ( controlling session) , 并访问身份管理器, 通过关系求解服务, 获得与流会 话身份相关的控制会话身份 (Controlling session ID ) ; Step 206: The control session manager creates an associated controlling session for the request according to the streaming session, and accesses the identity manager to obtain a Controlling Session ID related to the streaming session identity through the relationship solving service.
步骤 207, 控制会话管理器调用服务总线, 服务总线通过与之相连的多个 服务提供者将虚拟应用程序转化为应用程序, 控制请求走向, 控制会话通过服 务总线在服务提供者间传递, 同时将请求路由到资源中心的实体服务器上; 步骤 208, 服务器上的资源管理器管理应用请求的执行, 通过访问身份管
理器获取执行应用请求所需的资源; Step 207: The control session manager invokes a service bus, and the service bus converts the virtual application into an application through a plurality of service providers connected thereto, controls the request direction, and controls the session to be transmitted between the service providers through the service bus, and The request is routed to the physical server of the resource center; Step 208, the resource manager on the server manages the execution of the application request, by accessing the identity tube The processor obtains the resources required to execute the application request;
步骤 209, 判断资源是否准备好, 若资源都准备好了, 则转入到步骤 21 1, 否则转入到步骤 210; Step 209, determining whether the resource is ready, if the resource is ready, then proceeds to step 21 1, otherwise proceeds to step 210;
步骤 210, 等待, 直至资源都准备好了; Step 210, wait until the resources are ready;
步骤 21 1, 执行请求, 生成一个应用实例 (APP INSTANT ) ; Step 21 1. Execute the request to generate an application instance (APP INSTANT);
步骤 212, 流会话管理器管理运行的数据荷载, 并断开与代理服务器的为 该请求建立的与 TCP/UDP连接; Step 212, the stream session manager manages the running data load, and disconnects the TCP/UDP connection established with the proxy server for the request;
步骤 213, 将请求执行的结果通过重定向 (redirect) 直接返回给客户, 会 话结束后, 释放与之相关的资源信息。 Step 213: The result of the request execution is directly returned to the client by redirecting, and after the session ends, the resource information related thereto is released.
图 3是根据本发明的一个实施例的基于身份和会话的资源访问系统中流会 话平面图, 体现了客户荷载需要经过的通信资源和计算资源协议栈。 在流会话 平面中, 一个客户荷载 38的执行首先需要计算资源, 在虚拟化环境下, 计算 资源可以分为虚拟计算资源和物理计算资源。 虚拟计算资源就是我们通常所说 的虚机,具体以虚机文件的方式提供。在协议栈中处于本地逻辑计算工作栈 37。 本地逻辑计算工作栈 37下面是管理和控制虚机的虚机管理器 VMM 36, VMM 36提供了计算资源的交换和仲裁, 并将本地逻辑工作栈 37映射(map )到本地 物理计算工作栈 35, 即服务器上物理资源, 具体可以是服务器上的 CPU, memory, disk, I/O等设备。 当然, 也可以将本地物理计算工作栈 35映射(map) 到本地逻辑工作栈 37。 客户荷载 38获得了物理资源就可以真正运行起来。 荷 载之间需要交互, 传输, 这时就需要用于通信的网络资源, 包括本地网络端口 资源和 IO链路资源。 荷载之间的通信首先通过本地端口资源和 TCP/UDP端口 34进行通信, 根据通信协议栈的层次, 逐层映射到 IO链路中的 IP层 33的网 络通信, 数据链路层 32的数据链路通信, 直到最底层的物理媒介 31的传输, 此时便完成了整个通信过程。 并将运行结果返回到客户端, 通信过程是通过流 会话管理器来管理的, 从而保证了客户荷载的网络实例的运行以及服务质量。 此流会话平面 (信令网) 可以分离物理资源和动态资源需求, 实现资源的按需 供给。 3 is a flow plan diagram of an identity and session based resource access system in accordance with an embodiment of the present invention, embodying communication resources and computing resource protocol stacks through which client loads are required. In the flow session plane, the execution of a client load 38 first requires computing resources. In a virtualized environment, computing resources can be divided into virtual computing resources and physical computing resources. Virtual computing resources are what we usually call virtual machines, which are provided in the form of virtual machine files. It is in the local logical computing work stack 37 in the protocol stack. Below the local logical computing work stack 37 is a virtual machine manager VMM 36 that manages and controls the virtual machine. The VMM 36 provides exchange and arbitration of computing resources and maps the local logical working stack 37 to the local physical computing work stack. That is, the physical resources on the server, specifically the CPU, memory, disk, I/O, etc. on the server. Of course, the local physical computing work stack 35 can also be mapped to the local logical work stack 37. The customer load 38 gets the physical resources and can actually run. The load needs to be exchanged and transmitted. At this time, network resources for communication, including local network port resources and IO link resources, are required. The communication between the loads is first communicated through the local port resource and the TCP/UDP port 34, and mapped to the network communication of the IP layer 33 in the IO link layer by layer according to the hierarchy of the communication protocol stack, the data link of the data link layer 32 Road communication, until the transmission of the lowest physical medium 31, completes the entire communication process. The results of the operation are returned to the client, and the communication process is managed by the stream session manager, thereby ensuring the operation of the network instance of the customer load and the quality of service. This flow session plane (signaling network) can separate physical resources and dynamic resource requirements to achieve on-demand provisioning of resources.
