Inter-process communication method and system, first communication node and second communication node

Abstract

The invention discloses an inter-process communication method and system, a first communication node and a second communication node, and relates to the technical field of communication. The specific implementation scheme comprises the following steps: firstly, determining a secret key of a first to-be-communicated process in a first process through a first communication node, and determining a secret key of a second to-be-communicated process in a second process through a second communication node, and then the first communication node and the second communication node perform bidirectional identity authentication based on the corresponding secret keys, and then the first to-be-communicated process and the second to-be-communicated process communicate after the first communication node and the second communication node pass verification. And finally, after the first to-be-communicated process and the second to-be-communicated process complete communication, updating the corresponding secret key. According to the invention, the inter-process communication is completed, the security and efficiency of the inter-process communication are enhanced, the security of the inter-process communication is improved, and the integrity of an inter-process communication system is protected.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an inter-process communication method, system, first communication node and second communication node. Background Art

[0002] With the development of cloud computing and the Internet of Things, the security and isolation of inter-process communication have become key issues. The traditional inter-process communication method mainly uses the system driver layer to authenticate the communication between processes. Both communicating processes interact with the authentication driver. After the authentication is completed, the two communicating processes interact using encrypted data, thereby realizing inter-process communication and data transmission.

[0003] However, relying on the intervention of the driver layer to authenticate the two processes will be affected by the processing speed of the authentication driver, and the interaction through the authentication driver is relatively redundant, which increases the complexity of the system and significantly reduces the efficiency. Although the data is encrypted after authentication, the system driver layer has weaknesses and is vulnerable to attacks, making it difficult to ensure the integrity of the data. Therefore, it is necessary to develop a new inter-process communication mechanism. Summary of the invention

[0004] The present invention provides an inter-process communication method, system, first communication node and second communication node, so as to improve the security and flexibility of inter-process communication through the inter-process communication system.

[0005] According to one aspect of the present invention, there is provided an inter-process communication method, which is applied to an inter-process communication system. The communication system includes a first communication node and a second communication node. The first communication node includes a plurality of first processes, each of which is deployed with a corresponding first container instance, and the first container instance provides an independent execution environment for the corresponding first process. The second communication node includes a plurality of second processes, each of which is deployed with a corresponding second container instance, and the second container instance provides an independent execution environment for the corresponding second process. The method includes:

[0006] The first communication node determines a secret key of a first process to be communicated in the first process;

[0007] The second communication node determines a secret key of a second process to be communicated in the second process;

[0008] The first communication node and the second communication node respectively perform two-way identity authentication based on the corresponding secret keys;

[0009] After both the first communication node and the second communication node are verified, the first process to be communicated and the second process to be communicated communicate;

[0010] After the first process to communicate and the second process to communicate complete communication, the corresponding secret key is updated.

[0011] According to another aspect of the present invention, there is provided an inter-process communication system, comprising:

[0012] a first communication node and a second communication node, wherein the first communication node includes a plurality of first processes, each of which is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding first process; and the second communication node includes a plurality of second processes, each of which is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding second process;

[0013] The first communication node is used to determine a secret key of a first process to be communicated in the first process;

[0014] The second communication node is used to determine the secret key of the second process to be communicated in the second process;

[0015] The first communication node and the second communication node are respectively used to perform two-way identity authentication based on the corresponding secret keys;

[0016] The first communication node and the second communication node are respectively used to communicate after the verification is passed;

[0017] The first communication node and the second communication node are respectively used to update the corresponding secret key after the first process to be communicated and the second process to be communicated complete communication.

[0018] According to another aspect of the present invention, a first communication node is provided, wherein the first communication node includes a plurality of first processes, each first process is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding first process, and the first communication node includes:

[0019] at least one processor; and

[0020] a memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the following operations:

[0022] Determining a secret key of a first process to be communicated in the first process;

[0023] Authenticating the second communication node based on the corresponding secret key;

[0024] After the verification is passed, communicating with the second communication process of the second communication node through the first process to be communicated;

[0025] After the communication is completed, the secret key is updated.

