Cluster management method and device based on trusted long connection and storage medium

Abstract

The invention relates to a cluster management method and device based on trusted long connection and a storage medium, a trusted management center cluster at least comprises a prepositive server and a plurality of trusted management centers, and the method comprises the following steps: the prepositive server obtains a registration request of a terminal; and determining a target trusted management center in the plurality of trusted management centers based on the registration request. According to the method, the target trusted management center can be determined in the plurality of trusted management centers through the registration request of the terminal acquired by the prepositive server, and the data interaction between the target trusted management center and the terminal can be realized based on the trusted long connection under the condition that the terminal is successfully registered, so that the user experience can be improved under the condition that the network data security is ensured. The trusted terminals are safely, reliably and extendibly managed, the number of the managed terminals is not limited by the system and network resources, and only the trusted management center nodes in the cluster need to be expanded.

Description

Technical Field

[0001] The present application relates to the field of cluster technology, and in particular to a cluster management method, device and storage medium based on trusted long connection. Background Art

[0002] In the current field of cluster technology, cluster management functions are mostly implemented in the form of short connections. Especially in the field of trusted computing, there is a lack of long connections that guarantee security for cluster management. Therefore, how to achieve cluster management of trusted terminals based on trusted long connections while ensuring network data security has become an urgent problem to be solved. Summary of the invention

[0003] The present application provides a cluster management method, device and storage medium based on trusted long connection to solve the technical problem of realizing cluster management of trusted terminals based on trusted long connection while ensuring network data security.

[0004] In a first aspect, the present application provides a cluster management method based on a trusted long connection, which is applied to a trusted management center cluster, wherein the trusted management center cluster includes at least a front-end server and multiple trusted management centers, and the method includes:

[0005] The front-end server obtains a registration request from the terminal;

[0006] Determining a target trusted management center among the plurality of trusted management centers based on the registration request;

[0007] When the target trusted management center successfully registers the terminal, establishing a trusted long connection with the terminal;

[0008] The target trusted management center performs data interaction with the terminal based on the trusted long connection.

[0009] Optionally, determining a target trusted management center from among the plurality of trusted management centers based on the registration request includes:

[0010] Obtaining a target recommendation list determined by each of the trusted management centers based on the registration request and a preset recommendation algorithm, wherein the target recommendation list includes a recommendation priority order of the trusted management centers;

[0011] The target trusted management center is determined based on a plurality of the target recommendation lists.

[0012] Optionally, the target trusted management center performs data interaction with the terminal based on the trusted long connection, including:

[0013] Acquire first encrypted data sent by the terminal; wherein the first encrypted data is generated by the terminal using a preset key to perform a block cipher algorithm on the terminal public key certificate; wherein the preset key is a default key negotiated between the terminal and the target trusted management center;

[0014] The terminal public key certificate is obtained by decrypting the first encrypted data according to the preset key, and the management center public key certificate is encrypted by a block cipher algorithm using the preset key to generate second encrypted data;

[0015] Sending the second encrypted data to the terminal; so that the terminal decrypts the second encrypted data based on the preset key to obtain the management center public key certificate;

[0016] Acquire the third encrypted data sent by the terminal; wherein the third encrypted data is generated by the terminal after signing the terminal data signature public key certificate using the public key in the management center public key certificate;

[0017] The third encrypted data is signed by using the management center private key certificate, and after the signature is verified, a new encryption factor is determined based on the terminal data signature public key certificate obtained by the signature verification;

[0018] Replace the preset key according to the new encryption factor;

[0019] When the new encryption factor replaces the preset key, data interaction is performed with the terminal based on the trusted long connection.

[0020] Optionally, performing data interaction with the terminal based on the trusted long connection includes:

[0021] In the long connection secure channel, data is exchanged with the terminal according to a preset message format; wherein the preset message format includes a data area and data length information, the data length information is used to represent the length of the data area, and the data area includes a data header and a data body;

[0022] Wherein, performing data interaction with the terminal according to a preset message format includes:

[0023] The target trusted management center signs the data body based on the private key, and encrypts the data area using the new encryption factor using a block cipher algorithm to generate a first sending message;

[0024] The first sending message is sent to the terminal, so that the terminal decrypts based on the new encryption factor and verifies the signature of the data body based on the public key of the target trusted management center.

[0025] In a second aspect, the present application provides a cluster management method based on a trusted long connection, which is applied to a terminal, and the method includes:

[0026] Sending a registration request to a trusted management center cluster; wherein the trusted management center cluster includes at least a front-end server and multiple trusted management centers;

[0027] When the target trusted management center successfully registers the terminal, establishing a trusted long connection with the target trusted management center; wherein the target trusted management center is determined from among the multiple trusted management centers based on the registration request;

[0028] Data is exchanged with the target trusted management center based on the trusted long connection.