图 4是根据本发明的一个实施例的基于身份和会话的资源访问系统中代理 服务器与控制会话管理的交互, 以及控制会话管理器的框图。 流会话管理器 41
(或应用交付控制器) 生成流会话, 流会话管理器 41中的地址和服务器池可 以动态配置流会话所需的资源, 由于用户发出的请求 (面向用户的应用请求) 中是用户关注的一些应用信息, 比如 IP, port, protocol等,这些信息并不能准确 地提供面向资源的应用描述, 流会话管理器 41没法根据这些信息把请求路由 到具体的服务器上执行, 所以先将请求转向一个虚拟服务器(fake server) , 即 代理服务器 42。 代理服务器 42相当于用户和资源间的经纪人, 其中包含一个 应用容器 421, 里面存放用户请求的应用信息, 即虚拟应用, 从虚拟应用 1到 虚拟应用 n。 这里把整个系统看成执行请求的一个应用程序, 把请求看作用户 向应用程序发出的应用请求 (APP ) , 请求由用户发出, 到达代理服务器时, 此时的应用请求是用户描述的面向用户的应用, 也称之为虚拟应用; 当请求经 过服务提供者的处理到达资源时, 应用请求将会变成描述资源需求的面向资源 的应用, 也称之为应用。 代理服务器 42将请求转发到控制会话管理器 43 (来 控制请求的走向) , 控制会话管理器 43中的会话控制器 43 1为该请求创建与 流会话相关的控制会话, 协商执行用户请求的服务提供者之间的通信, 并管理 会话的生命周期。 控制会话过程中所参与的服务提供者间的通信协议栈形成控 制信令平面 432, 可以将服务提供者与资源提供者分离, 根据需要提供服务提 供者的任意动态组合, 即动态生成多个服务提供者平面, 从服务提供者平面 4321, 服务提供者平面 4322, 到服务提供者平面 432n。 控制会话管理器 43与 服务总线 44相连, 服务总线 44是由中间件基础架构技术实现的, 通过事件驱 动和消息引擎, 为面向服务的架构提供的软件架构的构造物。 在本发明中, 服 务提供者集合 441中的各服务提供者都与服务总线 44相连, 并在服务总线 44 下注册, 服务总线 44控制和管理这些服务提供者间的交互, 服务路由, 协议 转换等。 用户请求和会话身份通过服务总线在服务提供者之间传播。 这里的服 务提供者是支持和优化资源访问的提供应用服务的多个功能模块, 如 service enabler, service factory; 虚拟资源管理的功能模块, 如虚机管理器 441 1, 存 储管理器 4412,网络管理器 4413等;以及一些提升性能的功能模块,如 monitor, NMS等。 控制会话管理器 43运行在一个中心服务器上。 对服务提供者的访问 通过代理 45实现, 每个服务提供者上都有一个代理 (agent) 45, 代理 45监控 到请求, 就对请求进行调度后将请求发送给对应的服务提供者, 通过代理 45
可以实现对并发性请求的处理。 通过服务提供者的处理 (process ) 和一定的策 略, 最终将请求路由到资源中心中的实体服务器, 实体服务器是相对于前面的 代理服务器而言。 4 is a block diagram of an interaction of a proxy server with control session management and a control session manager in an identity and session based resource access system, in accordance with one embodiment of the present invention. Stream session manager 41 (or application delivery controller) to generate a streaming session, the address and server pool in the streaming session manager 41 can dynamically configure the resources required for the streaming session, due to the user's request (user-oriented application request) is the user's attention Application information, such as IP, port, protocol, etc., does not accurately provide resource-oriented application descriptions. Stream session manager 41 cannot route requests to specific servers for execution based on this information, so first redirect the request to a A fake server, that is, a proxy server 42. The proxy server 42 is equivalent to a broker between the user and the resource, and includes an application container 421, which stores application information requested by the user, that is, a virtual application, from the virtual application 1 to the virtual application n. Here, the whole system is regarded as an application that executes the request, and the request is regarded as an application request (APP) issued by the user to the application, and the request is sent by the user. When the proxy server is reached, the application request at this time is the user-oriented user description. An application, also called a virtual application; when a request arrives at a resource through the service provider's processing, the application request becomes a resource-oriented application that describes the resource requirement, also known as an application. The proxy server 42 forwards the request to the control session manager 43 (to control the direction of the request), and the session controller 43 1 in the control session manager 43 creates a control session associated with the streaming session for the request, negotiating to perform the service requested by the user. Communicate between providers and manage the lifecycle of the session. The communication protocol stack between the service providers involved in the control session forms a control signaling plane 432, which can separate the service provider from the resource provider, and provide any dynamic combination of service providers as needed, that is, dynamically generate multiple services. The provider plane, from the service provider plane 4321, the service provider plane 4322, to the service provider plane 432n. Control session manager 43 is coupled to service bus 44, which is implemented by middleware infrastructure technology, a software architecture architecture provided for service oriented architecture through event driven and messaging engines. In the present invention, each service provider in the service provider set 441 is connected to the service bus 44 and registered under the service bus 44. The service bus 44 controls and manages the interaction between these service providers, service routing, protocol conversion. Wait. User requests and session identities are propagated between service providers through the service bus. The service provider here is a plurality of functional modules for providing application services to support and optimize resource access, such as service enabler, service factory; functional modules of virtual resource management, such as virtual machine manager 441 1, storage manager 4412, network management 4413, etc.; and some functional modules that improve performance, such as monitor, NMS, etc. The control session manager 43 runs on a central server. The access to the service provider is implemented by the agent 45, and each service provider has an agent 45. The agent 45 monitors the request, dispatches the request, and sends the request to the corresponding service provider. 45 The processing of concurrent requests can be implemented. Through the service provider's process and certain policies, the request is finally routed to the physical server in the resource center, which is relative to the previous proxy server.
图 5是根据本发明的一个实施例的基于身份和会话的资源访问系统中代理 服务器与控制会话管理器的交互的流程图。 具体过程如下: Figure 5 is a flow diagram of the interaction of a proxy server with a control session manager in an identity and session based resource access system, in accordance with one embodiment of the present invention. The specific process is as follows:
步骤 501, 流会话管理器将请求发送到代理服务器; Step 501, the stream session manager sends the request to the proxy server;
步骤 502, 判断是否通过认证授权, 若通过认证授权, 则转入到步骤 503, 否则重新返回到步骤 502进行判断; Step 502: Determine whether the authentication authorization is passed. If the authentication authorization is passed, the process proceeds to step 503, otherwise, the process returns to step 502 to determine;
步骤 503, 判断是否是并发性的请求, 若是, 转入到步骤 504, 否则转入 到步骤 505 ; Step 503, determining whether it is a concurrent request, and if so, proceeding to step 504, otherwise proceeding to step 505;
步骤 504, 代理服务器中的应用容器对请求进行调度; Step 504: The application container in the proxy server schedules the request.
步骤 505, 代理服务器将该请求发到控制会话管理器; Step 505, the proxy server sends the request to the control session manager;
步骤 506, 会话控制器为该请求创建一个与流会话相关的控制会话; 步骤 507, 控制会话身份 (Controlling session ID ) 通过服务总线在多个服 务提供者 ( service provider) 间传递, 从而形成控制信令平面 ( service provider plane ) ; Step 506: The session controller creates a control session related to the streaming session for the request. Step 507: Controlling session ID is transmitted between the multiple service providers through the service bus, thereby forming a control message. Service provider plane ;
步骤 508, 判断是否多个请求同时请求使用一个服务 (service ) , 若是, 转入到步骤 510, 否则转入到步骤 509 ; Step 508, determining whether multiple requests simultaneously request to use a service (service), and if so, proceeding to step 510, otherwise proceeding to step 509;
步骤 509, 服务总线为请求分配服务提供者 (service provider) ; Step 509, the service bus allocates a service provider for the request;
步骤 510,服务总线下注册的服务提供者(service provider)上的代理(agent) 为请求分配服务 (service ) 。 通过该过程, 可以将请求路由到实体服务器上执 行, 即使请求访问真实的物理资源。 Step 510, an agent on a service provider registered under the service bus allocates a service (service) for the request. Through this process, requests can be routed to the physical server for execution, even if they request access to real physical resources.