[0026] According to another aspect of the present invention, a first communication node is provided, wherein the second communication node includes a plurality of second processes, each second process is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding second process, and the second communication node includes:

[0027] at least one processor; and

[0028] a memory communicatively connected to the at least one processor; wherein,

[0029] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the following operations:

[0030] Determining a secret key of a second process to be communicated in the second process;

[0031] Authenticating the first communication node based on the corresponding secret key;

[0032] After the verification is passed, communicating with the first communication process of the first communication node through the second process to be communicated;

[0033] After the communication is completed, the secret key is updated.

[0034] The technical solution of the embodiment of the present invention is applied to the inter-process communication system. First, the secret key of the first process to be communicated in the first process is determined by the first communication node, and the secret key of the second process to be communicated in the second process is determined by the second communication node. Then, the first communication node and the second communication node respectively perform two-way identity authentication based on the corresponding secret keys. Then, after the first communication node and the second communication node are both verified, the first process to be communicated and the second process to be communicated communicate. Finally, after the first process to be communicated and the second process to be communicated complete the communication, the corresponding secret key is updated. The present invention creates a corresponding container instance for the process to be communicated through the inter-process communication system, configures the corresponding secret key for the process to be communicated through the communication node, performs two-way identity authentication through the secret key, completes the communication between processes, and enhances the security and efficiency of the inter-process communication. By updating the secret key, the security of the inter-process communication is improved and the integrity of the inter-process communication system is protected.

[0035] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1A is a flowchart of an inter-process communication method provided according to Embodiment 1 of the present invention;

[0038] Figure 1B is a schematic diagram of inter-process communication provided according to Embodiment 1 of the present invention;

[0039] Figure 2 is a flowchart of a key update method provided according to Embodiment 2 of the present invention;

[0040] Figure 3 is a schematic diagram of the structure of an inter-process communication system provided according to Embodiment 3 of the present invention;

[0041] Figure 4 is a block diagram of a first communication node provided according to a fourth embodiment of the present invention;

[0042] Figure 5 This is a block diagram of a second communication node provided according to Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0043] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0044] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0045] Embodiment 1

[0046] Figure 1A This is a flowchart of an inter-process communication method provided according to the first embodiment of the present invention. This embodiment is applicable to the case of implementing inter-process communication. The method is applied to an inter-process communication system. The communication system includes a first communication node and a second communication node. The first communication node includes multiple first processes. Each first process is deployed with a corresponding first container instance. The first container instance provides an independent execution environment for the corresponding first process. The second communication node includes multiple second processes. Each second process is deployed with a corresponding second container instance. The second container instance provides an independent execution environment for the corresponding second process. Figure 1A As shown, the method includes:

[0047] S110. The first communication node determines a secret key of a first process to communicate in the first process.

[0048] In this embodiment, the inter-process communication system allows data and / or signal exchange and synchronization between different processes. The process is the smallest unit for allocating resources in a computer system and can be an entity of a running program in a computer. The first communication node can be understood as a node in the inter-process communication system, including multiple first processes, and the first communication node can be a device. The second communication node can be understood as another node in the inter-process communication system that is different from the first communication node, including multiple second processes, and the second communication node can be another device different from the first communication node. The first process can be understood as a process on the first communication node. The first container instance can be understood as a unit for storing the first process. The container is a lightweight virtualization technology that can package a process in an independent and portable container to isolate the contents in the container from the outside world. Each container runs in an independent environment and does not interfere with each other. The second process can be understood as a process on the second communication node. The second container instance can be understood as a unit for storing the second process. The first process to be communicated can be understood as a process in the first process that needs to perform inter-process communication. The secret key can be understood as a tool for encrypting and / or decrypting data in the process, and each process has a different secret key for uniquely identifying each process.

[0049] Specifically, in an inter-process communication system, a first communication node is included, and the first communication node includes multiple first processes. A corresponding first container instance is deployed for each first process, and the first container instance can provide an independent execution environment for the corresponding first process. The process that needs to communicate in the first process is determined through the first communication node as the first process to be communicated. A corresponding secret key is configured for the first process to be communicated according to the network policy, which is used to uniquely identify the first process to be communicated.

[0050] For example, Figure 1B FIG. 1 is a schematic diagram of an inter-process communication provided according to Embodiment 1 of the present invention. Figure 1B It can be regarded as an inter-process communication system, where device 1 can be regarded as the first communication node, process A and process B can be regarded as the first process. Container A is the first container instance deployed for process A, and container B is the first container instance deployed for process B. Figure 1B In the example, assuming that process A in the first process needs to communicate, process A is determined as the first process to be communicated, and a corresponding secret key is configured for process A.