[0029] Optionally, performing data interaction with the target trusted management center based on the trusted long connection includes:

[0030] The terminal public key certificate is encrypted using a block cipher algorithm with a preset key to generate first encrypted data; wherein the preset key is a default key negotiated between the terminal and the target trusted management center;

[0031] Sending the first encrypted data to the target trusted management center; so that the target trusted management center decrypts the first encrypted data according to the preset key to obtain the terminal public key certificate for storage;

[0032] Obtaining second encrypted data generated by the target trusted management center using the preset key to encrypt the management center public key certificate using a block cipher algorithm;

[0033] Decrypting the second encrypted data based on the preset key to obtain the management center public key certificate;

[0034] The third encrypted data is generated after signing the terminal data signature public key certificate using the public key in the management center public key certificate;

[0035] Sending the third encrypted data to the target trusted management center;

[0036] Obtaining a new encryption factor sent by the target trusted management center; wherein the new encryption factor is verified by the target trusted management center using the management center private key certificate to sign the third encrypted data, and after the signature verification is passed, the new encryption factor is determined based on the terminal data signature public key certificate obtained by the signature verification;

[0037] Replace the preset key according to the new encryption factor;

[0038] When the new encryption factor replaces the preset key, data interaction is performed with the target trusted management center based on the trusted long connection.

[0039] Optionally, performing data interaction with the target trusted management center based on the trusted long connection includes:

[0040] In the long connection security channel, data is exchanged with the target trusted management center according to a preset message format; wherein the preset message format includes a data area and data length information, the data length information is used to characterize the length of the data area, and the data area includes a data header and a data body;

[0041] The data interaction with the target trusted management center is performed according to a preset message format, including:

[0042] The terminal signs the data body based on the private key, and encrypts the data area using the new encryption factor using a block cipher algorithm to generate a second sending message;

[0043] The second sending message is sent to the target trusted management center, so that the target trusted management center decrypts based on the new encryption factor and verifies the signature of the data body based on the public key of the terminal.

[0044] In a third aspect, the present application provides a cluster management device based on a trusted long connection, which is applied to a trusted management center cluster, wherein the trusted management center cluster includes at least a front-end server and multiple trusted management centers, and the device includes:

[0045] An acquisition module, used for the front-end server to acquire a registration request of a terminal;

[0046] A determination module, configured to determine a target trusted management center among the plurality of trusted management centers based on the registration request;

[0047] A first connection establishing module, configured to establish a trusted long connection with the terminal when the terminal is successfully registered at the target trusted management center;

[0048] The first interaction module is used for the target trusted management center to perform data interaction with the terminal based on the trusted long connection.

[0049] In a fourth aspect, the present application provides a cluster management device based on a trusted long connection, which is applied to a terminal, and the device includes:

[0050] A sending module, used to send a registration request to a trusted management center cluster; wherein the trusted management center cluster includes at least a front-end server and multiple trusted management centers;

[0051] A second connection establishment module, configured to establish a trusted long connection with the target trusted management center when the target trusted management center successfully registers the terminal; wherein the target trusted management center is determined from among the plurality of trusted management centers based on the registration request;

[0052] The second interaction module is used to interact with the target trusted management center based on the trusted long connection.

[0053] In a fifth aspect, the present application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0054] Memory, used to store computer programs;

[0055] The processor is used to implement the cluster management method based on trusted long connection described in any embodiment of the first aspect or any embodiment of the second aspect when executing the program stored in the memory.

[0056] In a sixth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the cluster management method based on a trusted long connection as described in any embodiment of the first aspect or any embodiment of the second aspect is implemented.

[0057] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the method provided by the embodiment of the present application is applied to a trusted management center cluster, the trusted management center cluster includes at least a front-end server and multiple trusted management centers, and the method includes: the front-end server obtains a registration request of a terminal; based on the registration request, a target trusted management center is determined among multiple trusted management centers; if the target trusted management center successfully registers the terminal, a trusted long connection with the terminal is established; the target trusted management center performs data interaction with the terminal based on the trusted long connection. The method can determine the target trusted management center among multiple trusted management centers through the registration request of the terminal obtained by the front-end server, and if the terminal is successfully registered, the target trusted management center and the terminal are interacted with based on the trusted long connection. The trusted terminal can be managed safely, reliably and scalably while ensuring the security of network data. The number of managed terminals is not limited by system and network resources, and only the trusted management center nodes in the cluster need to be expanded. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0059] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0060] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0061] Figure 1 A system architecture diagram of a cluster management method based on a trusted long connection provided for an embodiment of the present application;