图 6是根据本发明的一个实施例的基于身份和会话的资源访问系统中存储 会话关系的会话数据库的部分存储结构。 会话数据库 6中存储的是多个会话 ( session)关系表格, 由流会话表格 61, 控制会话表格 62, 用户会话表格 63, 以及会话关系表格 64组成。 用户发出应用请求, 在本发明中, 用户请求的应 用即为资源, 为了实现一个用户对应多个请求, 资源的复用, 服务 (service ) 的复用, 将用户请求的会话分离成流会话, 控制会话, 用户会话。 流会话表格 61主要存储流会话以及与流会话绑定在一起的网络地址和网络寻址身份信息,
具体有流会话身份 (streaming session ID ) , 网络身份 (Network ID ) , 输入输 出端口身份 (I/O ID ) , 其中 ID通过访问身份管理器获得。 Network ID包括网 络设备交换机, 路由器等的身份, I/O ID是指端口的身份, 通过身份可以找到 这些资源的地址。 流会话表格对应于流会话平面中的 I/O链路资源和本地网络 端口资源部分。 控制会话是关于控制层面的会话, 控制会话表格 62主要存储 控制会话以及与控制会话绑定在一起的服务提供者身份信息, 具体有 6 is a partial storage structure of a session database storing session relationships in an identity-based and session-based resource access system, in accordance with one embodiment of the present invention. Stored in the session database 6 are a plurality of session relationship tables, which are composed of a stream session table 61, a control session table 62, a user session table 63, and a session relationship table 64. The user sends an application request. In the present invention, the application requested by the user is a resource, in order to implement a user corresponding to multiple requests, resource multiplexing, service (service) multiplexing, and separating the user-requested session into a streaming session. Control session, user session. The stream session table 61 mainly stores a stream session and a network address and network addressing identity information bound to the stream session. Specifically, there are streaming session ID, network ID, and I/O ID, where the ID is obtained by accessing the identity manager. The Network ID includes the identity of the network device switch, router, etc. The I/O ID refers to the identity of the port, and the address of these resources can be found by identity. The flow session table corresponds to the I/O link resource and local network port resource portion in the flow session plane. The control session is a session about the control plane, and the control session table 62 mainly stores the control session and the service provider identity information bound to the control session, specifically
controlling session ID和多个 service provider ID , 其 ID由身份管理器提供。 控 制会话表格对应于控制信令平面。 用户会话是用户请求应用 (app ) 的会话 ( session) , 表示了用户 (user) 和应用 (app ) 之间的关系, 以及应用 (app ) 的组件关系。 用户会话表格 63主要存储这些对象的身份信息, 具体有 User session ID, User ID, App ID, vApp ID, Domain ID, Component ID, VM ID, Server ID, Storage ID。 其间的关系是动态关系。 这些 ID都通过身份管理器获得, 并 通过身份管理器中的柄系统表示其中的关系, 将在后面的图中详细说明。 流会 话, 控制会话, 用户会话是一个请求的三个方面, 之间是有着紧密的联系的, 这时就需要一个会话关系表格(session relationship table ) 64来表示它们之间的 关系。 由于我们可以考虑用户请求的应用 (app ) 为服务请求, 故将服务会话身 份 (service session ID ) 作为关系表的主键, 其它的属性字段有 User session Id, streaming session ID, controlling session ID,这些属性都是前面几个表格的主键, 因而将这些分离的会话 (session) 关联在一个请求中。 当创建会话 (session) 时, 会话 (session) 相关的数据存放在会话数据库 ( Session Store ) , 当完成终 止一个会话 (session) 时, 则需要释放相应的资源。 会话身份 (Session ID ) 是 临时创建的,其它的资源身份(ID ),包括数据中心资源和服务提供者身份(ID) 都是不变的,当一个会话(session)结束时,需要删除临时表中的会话(session), 并释放相应的资源, 这个过程相当于订阅, 订阅结束, 释放资源。 Controlling session ID and multiple service provider IDs whose ID is provided by the identity manager. The control session table corresponds to the control signaling plane. A user session is a session in which a user requests an application (app), indicating the relationship between the user (user) and the application (app), and the component relationship of the application (app). The user session table 63 mainly stores the identity information of these objects, including User Session ID, User ID, App ID, vApp ID, Domain ID, Component ID, VM ID, Server ID, and Storage ID. The relationship between them is a dynamic relationship. These IDs are obtained through the Identity Manager and are represented by the handle system in the Identity Manager, as detailed in the following figures. Streaming sessions, controlling sessions, user sessions are three aspects of a request, and there is a close relationship between them. In this case, a session relationship table 64 is needed to represent the relationship between them. Since we can consider the application (app) requested by the user as the service request, the service session ID is used as the primary key of the relational table. The other attribute fields are User session Id, streaming session ID, controlling session ID, and these attributes. Both are the primary keys of the previous tables, thus associating these separate sessions in one request. When a session is created, session-related data is stored in the Session Store. When a session is terminated, the corresponding resources need to be released. The session ID is created temporarily. Other resource identities (IDs), including data center resources and service provider identities (IDs), are unchanged. When a session ends, the temporary table needs to be deleted. In the session, and release the corresponding resources, this process is equivalent to subscription, subscription end, release resources.