[0051] S120. The second communication node determines a secret key of a second process to be communicated in the second process.

[0052] In this embodiment, the second process to be communicated can be understood as a process in the second process that needs to perform inter-process communication.

[0053] Specifically, in an inter-process communication system, a second communication node is also included, and the second communication node includes multiple second processes. A corresponding second container instance is deployed for each second process, and the second container instance can provide an independent execution environment for the corresponding second process. The process that needs to communicate in the second process is determined by the second communication node as the second process to be communicated. According to the network policy, a corresponding secret key is configured for the second process to be communicated, which is used to uniquely identify the second process to be communicated.

[0054] For example, Figure 1B In an inter-process communication system, device 2 can be regarded as a second communication node, and process C and process D can be regarded as second processes. Container C is a second container instance deployed for process C, and container D is a second container instance deployed for process D. Figure 1B , assuming that process C in the second process needs to communicate, process C is determined as the second process to be communicated, and the corresponding secret key is configured for process C.

[0055] S130: The first communication node and the second communication node perform two-way identity authentication based on the corresponding secret keys respectively.

[0056] Specifically, based on the secret keys of the first process to be communicated and the second process to be communicated, the first communication node to which the first process to be communicated belongs and the second communication node to which the second process to be communicated belong are authenticated. The secret key of the first process to be communicated can be transmitted to the second communication node for verification, and the secret key of the second process to be communicated can be transmitted to the first communication node for verification, thereby completing two-way identity authentication.

[0057] For example, assuming that process A in the first process needs to communicate, and process C in the second process needs to communicate, the secret key corresponding to process A can be transmitted to device 2 for verification, and the secret key corresponding to process C can be transmitted to device 1 for verification.

[0058] S140: After both the first communication node and the second communication node are verified, the first process to be communicated and the second process to be communicated communicate.

[0059] Specifically, when the first communication node passes the key verification of the second communication process, and the second communication node passes the key verification of the first communication process, the two-way identity authentication of the first communication node and the second communication node is passed. That is, the first communication process and the second communication process can communicate.

[0060] For example, Figure 1B, assuming that the secret key corresponding to process A is transmitted to device 2 for verification, and the secret key corresponding to process C is transmitted to device 1 for verification. If both device 1 and device 2 pass the verification, it means that process A and process C can communicate.

[0061] S150: After the first process to communicate and the second process to communicate complete communication, the corresponding secret keys are updated.

[0062] Specifically, when the first process to be communicated and the second process to be communicated complete communication, in order to implement the one-time key strategy, the keys configured for the first process to be communicated and the second process to be communicated can be destroyed, and new keys can be configured for the first process to be communicated and the second process to be communicated, waiting for the next communication.

[0063] For example, Figure 1B , Assuming that process A and process C pass the two-way authentication and complete the communication, the secret key used for the two-way authentication of process A and process C is destroyed. Then, new secret keys are configured for process A and process C, and put back into the first process and the second process respectively, waiting for the next communication.

[0064] The technical solution of the embodiment of the present invention is applied to the inter-process communication system. First, the secret key of the first process to be communicated in the first process is determined by the first communication node, and the secret key of the second process to be communicated in the second process is determined by the second communication node. Then, the first communication node and the second communication node respectively perform two-way identity authentication based on the corresponding secret keys. Then, after the first communication node and the second communication node are both verified, the first process to be communicated and the second process to be communicated communicate. Finally, after the first process to be communicated and the second process to be communicated complete the communication, the corresponding secret key is updated. The present invention creates a corresponding container instance for the process to be communicated through the inter-process communication system, configures the corresponding secret key for the process to be communicated through the communication node, performs two-way identity authentication through the secret key, completes the communication between processes, and enhances the security and efficiency of the inter-process communication. By updating the secret key, the security of the inter-process communication is improved and the integrity of the inter-process communication system is protected.

[0065] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0066] In one embodiment, before the first communication node determines the secret key of the first process to be communicated in the first process, the method further includes:

[0067] The first communication node creates a corresponding first container instance for each first process in the first communication node, and configures an independent execution environment of the first process.