[0062] Figure 2 A flow chart of a cluster management method based on a trusted long connection provided in one embodiment of the present application;

[0063] Figure 3 A schematic diagram of a trusted management center cluster processing business process provided for an embodiment of the present application;

[0064] Figure 4 A flowchart of a cluster management method based on a trusted long connection provided for a specific embodiment of the present application;

[0065] Figure 5 A schematic diagram of a message format provided for an embodiment of the present application;

[0066] Figure 6 A schematic diagram of a business data interaction process provided for an embodiment of the present application;

[0067] Figure 7 A flowchart of a cluster management method based on a trusted long connection provided in another embodiment of the present application;

[0068] Figure 8 A schematic diagram of the structure of a cluster management device based on a trusted long connection provided by an embodiment of the present application;

[0069] Fig. 9 A schematic diagram of the structure of a cluster management device based on a trusted long connection provided in another embodiment of the present application;

[0070] Fig.10 A schematic diagram of the structure of an electronic device provided in accordance with an embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0072] The disclosure below provides many different embodiments or examples to realize the different structures of the present application. In order to simplify the disclosure of the present application, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present application. In addition, the present application can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0073] To facilitate understanding of the technical solution of this application, some of the terms involved are first explained as follows:

[0074] Trusted Management Center: Management software deployed on a separate server. It can also refer to a separate server on which the associated software is deployed.

[0075] Trusted management center cluster: Several trusted management centers form a cluster.

[0076] Trusted terminal node: A TSB terminal deployed on a specific business or data server, also known as a trusted terminal or terminal, where TSB refers to the Trusted Software Base, a collection of software elements that provide support for the trustworthiness of a trusted computing platform.

[0077] In order to solve the technical problem in the prior art of how to achieve cluster management of trusted terminals based on trusted long connections while ensuring network data security, the present application provides a cluster management method, device and storage medium based on trusted long connections, which can achieve safe, reliable and scalable management of trusted terminals. The number of managed terminals is not limited by system and network resources, and it only needs to expand the trusted management center node in the cluster.

[0078] The first embodiment of the present application provides a cluster management method based on a trusted long connection. The method can be applied to Figure 1 The system architecture shown in the figure includes at least a terminal and a trusted management center cluster, wherein the trusted management center cluster includes a front-end server and multiple trusted management centers, and may also include a database server, a software server, an audit server, etc. Communication connections are established between various components in the trusted management center cluster.

[0079] In this system architecture, the main function of the trusted management center is to deploy background services, where multiple servers form a trusted management center cluster, and multiple trusted management centers share one or more database servers and software servers. The trusted management center server can be dynamically expanded according to the actual number of terminals on site without stopping the service. The audit server is used to receive audits reported by the terminal. The database server is used to store basic business data. The software server is used to store software packages uploaded by the management center for terminals to download software. The front-end server is used to deploy the static page of the trusted management center, receive the initial registration request of the terminal, and the request between the trusted terminal and the trusted management center cluster, and ensure the security and integrity of the data through the security mechanism.

[0080] The method can be applied to a terminal or a trusted management center cluster in the system architecture. Next, based on the system architecture, the cluster management method based on the trusted long connection is described in detail.

[0081] When applied to a trusted management center cluster, such as Figure 2 , the cluster management method based on trusted long connection includes:

[0082] Step 201: The front-end server obtains a registration request from a terminal.

[0083] The front-end server can call the interface of the trusted management center cluster according to the terminal's registration request, so that the trusted management center cluster determines a target trusted management center from multiple trusted management centers to receive the registration request, and processes the registration service based on the registration request and establishes a trusted long connection with the terminal.

[0084] Step 202: determine a target trusted management center among multiple trusted management centers based on the registration request.

[0085] In one embodiment, a target trusted management center is determined among multiple trusted management centers based on a registration request, including: obtaining a target recommendation list determined by each trusted management center based on the registration request and a preset recommendation algorithm, wherein the target recommendation list includes a recommendation priority order of the trusted management center; and determining the target trusted management center based on multiple target recommendation lists.