图 7是根据本发明的一个实施例的基于身份和会话的资源访问系统中身份 管理器的结构框图。 身份管理器 7的核心是柄求解系统 71 以及存放身份信息 和各种管理配置信息的 ID仓库 (ID store ) 72, 身份符来标记, 其中不变的对 象如资源, 服务提供者都有一个唯一不变的身份符, 动态的对象如会话等都有 一个临时的身份符。 不变性 (persistence ) 由柄求解系统 (handle resolution
system) 71来保证。 柄求解系统 (Handle resolution system) 71 由引用实施 (reference Implementation) 711, 协议 (protocol) 712, 命名空间 (Namaspace)7 is a structural block diagram of an identity manager in an identity and session based resource access system, in accordance with one embodiment of the present invention. The core of the identity manager 7 is a handle solving system 71 and an ID store 72 for storing identity information and various management configuration information, which are marked by an identifier, wherein the invariant objects such as resources and the service provider have a unique identifier. Invariant identifiers, dynamic objects such as sessions have a temporary identifier. Invariance (handle resolution) System) 71 to guarantee. Handle resolution system 71 Reference implementation 711, protocol 712, namespace (Namaspace)
713, 管理服务 (Administrative Service) 714四个部分组成, 其中引用实施 (Reference Implementation) 711是柄求角率系统 (handle resolution system) 71 的核心, 提供求解服务和分布式类别服务。 分布式类别服务 7113接收不同类 型的并发性请求, 根据请求的类型, 对请求调度后将请求发往地址求解服务 (Address Resolution service) 7111或关系求角率月艮务 (Relationship resolution service) 7112。 地址求解服务 (Address Resolution Service) 7111中有地址关系 的树形结构, 通过该结构关系根据资源身份找到资源的位置。 关系求解服务 (Relationship Resolution Service) 7112通过关系求解服务, 里面存有用户713, Administrative Service 714 is composed of four parts, of which Reference Implementation 711 is the core of the handle resolution system 71, providing solution services and distributed category services. The distributed class service 7113 receives different types of concurrent requests, and according to the type of the request, the request is dispatched and sent to the Address Resolution service 7111 or the relationship resolution service 7112. The Address Resolution Service 7111 has a tree structure of address relationships through which the location of the resource is found based on the resource identity. Relationship Resolution Service 7112 uses a relational solution service that stores users
(User) 、 应用 (app) 、 资源 (resource) 、 会话 (session) 等之间关系的结 构, 将这些对象有效地连接起来; 由于其间的关系比较复杂, 往往存在多对多 的关系映射, 则可以釆用树, 图等各种结构来描述。 当用户访问系统中的求解 ( resolution )或管理过程( Administrative process )时,就需要用到协议( Protocol ) 712对客户进行认证。 命名空间 (Namespace) 713是大量的不同类型的身份符 的类型名字, 还包括对于具体对象名字的语法规定, 可以根据类型划分不同的 命名空间, 每个命名空间 713域下有多个不同的具体的名字。 管理服务 The structure of the relationship between (User), application (app), resource (resource), session, etc., effectively connects these objects; because of the complex relationship between them, there are often many-to-many relationship mappings. It can be described by various structures such as trees, diagrams, and so on. When a user accesses a resolution or administrative process in the system, a protocol 712 is required to authenticate the client. Namespace 713 is a type name of a large number of different types of identifiers. It also includes grammar rules for specific object names. Different namespaces can be divided according to types. Each namespace 713 has multiple different specifics. name. Management service
(Administrative service) 714提供系统中的各种配置管理服务。 ID仓库 (ID Store) 72是身份管理器 7中的存放身份信息, 管理配置信息等各种信息的存储 器, 各种资源, 过程, 应用, 服务等的身份都存储在 ID仓库 72中。 在本发明 的一个或多个较佳实施例中, 身份管理器为会话管理器和资源管理器提供身份 服务, 关系求解服务和地址求解服务,为求解各个对象之间的关系, 寻找资源位 置提供支撑。 身份管理器运行在一个 ID服务器上。 (Administrative service) 714 provides various configuration management services in the system. The ID Store 72 is a storage device for storing various pieces of information such as identity information, management configuration information, and the like in the Identity Manager 7, and various assets, processes, applications, services, and the like are stored in the ID Warehouse 72. In one or more preferred embodiments of the present invention, the identity manager provides an identity service, a relationship solving service, and an address solving service for the session manager and the resource manager, and provides a resource location for solving the relationship between the objects. support. The Identity Manager runs on an ID server.
图 8是图 7的身份管理器中的关系求解服务 (Relationship Resolution Service) 实施的描述框图。 本发明的关系求解实施方式 81 由对象身份符 811、 对象描述 812以及求解服务 813三个部分组成。 其中对象身份符 811表示的是 对象的身份, 这里的对象既可以是数据中心的资源, 如虚机, 服务器等, 也可 以是应用 (app) , 域 (domain) , 组件 (component) 等用户请求的应用关系 等, 还可以是各种会话 (session) , 也可以是系统中的管理程序 (也可以称之
为服务提供者) 。 对象描述 812表述的是对各个对象的属性, 特征等的描述。 求解服务 813由数据类型 (Data type ) 8131 , 结构元数据 ( structural metadata ) 8132, 以及元对象 (Meta-objects ) 8133组成, 结构元数据 8132描述了各对象 之间的结构关系, 由于关系很复杂, 存在多对多的情况, 如一个用户可以同时 使用多个应用 (app ) , 一个应用 (app ) 可以被多个用户同时使用, 因而釆用 图结构来表示, 这样可以保证从上面的对象引用到下面的对象, 也可以从下面 的对象引用到上面的对象的多对多的引用关系。 元数据是指关于对象的对象, 数据类型是对数据的分类。 82中列出了需要求解的主要对象, 包括用户 (user) 821, 应用 ( app ) 822, 域 ( domain) 823, 组件 ( component) 824, 虚拟资源 ( virtual resource ) 825, 物理资源 (physical resource ) 826等。 这些对象间的 关系也是一条用户会话 (session) 关系, 在一个用户会话中, 一个用户 821可 以同时使用多个应用 (app ) 822, 一个应用 (app ) 可以被多个用户 821同时使 用, 一个应用 (app ) 822对应一个域 (domain) 823, 一个域 (domain) 823 由多个组件 (component) 824组成, 由于组件 (component) 824是只包含一个 虚机实例 (VM instance ) 的特殊的域 (domain) 823, 则一个域 (component) 823对应一个虚机 VM, 一个虚机 VM可以被多个域 (component) 823引用, 一个 VM对应多个物理资源, 如 cpu, memory, nic等。 VM中有两个 ID , — 个是 Vm自身的, 另一个是 Reference ID,指向上面的组件 824, 建立与组件 824 间的身份对应关系。 83是一个用户请求运行起来所需要的主要资源, 包括 VM 831, LUN 832 , Raid 833, vswitch 834 , Nic 835等这些资源间的关系通过 ID 来标识。 8 is a block diagram depicting the implementation of a Relationship Resolution Service in the Identity Manager of FIG. The relationship solving embodiment 81 of the present invention is composed of three parts: an object identifier 811, an object description 812, and a solution service 813. The object identifier 811 represents the identity of the object, and the object here may be a resource of the data center, such as a virtual machine, a server, etc., or may be a user request such as an application (app), a domain, or a component. Application relationships, etc., can also be various sessions, or can be a management program in the system (also known as For the service provider). The object description 812 represents a description of the attributes, characteristics, and the like of the respective objects. The solution service 813 is composed of a data type 8131, a structural metadata 8132, and a meta-objects 8133. The structure metadata 8132 describes the structural relationship between the objects, because the relationship is complicated. There are many-to-many situations, such as a user can use multiple applications (app) at the same time, an application (app) can be used by multiple users at the same time, so it is represented by a graph structure, which can guarantee the reference from the above object. To the following object, you can also refer to the many-to-many reference relationship of the above object from the following object. Metadata refers to objects about objects, and data types are categories of data. The main objects that need to be solved are listed in 82, including user 821, application (app) 822, domain 823, component 824, virtual resource 825, physical resource (physical resource). 826 and so on. The relationship between these objects is also a user session relationship. In a user session, one user 821 can use multiple applications (app) 822 at the same time, and one application (app) can be used simultaneously by multiple users 821, one application. (app) 822 corresponds to a domain 823, and a domain 823 is composed of a plurality of components 824, since the component 824 is a special domain containing only one virtual machine instance (VM instance) ( Domain 823, a domain component 823 corresponds to a virtual machine VM, a virtual machine VM can be referenced by multiple domains 823, and one VM corresponds to multiple physical resources, such as cpu, memory, nic, and the like. There are two IDs in the VM, one is Vm's own, and the other is the Reference ID, which points to the above component 824, establishing an identity correspondence with the component 824. 83 is the main resource required for a user to request to run, including the relationship between VM 831, LUN 832, Raid 833, vswitch 834, Nic 835 and the like by ID.