[0068] Specifically, in an inter-process communication system, a first communication node is included, and the first communication node includes multiple first processes. In order to enable each first process to have an independent execution environment, before the first communication node configures a secret key for a first process to be communicated in the first process, a corresponding first container instance needs to be created for each first process.

[0069] For example, Figure 1B , device 1 can be regarded as the first communication node, and device 1 includes two first processes, process A and process B. Container A is the first container instance deployed for process A, and container B is the first container instance deployed for process B, ensuring that process A and process B have independent execution environments. After the first container instance is deployed, the corresponding key is determined for the first process determined as the first process to be communicated between process A and process B.

[0070] In one embodiment, before the second communication node determines the secret key of the second process to be communicated in the second process, the method further includes:

[0071] The second communication node creates a corresponding second container instance for each second process in the second communication node, and configures an independent execution environment of the second process.

[0072] Specifically, in an inter-process communication system, a second communication node is included, and the second communication node includes multiple second processes. In order to enable each second process to have an independent execution environment, before the second communication node configures a secret key for the second process to be communicated in the second process, a corresponding second container instance needs to be created for each second process.

[0073] For example, Figure 1B , device 1 can be regarded as the second communication node, and device 1 includes two second processes, process A and process B. Container A is the second container instance deployed for process A, and container B is the second container instance deployed for process B, ensuring that process A and process B have independent execution environments. After the second container instance is deployed, the corresponding secret key is determined for the second process determined as the second process to be communicated between process A and process B.

[0074] In one embodiment, the inter-process communication method further includes: the first communication node detects the state of the included first container instance to obtain a detection result, wherein the state includes a resource usage state and a container abnormal state.

[0075] In this embodiment, the state of the first container instance can be understood as the state of the first container at different stages during the use of the first container. The resource usage state can be understood as the result of tracking and analyzing the computing resources used by the container, such as CPU, memory, disk I / O, and network bandwidth. The abnormal state of the container can be understood as the state in which the container has an abnormality. The operating environment and behavior of the container can be continuously monitored to detect potential security threats and abnormal activities, so as to determine the abnormal state of the container.

[0076] Specifically, in an inter-process communication system, when the first container instance is running, the first communication node can detect the state of the first container instance. The detection includes detecting the resource usage state and the container abnormal state of the first container instance. The resource usage state can represent the performance and capacity of the first container instance, and the container abnormal state can represent the potential threats and behaviors received by the first container instance. By detecting the resource usage state and the container abnormal state of the first container instance, the detection result is obtained, thereby ensuring the robustness and security of the operating environment of the first container instance.

[0077] In one embodiment, the inter-process communication method further includes: the second communication node detects the state of the included second container instance to obtain a detection result, wherein the state includes a resource usage state and a container abnormal state.

[0078] In this embodiment, the state of the second container instance can be understood as the condition of the second container at different stages during the use of the second container.

[0079] Specifically, in an inter-process communication system, when the second container instance is running, the second communication node can detect the state of the second container instance. The detection includes detecting the resource usage state and container abnormal state of the second container instance. The resource usage state can represent the performance and capacity of the second container instance, and the container abnormal state can represent the potential threats and behaviors received by the second container instance. By detecting the resource usage state and container abnormal state of the second container instance, the detection result is obtained, thereby ensuring the robustness and security of the operating environment of the second container instance.

[0080] Embodiment 2

[0081] Figure 2 This is a flowchart of a key update method provided in the second embodiment of the present invention. This embodiment is aimed at updating the keys of the first process to be communicated and the second process to be communicated after the communication is completed in the above embodiment. Figure 2 As shown, the method includes:

[0082] S210: After the first process to communicate and the second process to communicate complete communication, the first communication node and the second communication node generate corresponding new keys respectively.

[0083] In this embodiment, the new key can be understood as a key set for the process after the communication is completed. The key used by the process during communication has been destroyed, and a new key needs to be set for the process that completes the communication.

[0084] Specifically, when the first process to be communicated and the second process to be communicated complete communication, the secret key used by the first process to be communicated and the second process to be communicated for two-way identity authentication is destroyed. Finally, the first communication node and the second communication node configure new secret keys for the first process to be communicated and the second process to be communicated that have completed communication.