[0086] In this embodiment, after the trusted management center cluster obtains the registration request of the terminal, the registration request can be processed by a certain trusted management center in the cluster, or each trusted management center can determine the target recommendation list for processing the registration request based on the registration request and a preset recommendation algorithm. That is to say, the various servers (trusted management centers) in the cluster must calculate with each other to select the server that is most suitable for processing the registration request. The target recommendation list can be the IP address of the trusted management center, and the IP address with a high priority is ranked first. Therefore, the target trusted management center recognized by each node for processing the registration request can be determined according to each target recommendation list. The front-end server can return the IP address representing the target trusted management center to the terminal, so that after receiving the IP address, the terminal initiates registration with the target trusted management center represented by the IP address.

[0087] From the administrator's perspective, a diagram of a trusted management center cluster processing business process is as follows: Figure 3 The administrator accesses the front-end server, and the front-end server calls a cluster interface in the trusted management center cluster. The trusted management center server processes the business, such as operating the database server, software server or audit server, and returns after the processing is completed. Of course, if the business to be processed is to upload a software package, the trusted management center server needs to upload the software package to the software server.

[0088] Step 203: When the target trusted management center successfully registers the terminal, a trusted long connection with the terminal is established.

[0089] Step 204: The target trusted management center interacts with the terminal based on the trusted long connection.

[0090] The method can determine the target trusted management center among multiple trusted management centers through the registration request of the terminal obtained by the front-end server, and realize the data interaction between the target trusted management center and the terminal based on the trusted long connection when the terminal is successfully registered. The trusted terminals can be managed safely, reliably and scalably while ensuring the security of network data. The number of managed terminals is not limited by system and network resources, and only the trusted management center nodes in the cluster need to be expanded.

[0091] In a specific embodiment, from the perspective of a terminal, a flow chart of a cluster management method based on a trusted long connection is as follows: Figure 4 ,include:

[0092] Step 401, the terminal requests the front-end server for the IP address of the trusted management center that can actually be used for registration and connection;

[0093] Step 402, the front-end server calls the trusted management center cluster interface;

[0094] Step 403: A server in the trusted management center cluster processes the request. The server that processes the request obtains a more suitable server IP address (such as 192.168.3.2) that can be used for registration through an algorithm and returns it to the front-end server (the servers in the cluster need to calculate with each other to select the most suitable IP address);

[0095] Step 404, the front-end server returns the IP address: 192.168.3.2 to the terminal;

[0096] Step 405, after receiving the IP address 192.168.3.2, the terminal initiates registration with the trusted management center;

[0097] Step 406, the trusted management center with the address 192.168.3.2 receives the registration request;

[0098] Step 407, whether the 192.168.3.2 trusted management center processes the registration service successfully; if successful, execute step 408, if failed, re-execute step 401;

[0099] Step 408: The terminal initiates a heartbeat cycle to maintain a secure long connection.

[0100] In one embodiment, the target trusted management center performs data interaction with the terminal based on the trusted long connection, including:

[0101] Acquire first encrypted data sent by the terminal; wherein the first encrypted data is generated by the terminal using a preset key to perform a block cipher algorithm on the terminal public key certificate; wherein the preset key is a default key negotiated between the terminal and the target trusted management center;

[0102] The first encrypted data is decrypted according to the preset key to obtain the terminal public key certificate, and the management center public key certificate is encrypted by the block cipher algorithm using the preset key to generate the second encrypted data;

[0103] Sending the second encrypted data to the terminal; so that the terminal decrypts the second encrypted data based on the preset key to obtain the management center public key certificate;

[0104] Acquire the third encrypted data sent by the terminal; wherein the third encrypted data is generated after the terminal signs the terminal data signature public key certificate using the public key in the management center public key certificate;

[0105] The third encrypted data is signed by using the management center private key certificate, and after the signature is verified, a new encryption factor is determined based on the terminal data signature public key certificate obtained by the signature verification;

[0106] Replace the preset key according to the new encryption factor;

[0107] When the new encryption factor replaces the preset key, data interaction is performed with the terminal based on a trusted long connection.