图 9是图 7中的身份管理器中的地址解析 (Address Resolution) 的关系表 述图。 在身份管理器中, 对每个资源都进行唯一的身份标记, 每个资源都有唯 一的身份标记符, 同时有一个可变的逻辑身份 (logical ID ) , 以建立资源之间 的逻辑关系, 这里不同于域名系统, 域名系统与 IP相对应, 而每一个 ID都是 唯一的不变的, 所以不管资源移至何处, 都可以通过 ID找到它。 地址求解通 过树形结构实现, 在身份上是从根到叶的继承关系。 以数据中心为例, 一个数 据中心 91可以分成多个组 92, 一个组 92下有多个主机 93, 一个主机 93上有 多个虚机 94, 一个虚机 94中使用到 vCPU 951 , vMemory 952, vNic 953, VHBA
954等虚拟硬件资源, 虚拟硬件资源通过虚机管理器 VMM映射到相应的物理 硬件资源 CPU 971, Memory 972, Nic 973 , HBA974,—个物理硬件设备可以 对应多个虚拟硬件设备,其中, vNic 953连接到虚机管理器 VMM中的 vSwitch 96, VMM中可以有一个或多个 vSwitch 96,一个 vSwitch 96连接多个 vnic 953, vswitch 953连接到物理 Nic 973, 通过 Nic 973又连接到 Switch (交换机) 98 上, 一个 Switch (交换机) 98可以连接多个 Nic 973, 亦即多个主机 93, 还可 以通过 Switch 98连接到共享存储器 (shared storage ) 99。 对于底层, 主机上 的资源, 使用 Tap Bridge建立虚机 94和其上的各种虚拟资源的身份对应关系, 一个虚机上可以有多个 vSwitch 96,分别管不同的 vlan, 连在不同的 vswitch上 的虚拟机被划分到不同的 vlan中, 一个 vswitch可以连接不同主机上的不同的 虚拟机。 当通过资源的 ID请求资源的地址时, 请求到达地址求解服务, 地址 求解服务通过资源的身份求解出资源所在的位置。 Figure 9 is a diagram showing the relationship of address resolution in the identity manager of Figure 7. In the Identity Manager, each resource is uniquely tagged. Each resource has a unique identity tag and a variable logical ID to establish a logical relationship between resources. Unlike the domain name system, the domain name system corresponds to IP, and each ID is unique and constant, so no matter where the resource is moved, it can be found by ID. The address solution is implemented by a tree structure, which is an inheritance relationship from root to leaf in identity. Taking the data center as an example, one data center 91 can be divided into multiple groups 92, one group 92 has multiple hosts 93, one host 93 has multiple virtual machines 94, and one virtual machine 94 uses vCPU 951, vMemory 952. , vNic 953, VHBA 954 and other virtual hardware resources, virtual hardware resources are mapped to the corresponding physical hardware resources CPU 971, Memory 972, Nic 973, HBA974 through the virtual machine manager VMM, a physical hardware device can correspond to multiple virtual hardware devices, wherein, vNic 953 Connect to the vSwitch 96 in the Virtual Machine Manager VMM. There may be one or more vSwitches 96 in the VMM, one vSwitch 96 connected to multiple vnic 953, vswitch 953 connected to the physical Nic 973, and Nic 973 connected to the Switch (switch) On the 98, a Switch 98 can be connected to multiple Nic 973s, that is, multiple hosts 93, and can also be connected to a shared storage 99 via Switch 98. For the underlying, resources on the host, use the Tap Bridge to establish the identity relationship between the virtual machine 94 and various virtual resources on it. A virtual machine can have multiple vSwitches 96, which respectively manage different vlans and are connected to different vswitches. The virtual machines are divided into different vlans, and one vswitch can connect different virtual machines on different hosts. When the address of the resource is requested by the ID of the resource, the request arrives at the address solving service, and the address solving service solves the location of the resource by the identity of the resource.
图 10是根据本发明的一个实施例的基于身份和会话的资源访问系统中使 用身份管理器的流程图。 具体包括如下的步骤: Figure 10 is a flow diagram of the use of an identity manager in an identity and session based resource access system, in accordance with one embodiment of the present invention. Specifically, the following steps are included:
步骤 1001, 客户端发出请求, 并转入到步骤 1002; Step 1001, the client sends a request, and proceeds to step 1002;
步骤 1002, 请求到达身份管理器, 并转入到步骤 1003 ; Step 1002, the request arrives at the identity manager, and proceeds to step 1003;
步骤 1003, 判断所请求的对象是否在身份管理器中注册, 若注册, 转入到 步骤 1004, 否则转入到步骤 1008 ; Step 1003: Determine whether the requested object is registered in the identity manager. If registered, go to step 1004, otherwise proceed to step 1008;
步骤 1004,根据 ID到身份管理器中査询柄求解系统,并转入到步骤 1005 ; 步骤 1005, 判断是否査询资源地址, 若是, 转入到步骤 1006, 否则转入 到步骤 1010 ; Step 1004: Solving the system according to the ID to the query manager in the identity manager, and proceeding to step 1005; Step 1005, determining whether to query the resource address, and if yes, proceeding to step 1006, otherwise proceeding to step 1010;
步骤 1006, 通过地址求解服务找到资源的位置, 并转入到步骤 1007 ; 步骤 1007, 将位置信息返回给请求方, 结束; Step 1006: Find the location of the resource by using the address solving service, and proceed to step 1007; Step 1007, return the location information to the requesting party, and end;
步骤 1008, 使用注册器注册对象, 并转入到步骤 1009 ; Step 1008, registering the object using the registrar, and proceeding to step 1009;
步骤 1009, 生成器根据对象类型和字符串规则为该对象创建删除身份符 Step 1009, the generator creates a delete identifier for the object according to the object type and the string rule.
ID, 并转入到步骤 1004; ID, and proceeds to step 1004;
步骤 1010, 通过关系求解服务找到关系的对象, 并转入到步骤 101 1 ; 步骤 101 1, 将关系对象信息返回给请求方, 结束。 Step 1010: The relationship finding service finds the object of the relationship, and proceeds to step 101 1; Step 101, returns the relationship object information to the requesting party, and ends.
本发明的基于身份和会话的资源访问系统能在数据中心的网络实例环境
下, 将传统电信中服务提供者和资源提供者分离的思想引入到企业数据中心资 源的访问中, 实现荷载和控制会话的分离, 并釆用身份管理方法管理这些资源 的身份。 The identity and session based resource access system of the present invention can be in a network instance environment of a data center Next, the idea of separating service providers and resource providers in traditional telecommunications is introduced into the access of enterprise data center resources, realizing the separation of load and control sessions, and using identity management methods to manage the identity of these resources.