[0085] For example, Figure 1B , assuming that process A and process C can communicate, when the two complete the communication, the secret key used by process A and process C for two-way authentication is destroyed. Then device 1 and device 2 configure new secret keys for process A and process C respectively.

[0086] S220: Update the key based on the new key.

[0087] Specifically, according to the new keys configured by the first communication node and the second communication node for the first process to be communicated and the second process to be communicated that complete the communication respectively, the key of the first process corresponding to the first process to be communicated is updated to the new key, and similarly, the key of the second process corresponding to the second process to be communicated is updated to the new key.

[0088] Optionally, the first communication node and the second communication node respectively generate corresponding new keys, including:

[0089] A new key is configured according to the network policies corresponding to the first communication node and the second communication node respectively, and the network policies are associated with the network status.

[0090] In this embodiment, the network policy can be understood as a series of rules and configurations for protecting the computer network, and the secret key of the process can be configured according to the network policy. The network status can be understood as factors such as the stability of the network connection, bandwidth utilization, and latency. When configuring the secret key for the process, the network status can help determine the update frequency of the secret key, encryption strength and other parameters.

[0091] Specifically, when the first process to be communicated and the second process to be communicated complete communication, the secret key used by the first process to be communicated and the second process to be communicated for two-way identity authentication is destroyed. The first communication node and the second communication node configure new secret keys for the first process to be communicated and the second process to be communicated according to the network policy.

[0092] For example, if the network policy indicates that the network status is stable and the bandwidth is sufficient, a more complex key encryption algorithm can be used to configure more complex and more secure keys for the first process to communicate and the second process to communicate; if the network policy indicates that the network status is unstable or the bandwidth is limited, it may be necessary to select a relatively simple but efficient key configuration method to configure the first process to communicate and the second process to communicate.

[0093] The technical solution of the embodiment of the present invention provides a method for updating the secret key of the first process to be communicated and the second process to be communicated after the communication is completed. After the first process to be communicated and the second process to be communicated complete the communication, the first communication node and the second communication node respectively generate corresponding new secret keys, and perform the secret key update based on the new secret keys. By updating the secret key of the process after the communication is completed, the regular replacement of the process secret key is realized, the security and flexibility of the secret key are enhanced, the risk of secret key leakage is reduced, and the security of inter-process communication is ensured.

[0094] Embodiment 3

[0095] Figure 3 This is a schematic diagram of the structure of an inter-process communication system provided by Embodiment 3 of the present invention. Figure 3 As shown, the system includes:

[0096] A first communication node 310 and a second communication node 320, wherein the first communication node includes a plurality of first processes, each of which is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding first process; and the second communication node includes a plurality of second processes, each of which is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding second process;

[0097] A first communication node 310, used to determine a secret key of a first process to be communicated in the first process;

[0098] A second communication node 320, used to determine a secret key of a second process to be communicated in the second process;

[0099] The first communication node 310 and the second communication node 320 are respectively used to perform two-way identity authentication based on corresponding secret keys;

[0100] The first communication node 310 and the second communication node 320 are respectively used to communicate after verification;

[0101] The first communication node 310 and the second communication node 320 are respectively used to update the corresponding secret key after the first process to communicate and the second process to communicate complete communication.

[0102] The inter-process communication system provided by the embodiment of the present invention first determines the secret key of the first process to be communicated in the first process through the first communication node, determines the secret key of the second process to be communicated in the second process through the second communication node, then the first communication node and the second communication node respectively perform two-way identity authentication based on the corresponding secret key, and then after the first communication node and the second communication node are both verified, the first process to be communicated and the second process to be communicated communicate, and finally after the first process to be communicated and the second process to be communicated complete the communication, the corresponding secret key is updated. Through the cooperation between the nodes, the corresponding container instance is created for the process to be communicated through the inter-process communication system, the corresponding secret key is configured for the process to be communicated through the communication node, and the two-way identity authentication is performed through the secret key, so that the communication between processes is completed, and the security and efficiency of the inter-process communication are enhanced. By updating the secret key, the security of the inter-process communication is improved and the integrity of the inter-process communication system is protected.

[0103] In one embodiment, the first communication node 310 and the second communication node 320 include:

[0104] A generating module, configured for the first communication node and the second communication node to generate corresponding new keys respectively after the first communication process and the second communication process complete communication;

[0105] An update module is used to update the key based on the new key.