[0108] In the embodiment of the present application, during the data interaction process of the trusted long connection between the target trusted management center and the terminal, the data is transmitted through double encryption, that is, the certificate is signed inside the data, and the entire data is encrypted by a block cipher algorithm, and the block cipher algorithm can be an SM4 block cipher algorithm. Specifically, the terminal and the target trusted management center pre-negotiate a default key (that is, a preset key), the terminal uses the preset key to perform a block cipher algorithm to encrypt the terminal public key certificate to generate the first encrypted data, the terminal sends the first encrypted data to the target trusted management center, the target trusted management center decrypts the first encrypted data according to the preset key to obtain the terminal public key certificate, saves the terminal public key certificate (the terminal public key certificate contains the terminal's public key), and uses the preset key to perform a block cipher algorithm to encrypt the management center public key certificate to generate the second encrypted data, the target trusted management center sends the second encrypted data to the terminal, the terminal decrypts the second encrypted data based on the preset key to obtain the management center public key certificate (the management center public key certificate contains the target trusted management center's public key); the terminal uses the public key in the management center public key certificate to sign the terminal data and then generates the third encrypted data after signing the public key certificate, The third encrypted data is sent to the target trusted management center, which uses the management center private key certificate to verify the signature of the third encrypted data. After the signature verification is passed, the new encryption factor is determined based on the terminal data signature public key certificate obtained by the signature verification. For example, the terminal data signature public key certificate and a 16-bit random number are XORed to obtain the new encryption factor, and the original preset key is replaced according to the new encryption factor. At the same time, the new encryption factor is sent to the terminal, and the original preset key is also replaced in the terminal according to the new encryption factor. When the replacement of the preset key by the new encryption factor is completed, data interaction is performed with the terminal based on the trusted long connection, and the new encryption factor is used for SM4 encryption and decryption in subsequent normal communications, thereby ensuring that each terminal has a dedicated new encryption factor in the trusted long connection with its corresponding target trusted management center, thereby ensuring the data security of the long connection.

[0109] In one embodiment, data interaction with a terminal based on a trusted long connection includes: data interaction with the terminal in a preset message format in a long connection security channel; wherein the preset message format includes a data area and data length information, the data length information is used to characterize the length of the data area, and the data area includes a data header and a data body. Wherein, data interaction with the terminal in the preset message format includes: the target trusted management center signs the data body based on a private key, and encrypts the data area using a block cipher algorithm using a new encryption factor to generate a first send message; the first send message is sent to the terminal so that the terminal decrypts based on the new encryption factor, and verifies the signature of the data body based on the public key of the target trusted management center.

[0110] In this embodiment, the message for data exchange in the persistent connection secure channel may be in a preset message format. The preset message format may be as follows: Figure 5 , including data area and data length information. The data length information is used to characterize the length of the data area. For example, it can be a 4-byte integer. The integer represents the length of the data area. The data area includes a data header and a data body. The data body can be signed based on the private key of the target trusted management center. The entire message can be sm4 encrypted based on the new encryption factor. For example, the target trusted management center sends the encrypted message to the terminal. The terminal can decrypt the message using the new encryption factor and verify the signature of the data body based on the public key of the target trusted management center. Transmission through double encryption can ensure the security of the trusted long connection data interaction between the target trusted management center and the terminal.

[0111] In a specific embodiment, a schematic diagram of a business data interaction process is as follows: Figure 6, including: establishing connection, certificate exchange, negotiating keys, changing encryption factors, data signing and verification, sending data, maintaining connection and other steps. Specifically, the terminal registers with the trusted management center cluster to establish a connection, such as being assigned to the target trusted management center (hereinafter referred to as the management center), and sends the terminal's public key certificate to the management center after sm4 encryption. The management center uses the default key to decrypt the data, saves the terminal public key certificate, and at the same time encrypts the management center's own public key certificate with sm4 and sends it to the terminal. Next, key negotiation is performed to change the encryption factor. The terminal uses the management center's public key to sign the terminal data signature public key certificate and sends it to the management center, which verifies the signature with its own private key certificate. After the signature is verified, the terminal's data signature public key certificate is XORed with a 16-bit random number to form a new sm4 encryption factor and replace the default sm4 key. In the future, the new encryption factor is used for sm4 encryption and decryption in normal communication. When sending data, both parties use their own private keys to sign the data area of ​​the message, and then use the newly added encryption factor to sm4 encrypt the entire message and send it to the other party. After the other party receives the message, it first decrypts it with the encryption factor and then verifies the signature with the other party's public key.

[0112] In this embodiment, a secure and reliable long connection is adopted, combined with double encryption to ensure data security, and the trusted management center cluster can effectively handle long connections. Dynamic expansion can be achieved by increasing the number of trusted management centers in the trusted management center cluster. There is no need to stop the entire trusted management center cluster during the expansion process. After the expansion, the terminal that sends the registration request can be assigned a target trusted management center by the front-end server based on the registration request. At this time, the target trusted management center can be a newly added trusted management center. In other words, when the number of terminals increases, no bottleneck will be formed. At the same time, the number of online long connection terminals can theoretically grow infinitely, and it is only necessary to increase the number of trusted management centers accordingly.

