Password service calling system based on network intelligent switching and local escape mechanism

Abstract

The invention discloses a password service calling system based on a network intelligent switching and local escape mechanism, the system comprises a password service request business module, an asynchronous thread module, a metering and counting module, a business gateway and a local password service module, the password service request business module is used for processing a password service request and sending the password service request to the business gateway when a network is abnormal; switching to a local password service module; the asynchronous thread module is used for carrying out calling weight distribution on the probing operation of the password service, and analyzing and judging whether to carry out elastic expansion on the service node or not through the data counted by the metering and counting module; the metering statistical module is used for acquiring a calling log of the service gateway and performing statistical analysis on flow generated in password service calling data; the service gateway undertakes a service routing function and carries out tcp probing operation on the password service node; and the local password service module provides a local password service when the network is abnormal. By using the system, the reliability of password service calling can be improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to a cryptographic service calling system based on network intelligent switching and local escape mechanism. Background Art

[0002] In today's complex network environment, many information systems and applications in industries such as enterprises, medical care, and power need to frequently call cryptographic services to implement operations such as encryption, decryption, signing, and signature verification. These cryptographic services are usually deployed on a dedicated cryptographic service platform. Through network connections, they provide clients with powerful cryptographic computing capabilities and secure key management functions.

[0003] However, current cryptographic service calls are highly dependent on network connections. Once a network failure occurs, such as network interruption, congestion, high latency, or network attacks, the client will not be able to access the remote cryptographic service normally, resulting in a cryptographic service call failure, which in turn cannot guarantee business continuity and stability, and may lead to losses. Summary of the invention

[0004] In view of this, the present invention provides a cryptographic service calling system based on network intelligent switching and local escape mechanism, which can well solve the above technical problems.

[0005] To achieve the above purpose, the technical solution adopted by the present invention is: a cryptographic service calling system based on network intelligent switching and local escape mechanism, the system comprising: a cryptographic service request business module, an asynchronous thread module, a metering and statistics module, a business gateway and a local cryptographic service module, wherein:

[0006] The cryptographic service request business module is used to process cryptographic service requests and switch to the local cryptographic service module when the network is abnormal;

[0007] The asynchronous thread module is used to perform the detection operation of the cryptographic service, perform call weight allocation, and analyze and determine whether to elastically expand the service node based on the data obtained by the measurement and statistics module;

[0008] The metering and statistics module is used to obtain the call log of the service gateway and perform statistical analysis on the traffic generated in the cryptographic service call data;

[0009] The service gateway is used to assume the function of service routing and perform TCP detection operations on the cryptographic service node;

[0010] The local password service module is used to call the local password service when the network is abnormal.

[0011] In an optional implementation, the asynchronous thread module includes: a daemon thread unit, a linear programming weight allocation unit and an elastic expansion unit, wherein:

[0012] The daemon thread unit periodically detects the cryptographic service status, and when it detects that a cryptographic service is unavailable, temporarily removes the cryptographic service node from the call list;

[0013] The linear programming weight allocation unit dynamically allocates weights according to the performance data of the cryptographic service node;

[0014] The elastic expansion unit determines the elastic expansion opportunity according to the dynamic changes of the business load and adjusts the number of instances and resource allocation of the cryptographic server.

[0015] In an optional implementation, the linear programming weight allocation unit dynamically allocates weights according to the performance data of the cryptographic service node through a linear regression algorithm, and the specific process includes:

[0016] 1) Collect the historical performance data of each cryptographic service node, select the connection time x1, request time x2, response time x3, data packet size x4, request error rate x5, number of requests x6, network bandwidth x7 as features, i.e., independent variables; record the historical weight y corresponding to each node as the dependent variable; perform Z-score standardization on the collected data; for each feature x i , and its standardized value is:

[0017]

[0018] Among them, x' i is the value after feature normalization, is the mean of the feature, σ i is the standard deviation, i represents the i-th feature, i∈[1,2,3,...,7];

[0019] 2) Using the processed data, the least squares method is used to estimate the values ​​of regression coefficients β0, β1, …, β7, that is, to minimize the objective function:

[0020] Where n is the number of samples in the dataset, x ij represents the ith eigenvalue of the node at the jth call, y j Represents the weight at the jth call;

[0021] 3) Predict the weight of the cryptographic service, and assume that the feature value of the node obtained in real time is Prediction weight The calculation formula is:

[0022]

[0023] Continuously make predictions and adjustments based on the constantly updated real-time data, so that the weight distribution of cryptographic service nodes is adjusted according to the actual operating conditions.