[0106] In one embodiment, the generating module is specifically used to:

[0107] A new key is configured according to the network policies corresponding to the first communication node and the second communication node respectively, and the network policies are associated with the network status.

[0108] In one embodiment, the first communication node 310 is further configured to:

[0109] The first communication node creates a corresponding first container instance for each first process in the first communication node, and configures an independent execution environment of the first process.

[0110] In one embodiment, the second communication node 320 is further configured to:

[0111] The second communication node creates a corresponding second container instance for each second process in the second communication node, and configures an independent execution environment of the second process.

[0112] In one embodiment, the first communication node 310 is further configured to:

[0113] The first communication node detects the state of the included first container instance to obtain a detection result, where the state includes a resource usage state and a container abnormal state.

[0114] In one embodiment, the second communication node 320 is further configured to:

[0115] The second communication node detects the state of the included second container instance to obtain a detection result, where the state includes a resource usage state and a container abnormal state.

[0116] The inter-process communication system provided by the embodiment of the present invention can execute the inter-process communication method provided by any embodiment of the present invention, and has the corresponding nodes and beneficial effects of the execution method.

[0117] Embodiment 4

[0118] According to an embodiment of the present invention, the present invention also provides a first communication node and a second communication node.

[0119] Figure 4 It is a block diagram of a first communication node provided according to Embodiment 4 of the present invention, and the first communication node can implement the inter-process communication method described in the embodiment of the present invention. The first communication node is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The first communication node can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0120] like Figure 4 As shown, the first communication node 410 includes at least one processor 411, and a memory connected to the at least one processor 411, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the first communication node 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0121] A number of components in the first communication node are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the first communication node to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0122] Processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. Processor 411 performs the various methods and processes described above, such as inter-process communication methods.

[0123] In some embodiments, the inter-process communication method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the first communication node 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the inter-process communication method described above may be performed. Alternatively, in other embodiments, the processor 411 may be configured to perform the inter-process communication method in any other appropriate manner (e.g., by means of firmware).

[0124] Figure 5 It is a block diagram of a second communication node provided according to Embodiment 4 of the present invention, and the second communication node can implement the inter-process communication method described in the embodiment of the present invention. The second communication node is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The second communication node can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0125] like Figure 5As shown, the second communication node 510 includes at least one processor 511, and a memory connected to the at least one processor 511, such as a read-only memory (ROM) 512, a random access memory (RAM) 513, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 511 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 512 or the computer program loaded from the storage unit 518 to the random access memory (RAM) 513. In the RAM 513, various programs and data required for the operation of the second communication node 510 can also be stored. The processor 511, the ROM 512 and the RAM 513 are connected to each other via a bus 514. An input / output (I / O) interface 515 is also connected to the bus 514.

[0126] A number of components in the second communication node are connected to the I / O interface 515, including: an input unit 516, such as a keyboard, a mouse, etc.; an output unit 517, such as various types of displays, speakers, etc.; a storage unit 518, such as a disk, an optical disk, etc.; and a communication unit 519, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 519 allows the second communication node to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0127] The processor 511 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 511 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 511 performs the various methods and processes described above, such as inter-process communication methods.

[0128] In some embodiments, the inter-process communication method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 518. In some embodiments, part or all of the computer program may be loaded and / or installed on the second communication node 510 via the ROM 512 and / or the communication unit 519. When the computer program is loaded into the RAM 513 and executed by the processor 511, one or more steps of the inter-process communication method described above may be performed. Alternatively, in other embodiments, the processor 511 may be configured to perform the inter-process communication method in any other appropriate manner (e.g., by means of firmware).