[0113] When applied to a terminal, such as Figure 7 , the cluster management method based on trusted long connection includes:

[0114] Step 701, sending a registration request to a trusted management center cluster; wherein the trusted management center cluster includes at least a front-end server and multiple trusted management centers.

[0115] Step 702: When the target trusted management center successfully registers the terminal, a trusted long connection with the target trusted management center is established; wherein the target trusted management center is determined from among multiple trusted management centers based on the registration request.

[0116] Step 703: Data interaction with the target trusted management center based on the trusted long connection.

[0117] The method can determine the target trusted management center among multiple trusted management centers through the registration request of the terminal obtained by the front-end server, and realize the data interaction between the target trusted management center and the terminal based on the trusted long connection when the terminal is successfully registered. The trusted terminals can be managed safely, reliably and scalably while ensuring the security of network data. The number of managed terminals is not limited by system and network resources, and only the trusted management center nodes in the cluster need to be expanded.

[0118] In one embodiment, data interaction with a target trusted management center based on a trusted long connection includes:

[0119] The terminal public key certificate is encrypted using a block cipher algorithm with a preset key to generate first encrypted data; wherein the preset key is a default key negotiated between the terminal and the target trusted management center;

[0120] Sending the first encrypted data to the target trusted management center; so that the target trusted management center decrypts the first encrypted data according to the preset key to obtain the terminal public key certificate for storage;

[0121] Obtaining second encrypted data generated by encrypting the management center public key certificate using a block cipher algorithm by the target trusted management center using a preset key;

[0122] Decrypting the second encrypted data based on the preset key to obtain a management center public key certificate;

[0123] The third encrypted data is generated after the terminal data is signed with the public key in the public key certificate of the management center;

[0124] Sending the third encrypted data to a target trusted management center;

[0125] Obtain a new encryption factor sent by the target trusted management center; wherein the new encryption factor is verified by the target trusted management center using the management center private key certificate to sign the third encrypted data, and after the signature is verified, it is determined based on the terminal data signature public key certificate obtained by the signature verification;

[0126] Replace the preset key according to the new encryption factor;

[0127] When the new encryption factor replaces the preset key, data interaction is performed with the target trusted management center based on the trusted long connection.

[0128] In the embodiment of the present application, during the data interaction process of the trusted long connection between the target trusted management center and the terminal, the data is transmitted through double encryption, that is, the certificate is signed inside the data, and the entire data is encrypted by a block cipher algorithm, and the block cipher algorithm can be an SM4 block cipher algorithm. Specifically, the terminal and the target trusted management center pre-negotiate a default key (that is, a preset key), the terminal uses the preset key to perform a block cipher algorithm to encrypt the terminal public key certificate to generate the first encrypted data, the terminal sends the first encrypted data to the target trusted management center, the target trusted management center decrypts the first encrypted data according to the preset key to obtain the terminal public key certificate, saves the terminal public key certificate (the terminal public key certificate contains the terminal's public key), and uses the preset key to perform a block cipher algorithm to encrypt the management center public key certificate to generate the second encrypted data, the target trusted management center sends the second encrypted data to the terminal, the terminal decrypts the second encrypted data based on the preset key to obtain the management center public key certificate (the management center public key certificate contains the target trusted management center's public key); the terminal uses the public key in the management center public key certificate to sign the terminal data and then generates the third encrypted data after signing the public key certificate, The third encrypted data is sent to the target trusted management center, which uses the management center private key certificate to verify the signature of the third encrypted data. After the signature verification is passed, the new encryption factor is determined based on the terminal data signature public key certificate obtained by the signature verification. For example, the terminal data signature public key certificate and a 16-bit random number are XORed to obtain the new encryption factor, and the original preset key is replaced according to the new encryption factor. At the same time, the new encryption factor is sent to the terminal, and the original preset key is also replaced in the terminal according to the new encryption factor. When the replacement of the preset key by the new encryption factor is completed, data interaction is performed with the terminal based on the trusted long connection, and the new encryption factor is used for SM4 encryption and decryption in subsequent normal communications, thereby ensuring that each terminal has a dedicated new encryption factor in the trusted long connection with its corresponding target trusted management center, thereby ensuring the data security of the long connection.

[0129] In one embodiment, data interaction with a target trusted management center based on a trusted long connection includes: data interaction with the target trusted management center in a preset message format in a long connection security channel; wherein the preset message format includes a data area and data length information, the data length information is used to characterize the length of the data area, and the data area includes a data header and a data body. Wherein, data interaction with the target trusted management center in accordance with the preset message format includes: the terminal signs the data body based on a private key, and encrypts the data area using a block cipher algorithm using a new encryption factor to generate a second sending message; the second sending message is sent to the target trusted management center, so that the target trusted management center decrypts the data based on the new encryption factor, and verifies the signature of the data body based on the public key of the terminal.