上述实施例是提供给熟悉本领域内的人员来实现或使用本发明的, 熟悉本 领域的人员可在不脱离本发明的发明思想的情况下, 对上述实施例做出种种修 改或变化, 因而本发明的保护范围并不被上述实施例所限, 而应该是符合权利 要求书提到的创新性特征的最大范围。
The above embodiments are provided to those skilled in the art to implement or use the present invention. Those skilled in the art can make various modifications or changes to the above embodiments without departing from the inventive concept. The scope of the invention is not limited by the embodiments described above, but should be the maximum range of the innovative features mentioned in the claims.
Claims
1 . 一种基于身份和会话的资源访问系统, 其特征在于, 包括: What is claimed is: 1. An identity and session based resource access system, comprising:
客户端, 客户端发出服务请求并定义执行该服务请求所需要的资源信息; 会话管理中心, 接收所述客户端发出的服务请求, 根据该服务请求创建流 会话并根据流会话创建控制会话, 协商流会话所需的资源和控制会话所需的服 务提供者, 并将请求路由到资源中心; a client, the client sends a service request and defines resource information required to execute the service request; the session management center receives a service request sent by the client, creates a flow session according to the service request, and creates a control session according to the flow session, and negotiates The resources required to stream the session and the service providers required to control the session, and route the request to the resource center;
资源中心, 包括实体服务器、 网络和存储器, 所述实体服务器上运行一个 或多个虚机, 资源中心接收所述服务请求、 并管理请求的运行, 所述虚机运行 所述服务请求并将运行的结果反馈给客户端; a resource center, including an entity server, a network, and a storage, where the virtual server runs one or more virtual machines, the resource center receives the service request, and manages the running of the request, the virtual machine runs the service request and runs The results are fed back to the client;
身份管理器,与会话管理中心及资源中心通信连接,身份管理器管理资源、 服务提供者、 会话、 应用的对象的身份信息, 身份管理器还管理所述身份信息 的生命周期。 The identity manager is in communication with the session management center and the resource center. The identity manager manages the identity information of the resource, the service provider, the session, and the object of the application, and the identity manager also manages the life cycle of the identity information.
2. 如权利要求 1 所述的基于身份和会话的资源访问系统, 其特征在于, 所述会话管理中心包括: 2. The identity and session based resource access system of claim 1, wherein the session management center comprises:
流会话管理器, 接收所述客户端发送的服务请求, 根据该服务请求创建流 会话并协商流会话所需的资源, 流会话管理器转发所述服务请求; a stream session manager, receiving a service request sent by the client, creating a stream session according to the service request, and negotiating resources required for the stream session, and the stream session manager forwarding the service request;
代理服务器, 与流会话管理器通信连接, 代理服务器接收由流会话管理器 转发的服务请求并保持连接, 代理服务器获取流会话管理器创建的流会话信 息, 代理服务器调度并发的服务请求; a proxy server, in communication with the streaming session manager, the proxy server receives the service request forwarded by the streaming session manager and maintains the connection, the proxy server obtains the streaming session information created by the streaming session manager, and the proxy server schedules the concurrent service request;
控制会话管理器, 与代理服务器通信连接, 从代理服务器获取流会话信息 并根据流会话信息创建控制会话并协商控制会话所需的服务提供者, 控制会话 管理器转发所述服务请求; Controlling the session manager, communicating with the proxy server, obtaining flow session information from the proxy server, and creating a control session according to the flow session information and negotiating a service provider required to control the session, and controlling the session manager to forward the service request;
服务总线, 连接到所述控制会话管理器, 并与多个服务提供者相连, 在服 务提供者之间传递请求和控制会话身份信息; a service bus, connected to the control session manager, and connected to a plurality of service providers to transfer requests and control session identity information between service providers;
会话数据库保存服务请求从客户端传送至资源中心的虚机上运行以及运 行的结果从资源中心反馈给客户端的过程中的流会话、 控制会话和用户会话信 白 The session database saves the service request from the client to the virtual machine running on the virtual machine and the result of running the flow session, control session and user session in the process of feeding back from the resource center to the client
3. 如权利要求 2 所述的基于身份和会话的资源访问系统, 其特征在于, 所述流会话管理器包括: 3. The identity and session based resource access system of claim 2, wherein the stream session manager comprises:
流会话生成器, 为接收到的服务请求创建流会话并管理流会话的生命周 期, 流会话生成器还协商流会话所需要的资源; The stream session generator creates a stream session for the received service request and manages the life cycle of the stream session, and the stream session generator also negotiates resources required for the stream session;
流信令平面, 与流会话生成器通信连接, 由流会话过程中所参与的资源间 的通信协议栈形成, 分离所述资源中的物理资源与动态资源。 The flow signaling plane is formed in communication with the flow session generator, and is formed by a communication protocol stack between resources involved in the flow session, and separates physical resources and dynamic resources in the resource.
4. 根据权利要求 3所述的基于身份和会话的资源访问系统, 其特征在于, 所述流信令平面包括: The identity and session-based resource access system according to claim 3, wherein the flow signaling plane comprises:
I/O 链路资源, 本地网络端口资源和计算资源形成的协议栈, 其中计算资 源协议栈包括本地物理计算工作栈、 虚机管理器, 本地逻辑计算工作栈。 A protocol stack formed by an I/O link resource, a local network port resource, and a computing resource, wherein the computing resource protocol stack includes a local physical computing working stack, a virtual machine manager, and a local logical computing working stack.
5. 如权利要求 2 所述的基于身份和会话的资源访问系统, 其特征在于, 所述代理服务器包括: 5. The identity and session based resource access system of claim 2, wherein the proxy server comprises:
应用容器, 保存与所述服务请求相关的请求信息, 包括 IP地址、 端口号、 协议。 The application container saves request information related to the service request, including an IP address, a port number, and a protocol.
6. 如权利要求 2 所述的基于身份和会话的资源访问系统, 其特征在于, 所述控制会话管理器包括: 6. The identity and session based resource access system of claim 2, wherein the control session manager comprises:
会话控制器, 根据所述流会话创建控制会话并管理控制会话的生命周期, 会话控制器还协商执行该控制会话所需要的服务提供者; a session controller, creating a control session according to the flow session and managing a life cycle of the control session, the session controller also negotiating a service provider required to execute the control session;
控制信令平面, 由控制会话过程中所参与的服务提供者间的通信协议栈形 成, 控制信令平面将服务提供者与资源提供者分离。 The control signaling plane is formed by a communication protocol stack between service providers involved in the control session, and the control signaling plane separates the service provider from the resource provider.
7. 如权利要求 1所述的基于身份和会话的资源访问系统, 其特征在于, 所述实体服务器包括服务器资源管理器、 硬件架构、 虚机管理器和数个虚 机, 所述服务器资源管理器管理服务请求在虚机上的运行, 虚机管理器管理所 述虚机; 所述网络包括网络资源管理器, 网络资源管理器管理网络资源并对实体服 务器中的虚机进行组网; 7. The identity and session based resource access system of claim 1, wherein the entity server comprises a server resource manager, a hardware architecture, a virtual machine manager, and a plurality of virtual machines, the server resource management. The management service requests the operation on the virtual machine, and the virtual machine manager manages the virtual machine; The network includes a network resource manager, and the network resource manager manages the network resources and performs networking on the virtual machines in the entity server;
所述存储器包括存储资源管理器, 存储资源管理器管理存储资源。 The memory includes a storage resource manager, and the storage resource manager manages storage resources.