[0129] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0130] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0131] To provide interaction with a user, the systems and techniques described herein may be implemented on a first communication node or a second communication node, the first communication node or the second communication node having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball), through which the user can provide input to the first communication node or the second communication node. Other types of devices may also be used to provide interaction with a user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0132] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0133] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0134] The technical solution of the embodiment of the present invention is applied to the inter-process communication system through an inter-process communication method, system, first communication node and second communication node. First, the secret key of the first process to be communicated in the first process is determined by the first communication node, and the secret key of the second process to be communicated in the second process is determined by the second communication node. Then, the first communication node and the second communication node respectively perform two-way identity authentication based on the corresponding secret key. Then, after the first communication node and the second communication node are both verified, the first process to be communicated and the second process to be communicated communicate. Finally, after the first process to be communicated and the second process to be communicated complete the communication, the corresponding secret key is updated. The present invention creates a corresponding container instance for the process to be communicated through the inter-process communication system, configures the corresponding secret key for the process to be communicated through the communication node, performs two-way identity authentication through the secret key, completes the communication between processes, and enhances the security and efficiency of inter-process communication. By updating the secret key, the security of inter-process communication is improved and the integrity of the inter-process communication system is protected.

[0135] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0136] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An inter-process communication method, characterized in that: Applied to an inter-process communication system, the communication system includes a first communication node and a second communication node, the first communication node includes a plurality of first processes, each first process is deployed with a corresponding first container instance, the first container instance provides an independent execution environment for the corresponding first process, the second communication node includes a plurality of second processes, each second process is deployed with a corresponding second container instance, the second container instance provides an independent execution environment for the corresponding second process, the method includes: The first communication node determines a secret key of a first process to be communicated in the first process; The second communication node determines a secret key of a second process to be communicated in the second process; The first communication node and the second communication node respectively perform two-way identity authentication based on the corresponding secret keys; After both the first communication node and the second communication node are verified, the first process to be communicated and the second process to be communicated communicate; After the first process to communicate and the second process to communicate complete communication, the corresponding secret key is updated.

2. The method according to claim 1, characterized in that After the first process to communicate and the second process to communicate complete communication, updating the corresponding secret key includes: After the first process to be communicated and the second process to be communicated complete communication, the first communication node and the second communication node generate corresponding new keys respectively; The key is updated based on the new key.

3. The method according to claim 2, characterized in that The first communication node and the second communication node respectively generate corresponding new keys, including: A new key is configured according to the network policies corresponding to the first communication node and the second communication node respectively, and the network policies are associated with the network status.

4. The method according to claim 1, characterized in that: Before the first communication node determines the secret key of the first process to be communicated in the first process, the method further includes: The first communication node creates a corresponding first container instance for each first process in the first communication node, and configures an independent execution environment of the first process.

5. The method according to claim 1, characterized in that Before the second communication node determines the secret key of the second process to be communicated in the second process, the method further includes: The second communication node creates a corresponding second container instance for each second process in the second communication node, and configures an independent execution environment of the second process.

6. The method according to claim 1, characterized in that Also includes: The first communication node detects the state of the included first container instance to obtain a detection result, where the state includes a resource usage state and a container abnormal state.

7. The method according to claim 1, characterized in that Also includes: The second communication node detects the state of the included second container instance to obtain a detection result, where the state includes a resource usage state and a container abnormal state.

8. An inter-process communication system, characterized in that: include: a first communication node and a second communication node, wherein the first communication node includes a plurality of first processes, each of which is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding first process; and the second communication node includes a plurality of second processes, each of which is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding second process; The first communication node is used to determine a secret key of a first process to be communicated in the first process; The second communication node is used to determine the secret key of the second process to be communicated in the second process; The first communication node and the second communication node are respectively used to perform two-way identity authentication based on the corresponding secret keys; The first communication node and the second communication node are respectively used to communicate after the verification is passed; The first communication node and the second communication node are respectively used to update the corresponding secret key after the first process to be communicated and the second process to be communicated complete communication.

9. A first communication node, characterized in that: The first communication node includes a plurality of first processes, each of which is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding first process. The first communication node includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the following operations: Determining a secret key of a first process to be communicated in the first process; Authenticating the second communication node based on the corresponding secret key; After the verification is passed, communicating with the second communication process of the second communication node through the first process to be communicated; After the communication is completed, the secret key is updated.

10. A second communication node, characterized in that: The second communication node includes a plurality of second processes, each second process is deployed with a corresponding first container instance, and the container instance provides an independent execution environment for the corresponding second process. The second communication node includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the following operations: Determining a secret key of a second process to be communicated in the second process; Authenticating the first communication node based on the corresponding secret key; After the verification is passed, communicating with the first communication process of the first communication node through the second process to be communicated; After the communication is completed, the secret key is updated.

Images