[0130] In this embodiment, the message for data interaction in the long connection security channel can be a preset message format. The composition of the preset message format is not repeated here. The data body can be signed based on the private key of the terminal, and the entire message can be sm4 encrypted based on the new encryption factor. For example, the terminal sends the encrypted message to the target trusted management center, and the target trusted management center can decrypt the message using the new encryption factor and verify the signature of the data body based on the public key of the terminal. Through double encryption for transmission, the security of the trusted long connection data interaction between the terminal and the target trusted management center can be guaranteed.

[0131] Based on the same technical concept, the second embodiment of the present application provides a cluster management device based on a trusted long connection. When applied to a trusted management center cluster, the trusted management center cluster includes at least a front-end server and multiple trusted management centers, such as Figure 8 , the device comprises:

[0132] Acquisition module 801, used for the front-end server to acquire a registration request of a terminal;

[0133] A determination module 802, configured to determine a target trusted management center from among the plurality of trusted management centers based on the registration request;

[0134] A first connection establishing module 803, configured to establish a trusted long connection with the terminal when the terminal is successfully registered at the target trusted management center;

[0135] The first interaction module 804 is used for the target trusted management center to perform data interaction with the terminal based on the trusted long connection.

[0136] The device can determine the target trusted management center among multiple trusted management centers through the registration request of the terminal obtained by the front-end server, and when the terminal is successfully registered, realize the data interaction between the target trusted management center and the terminal based on the trusted long connection. It can manage the trusted terminals safely, reliably and scalably while ensuring the security of network data. The number of managed terminals is not limited by system and network resources, and it only needs to expand the trusted management center nodes in the cluster.

[0137] When applied to a terminal, such as Fig. 9 , the device comprises:

[0138] The sending module 901 is used to send a registration request to a trusted management center cluster; wherein the trusted management center cluster includes at least a front-end server and multiple trusted management centers;

[0139] A second connection establishing module 902 is used to establish a trusted long connection with the target trusted management center when the target trusted management center successfully registers the terminal; wherein the target trusted management center is determined from the plurality of trusted management centers based on the registration request;

[0140] The second interaction module 903 is used to perform data interaction with the target trusted management center based on the trusted long connection.

[0141] The device can determine the target trusted management center among multiple trusted management centers through the registration request of the terminal obtained by the front-end server, and when the terminal is successfully registered, realize the data interaction between the target trusted management center and the terminal based on the trusted long connection. It can manage the trusted terminals safely, reliably and scalably while ensuring the security of network data. The number of managed terminals is not limited by system and network resources, and it only needs to expand the trusted management center nodes in the cluster.

[0142] like Fig.10 As shown, an embodiment of the present application provides an electronic device, including a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0143] Memory 113, used for storing computer programs;

[0144] In one embodiment of the present application, the processor 111 is used to implement the cluster management method based on trusted long connection provided by any one of the aforementioned method embodiments when executing the program stored in the memory 113.

[0145] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0146] The communication interface is used for communication between the above terminal and other devices.

[0147] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0148] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0149] An embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the cluster management method based on a trusted long connection provided by any of the aforementioned method embodiments is implemented.

[0150] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0151] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0152] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0153] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. In the description, the suffixes such as "module", "component" or "unit" used to represent the elements are only used to facilitate the description of the present application and have no specific meaning in themselves. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0154] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A cluster management method based on trusted long connection, characterized in that: Applied to a trusted management center cluster, the trusted management center cluster includes at least a front-end server and multiple trusted management centers, the method includes: The front-end server obtains a registration request from the terminal; Determining a target trusted management center among the plurality of trusted management centers based on the registration request; When the target trusted management center successfully registers the terminal, establishing a trusted long connection with the terminal; The target trusted management center performs data interaction with the terminal based on the trusted long connection.

2. The method according to claim 1, characterized in that Determining a target trusted management center among the plurality of trusted management centers based on the registration request includes: Obtaining a target recommendation list determined by each of the trusted management centers based on the registration request and a preset recommendation algorithm, wherein the target recommendation list includes a recommendation priority order of the trusted management centers; The target trusted management center is determined based on a plurality of the target recommendation lists.