8. 如权利要求 1 所述的基于身份和会话的资源访问系统, 其特征在于, 所述身份管理器包括: 8. The identity and session based resource access system of claim 1, wherein the identity manager comprises:
柄求解系统, 通过树形结构和图形结构求解确定资源的位置和服务请求涉 及的各对象间的关系; The shank solving system determines the location of the resource and the relationship between the objects involved in the service request through the tree structure and the graphical structure solution;
生成器, 为每个定义的资源和服务提供者生成唯一的身份信息, 为每一个 会话、 应用生成身份信息; a generator that generates unique identity information for each defined resource and service provider, and generates identity information for each session, application;
注册器, 为每个对象向身份管理器注册, 注册器调用生成器为对象生成身 份; The registrar registers each object with an identity manager, and the registrar invokes the generator to generate an identity for the object;
身份存储器, 存储各种对象的身份信息, 包括会话、 服务提供者、 资源、 应用。 An identity store that stores identity information for various objects, including sessions, service providers, resources, and applications.
9. 一种基于身份和会话的资源访问方法, 其特征在于, 所述方法包括: 一个上游流会话管理器接收客户端的资源请求; An identity-based and session-based resource access method, the method comprising: receiving, by an upstream stream session manager, a resource request of a client;
该流会话管理器为请求创建一个用于协商执行客户荷载所需资源的流会 话, 并将请求和流会话信息发送到上游代理服务器; The stream session manager creates a stream session for the request to negotiate the resources required to perform the client load, and sends the request and stream session information to the upstream proxy server;
该代理服务器作为中转代理多个请求, 并将请求和流会话信息发往上游控 制会话管理器; The proxy server acts as a relay agent for multiple requests, and sends request and stream session information to the upstream control session manager;
该控制会话管理器为该请求生成一个与上述流会话相关联的用于协商控 制服务请求的服务提供者的控制会话; The control session manager generates, for the request, a control session of the service provider associated with the streaming session for negotiating the control service request;
控制会话管理器与上游服务总线交互, 服务总线与多个服务提供者相连, 请求和控制会话身份信息通过服务总线在多个服务提供者之间传递, 并通过服 务提供者将请求路由到下游资源中心的实体服务器; The control session manager interacts with the upstream service bus, the service bus is connected to a plurality of service providers, requesting and controlling session identity information is passed between the plurality of service providers over the service bus, and the request is routed to the downstream resources by the service provider Central entity server;
实体服务器上有一个或多个虚机, 资源管理器管理请求在虚机上的运行, 虚机运行所述请求并将运行的结果反馈给客户端。 There are one or more virtual machines on the physical server. The resource manager manages the running of the request on the virtual machine. The virtual machine runs the request and feeds back the result of the running to the client.
10. 如权利要求 9所述的基于身份和会话的资源访问方法, 其特征在于, 所述方法进一步包括: 10. The method according to claim 9, wherein the method further comprises:
流会话管理器创建流会话, 并访问身份管理器, 获得流会话身份; 代理服务器创建虚拟应用, 并访问身份管理器, 通过关系求解服务, 获得 与上述流会话身份相关联的虚拟应用身份; The streaming session manager creates a streaming session and accesses the identity manager to obtain the streaming session identity; the proxy server creates the virtual application and accesses the identity manager, and obtains the virtual application identity associated with the streaming session identity through the relationship solving service;
控制会话管理器创建与流会话相关联的控制会话, 访问身份管理器, 通过 关系求解服务, 获得与上述流会话身份相关联的控制会话身份。 The control session manager creates a control session associated with the streaming session, accesses the identity manager, and obtains the control session identity associated with the stream session identity described above by the relationship solving service.
资源管理器访问身份管理器, 获得资源的唯一身份, 并可根据资源的唯一 身份通过地址求解服务找到资源的位置。 The resource manager accesses the identity manager, obtains the unique identity of the resource, and can find the location of the resource through the address solving service according to the unique identity of the resource.
1 1. 如权利要求 9所述的基于身份和会话的资源访问方法, 其特征在于, 所述方法进一步包括: The method according to claim 9, wherein the method further comprises:
代理服务器接收到流会话控制器发送的请求和流会话信息后, 继续保持与 流会话控制器之间的 TCP/UDP连接; After receiving the request and the stream session information sent by the stream session controller, the proxy server continues to maintain the TCP/UDP connection with the stream session controller;
请求在资源中心的实体服务器上的虚机上运行起来后, 断开代理服务器与 流会话控制器之间的 TCP/UDP 连接, 并通过重定向直接将运行结果返回客户 。 After requesting to run on the virtual machine on the physical server in the resource center, disconnect the TCP/UDP connection between the proxy server and the streaming session controller, and directly return the running result to the client through redirection.
12. 如权利要求 9所述的基于身份和会话的资源访问方法, 其特征在于, 所述方法进一步包括: 12. The method according to claim 9, wherein the method further comprises:
流会话管理器创建流会话, 生成流信令平面, 分离物理资源和动态资源需 求, 并控制按需生成的逻辑核心网。 The stream session manager creates a stream session, generates a stream signaling plane, separates physical resources and dynamic resource requirements, and controls the logical core network generated on demand.
13. 根据权利要求 9所述的基于身份和会话的资源访问方法,其特征在于, 所述方法进一步包括: The method according to claim 9, wherein the method further comprises:
控制会话管理器创建控制会话, 生成控制会话平面, 根据请求需要对服务 提供者进行任意动态组合, 生成多个服务提供者平面。 The control session manager creates a control session, generates a control session plane, and arbitrarily dynamically combines the service providers according to the request to generate multiple service provider planes.
14. 根据权利要求 9所述的基于身份和会话的资源访问方法,其特征在于, 所述方法进一歩包括: 14. The identity and session based resource access method of claim 9, wherein The method further includes:
使用桥接建立虚机和其上的各种虚拟资源的身份对应关系。 The bridging is used to establish the identity correspondence between the virtual machine and various virtual resources on it.
15. 根据权利要求 9所述的基于身份和会话的资源访问方法,其特征在于, 所述方法进一步包括: The method according to claim 9, wherein the method further comprises:
为虚机设置两个身份, 一个是虚机自身的, 另一个是引用身份, 指向上面 的组件, 建立虚机与组件间的身份对应关系。 Set two identities for the virtual machine, one is the virtual machine itself, the other is the reference identity, pointing to the above components, establishing the identity relationship between the virtual machine and the component.