3. The method according to claim 1, characterized in that The target trusted management center performs data interaction with the terminal based on the trusted long connection, including: Acquire first encrypted data sent by the terminal; wherein the first encrypted data is generated by the terminal using a preset key to perform a block cipher algorithm on the terminal public key certificate; wherein the preset key is a default key negotiated between the terminal and the target trusted management center; The terminal public key certificate is obtained by decrypting the first encrypted data according to the preset key, and the management center public key certificate is encrypted by a block cipher algorithm using the preset key to generate second encrypted data; Sending the second encrypted data to the terminal; so that the terminal decrypts the second encrypted data based on the preset key to obtain the management center public key certificate; Acquire the third encrypted data sent by the terminal; wherein the third encrypted data is generated by the terminal after signing the terminal data signature public key certificate using the public key in the management center public key certificate; The third encrypted data is signed by using the management center private key certificate, and after the signature is verified, a new encryption factor is determined based on the terminal data signature public key certificate obtained by the signature verification; Replace the preset key according to the new encryption factor; When the new encryption factor replaces the preset key, data interaction is performed with the terminal based on the trusted long connection.

4. The method according to claim 3, characterized in that Interacting data with the terminal based on the trusted long connection includes: In the long connection secure channel, data is exchanged with the terminal according to a preset message format; wherein the preset message format includes a data area and data length information, the data length information is used to represent the length of the data area, and the data area includes a data header and a data body; Wherein, performing data interaction with the terminal according to a preset message format includes: The target trusted management center signs the data body based on the private key, and encrypts the data area using the new encryption factor using a block cipher algorithm to generate a first sending message; The first sending message is sent to the terminal, so that the terminal decrypts based on the new encryption factor and verifies the signature of the data body based on the public key of the target trusted management center.

5. A cluster management method based on trusted long connection, characterized in that: Applied to a terminal, the method comprises: Sending a registration request to a trusted management center cluster; wherein the trusted management center cluster includes at least a front-end server and multiple trusted management centers; When the target trusted management center successfully registers the terminal, establishing a trusted long connection with the target trusted management center; wherein the target trusted management center is determined from among the multiple trusted management centers based on the registration request; Data is exchanged with the target trusted management center based on the trusted long connection.

6. The method according to claim 5, characterized in that Performing data interaction with the target trusted management center based on the trusted long connection includes: The terminal public key certificate is encrypted using a block cipher algorithm with a preset key to generate first encrypted data; wherein the preset key is a default key negotiated between the terminal and the target trusted management center; Sending the first encrypted data to the target trusted management center; so that the target trusted management center decrypts the first encrypted data according to the preset key to obtain the terminal public key certificate for storage; Obtaining second encrypted data generated by the target trusted management center using the preset key to encrypt the management center public key certificate using a block cipher algorithm; Decrypting the second encrypted data based on the preset key to obtain the management center public key certificate; The third encrypted data is generated after signing the terminal data signature public key certificate using the public key in the management center public key certificate; Sending the third encrypted data to the target trusted management center; Obtaining a new encryption factor sent by the target trusted management center; wherein the new encryption factor is verified by the target trusted management center using the management center private key certificate to sign the third encrypted data, and after the signature verification is passed, the new encryption factor is determined based on the terminal data signature public key certificate obtained by the signature verification; Replace the preset key according to the new encryption factor; When the new encryption factor replaces the preset key, data interaction is performed with the target trusted management center based on the trusted long connection.

7. The method according to claim 6, characterized in that Performing data interaction with the target trusted management center based on the trusted long connection includes: In the long connection security channel, data is exchanged with the target trusted management center according to a preset message format; wherein the preset message format includes a data area and data length information, the data length information is used to characterize the length of the data area, and the data area includes a data header and a data body; The data interaction with the target trusted management center is performed according to a preset message format, including: The terminal signs the data body based on the private key, and encrypts the data area using the new encryption factor using a block cipher algorithm to generate a second sending message; The second sending message is sent to the target trusted management center, so that the target trusted management center decrypts based on the new encryption factor and verifies the signature of the data body based on the public key of the terminal.

8. A cluster management device based on a trusted long connection, characterized in that: Applied to a trusted management center cluster, the trusted management center cluster includes at least a front-end server and multiple trusted management centers, and the device includes: An acquisition module, used for the front-end server to acquire a registration request of a terminal; A determination module, configured to determine a target trusted management center among the plurality of trusted management centers based on the registration request; A first connection establishing module, configured to establish a trusted long connection with the terminal when the terminal is successfully registered at the target trusted management center; The first interaction module is used for the target trusted management center to perform data interaction with the terminal based on the trusted long connection.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to implement the cluster management method based on trusted long connection described in any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the cluster management method based on a trusted long connection is implemented as described in any one of claims 1 to 7.

Images