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201110369727.3A CN102347959B (en) | 2011-11-18 | 2011-11-18 | Resource access system and method based on identity and session |
CN201110369727.3 | 2011-11-18 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2013071890A1 true WO2013071890A1 (en) | 2013-05-23 |
Family
ID=45546247
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2012/084810 WO2013071890A1 (en) | 2011-11-18 | 2012-11-19 | Resource access system and method based on identity and session |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN102347959B (en) |
WO (1) | WO2013071890A1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112948313A (en) * | 2021-03-01 | 2021-06-11 | 杭州迪普科技股份有限公司 | Session data management method and device |
CN116055497A (en) * | 2023-01-18 | 2023-05-02 | 紫光云技术有限公司 | Method for realizing load balancing LB multi-activity oversized cluster |
Families Citing this family (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102347959B (en) * | 2011-11-18 | 2014-07-23 | 运软网络科技(上海)有限公司 | Resource access system and method based on identity and session |
US9038083B2 (en) * | 2012-02-09 | 2015-05-19 | Citrix Systems, Inc. | Virtual machine provisioning based on tagged physical resources in a cloud computing environment |
WO2014036715A1 (en) * | 2012-09-07 | 2014-03-13 | 运软网络科技(上海)有限公司 | System and method for controlling real-time resource supply process based on delivery point |
CN102917254B (en) * | 2012-10-08 | 2016-06-29 | 青岛海信传媒网络技术有限公司 | Program broadcasting method and system based on NGOD |
CN105610827B (en) * | 2015-12-25 | 2019-01-29 | 广东威创视讯科技股份有限公司 | Spell wall control system signal interaction control method and system |
CN106921721A (en) * | 2015-12-28 | 2017-07-04 | 华为软件技术有限公司 | A kind of server, conversation managing method and system |
WO2021028052A1 (en) * | 2019-08-14 | 2021-02-18 | Huawei Technologies Co., Ltd. | Method and apparatus for cloud-based console service in a cloud network |
US11546335B2 (en) * | 2019-09-27 | 2023-01-03 | Amazon Technologies, Inc. | Managing permissions to cloud-based resources with session-specific attributes |
CN113872933B (en) * | 2021-08-20 | 2023-05-26 | 上海云盾信息技术有限公司 | Method, system, device, equipment and storage medium for hiding source station |
CN114844672B (en) * | 2022-03-22 | 2023-08-22 | 华为技术有限公司 | Method, management unit and equipment for confirming application trusted identity |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20090300152A1 (en) * | 2008-05-27 | 2009-12-03 | James Michael Ferris | Methods and systems for user identity management in cloud-based networks |
CN101969475A (en) * | 2010-11-15 | 2011-02-09 | 张军 | Business data controllable distribution and fusion application system based on cloud computing |
CN102103518A (en) * | 2011-02-23 | 2011-06-22 | 运软网络科技(上海)有限公司 | System for managing resources in virtual environment and implementation method thereof |
CN102347959A (en) * | 2011-11-18 | 2012-02-08 | 运软网络科技(上海)有限公司 | Resource access system and method based on identity and session |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7415704B2 (en) * | 2004-05-20 | 2008-08-19 | Sap Ag | Sharing objects in runtime systems |
CN101102265B (en) * | 2006-07-06 | 2010-05-12 | 华为技术有限公司 | Control and carrier separation system and implementation method for multi-service access |
US8984621B2 (en) * | 2010-02-27 | 2015-03-17 | Novell, Inc. | Techniques for secure access management in virtual environments |
CN101969391B (en) * | 2010-10-27 | 2012-08-01 | 北京邮电大学 | Cloud platform supporting fusion network service and operating method thereof |
-
2011
- 2011-11-18 CN CN201110369727.3A patent/CN102347959B/en not_active Expired - Fee Related
-
2012
- 2012-11-19 WO PCT/CN2012/084810 patent/WO2013071890A1/en active Application Filing
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20090300152A1 (en) * | 2008-05-27 | 2009-12-03 | James Michael Ferris | Methods and systems for user identity management in cloud-based networks |
CN101969475A (en) * | 2010-11-15 | 2011-02-09 | 张军 | Business data controllable distribution and fusion application system based on cloud computing |
CN102103518A (en) * | 2011-02-23 | 2011-06-22 | 运软网络科技(上海)有限公司 | System for managing resources in virtual environment and implementation method thereof |
CN102347959A (en) * | 2011-11-18 | 2012-02-08 | 运软网络科技(上海)有限公司 | Resource access system and method based on identity and session |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112948313A (en) * | 2021-03-01 | 2021-06-11 | 杭州迪普科技股份有限公司 | Session data management method and device |
CN112948313B (en) * | 2021-03-01 | 2023-11-21 | 杭州迪普科技股份有限公司 | Session data management method and device |
CN116055497A (en) * | 2023-01-18 | 2023-05-02 | 紫光云技术有限公司 | Method for realizing load balancing LB multi-activity oversized cluster |
Also Published As
Publication number | Publication date |
---|---|
CN102347959A (en) | 2012-02-08 |
CN102347959B (en) | 2014-07-23 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2013071890A1 (en) | Resource access system and method based on identity and session | |
US11588886B2 (en) | Managing replication of computing nodes for provided computer networks | |
CN107947961B (en) | SDN-based Kubernetes network management system and method | |
US9614748B1 (en) | Multitenant data center providing virtual computing services | |
US9961143B2 (en) | Providing enhanced data retrieval from remote locations | |
US10057189B2 (en) | Virtual computing services deployment network | |
US8286232B2 (en) | System and method for transparent cloud access | |
Gong | JXTA: A network programming environment | |
US10187458B2 (en) | Providing enhanced access to remote services | |
US8565118B2 (en) | Methods and apparatus for distributed dynamic network provisioning | |
US20120239825A1 (en) | Intercloud Application Virtualization | |
US10931559B2 (en) | Distribution of network-policy configuration, management, and control using model-driven and information-centric networking | |
US10771309B1 (en) | Border gateway protocol routing configuration | |
US7934218B2 (en) | Interprocess communication management using a socket layer | |
WO2021098819A1 (en) | Route updating method and user cluster | |
US9166947B1 (en) | Maintaining private connections during network interface reconfiguration | |
Kohler et al. | ZeroSDN: A highly flexible and modular architecture for full-range distribution of event-based network control | |
CN116668191B (en) | Internet of things application virtual gateway with data encryption convergence function | |
Hamid et al. | Web Services Architecture Model to Support Distributed Systems | |
US8312154B1 (en) | Providing enhanced access to remote services | |
CN115242882A (en) | Method and device for accessing k8s container environment based on transport layer route | |
Li et al. | Integrate software agents and CORBA in computational grid | |
Shim et al. | A study on communication optimization in multi-SDN controller | |
US20240241874A1 (en) | Disseminating configuration across distributed systems using database nodes | |
Chaves et al. | A proposal for application-to-application network addressing in clean-slate architectures |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 12850637 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 12850637 Country of ref document: EP Kind code of ref document: A1 |