[0024] In an optional implementation, the elastic expansion unit determines the elastic expansion timing by moving average calculation according to the dynamic change of the business load. The specific method of moving average calculation includes:

[0025] Set the window size according to the actual business traffic. For traffic data, the traffic moving average MA of t minutes F,t The calculation formula is:

[0026]

[0027] Among them, F o is the flow rate in the oth minute, c is the window size;

[0028] TPS peak moving average MA in t minutes TPSP,t , flow rate peak MA V,t , Average request time MA RAT,t , request maximum time MA RMT,t , calculated by the following formula:

[0029]

[0030] Among them, TPSP o 、V o , RAT o 、RMT o They represent the TPS peak, flow rate peak, average request duration, and maximum request duration in the oth minute respectively.

[0031] In an optional embodiment, in the system, thresholds are set for indicators, and the relationship between the moving average of each indicator and the corresponding threshold is checked at intervals; based on the relationship between the moving average of the indicator and the corresponding threshold, new cryptographic service nodes are added to the service call list and initial call weights are assigned, or capacity reduction operations are performed to temporarily remove the previously added new cryptographic service nodes.

[0032] In an optional embodiment, in the system, the indicator threshold is set to 80%. When two or more of the indicators increase in two consecutive inspection cycles, a new cryptographic service node is added to the service call list and an initial call weight is assigned; when three or more of the indicators decrease in two consecutive inspection cycles, a capacity reduction operation is performed to temporarily remove the previously added new cryptographic service node.

[0033] In an optional implementation, in the system, when the TCP detection of the daemon thread unit or the service gateway fails, the detected cryptographic service node is temporarily removed from the call list; if the weight of each cryptographic service node in the call list is lower than the weight threshold or the cryptographic service call list is empty, it is determined that the current network has serious fluctuations or network anomalies, and the escape strategy is enabled to convert the call to the cryptographic service to a call to the local cryptographic service to ensure the normal operation of the business; and in the next detection cycle, if a normal cryptographic service node is found, it is re-added to the call list and the default weight is reallocated, and subsequent calls are now changed from local cryptographic services to cryptographic service node calls.

[0034] In an optional implementation, the local cryptographic service module is developed based on jce and encapsulates the national cryptographic algorithms of sm2 and sm4.

[0035] Compared with the prior art, the present invention has at least the following beneficial technical effects:

[0036] 1. Strong ability to cope with network failures: In a complex and unstable network environment, when part of the network is interrupted, congested, highly delayed, or attacked, the system can quickly detect and switch to an available network connection or node to ensure that the call of cryptographic services is not affected, greatly improving the reliability of cryptographic service calls, thereby ensuring business continuity and stability and avoiding losses.

[0037] 2. Dynamic adjustment to avoid waste of resources: Automatically adjust the number of cryptographic service instances called according to dynamic changes in business load; be able to flexibly respond to cryptographic service needs in different business scenarios and avoid possible waste of resources in cryptographic service calling solutions.

[0038] 3. Multi-node configuration ensures high-availability calls: The present invention supports the simultaneous configuration of multiple cryptographic service node IPs. Combined with the triple network detection solution, it can select available service nodes from multiple nodes for calling; even if some nodes or networks have problems, there are still other nodes that can provide cryptographic services, thereby ensuring the high availability of cryptographic services in various complex network environments and meeting the needs of many information systems and applications for frequent cryptographic service calls.

[0039] 4. Local escape mechanism ensures uninterrupted business: When an overall network anomaly occurs, causing all remote cryptographic services to be inaccessible, the present invention uses the local escape mechanism to be able to start in time, and by calling the local cryptographic service, ensure that the business can continue to perform cryptographic-related operations such as encryption and decryption during the network failure.

[0040] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0041] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0044] Figure 1 A schematic diagram of the structure of a cryptographic service calling system based on network intelligent switching and local escape mechanism provided in an embodiment of the present invention.

[0045] Figure 2 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0047] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0048] First, the abbreviations and key term definitions involved in the present invention are introduced:

[0049] Cryptographic service node: A cryptographic device or server that is specially deployed for cryptographic services. It has cryptographic computing capabilities and key management functions, and provides cryptographic services such as encryption, decryption, signing, and signature verification to clients.

[0050] High availability: refers to the ability of a system or service to continue to operate normally for a long period of time, and to maintain accessibility and functionality in the face of various failures, errors or abnormal situations, thereby minimizing the impact on the business.

[0051] Network liveness detection: refers to the process of detecting the survival status of cryptographic service nodes in the network and evaluating service availability through a series of technical means.

[0052] Intelligent network switching: A method that uses rules and model predictions to intelligently switch cryptographic service call strategies between multiple cryptographic service nodes based on network conditions and node performance through multiple means such as daemon thread timing detection, dynamic weight allocation, and TCP detection of business gateways to ensure high availability of cryptographic services.

[0053] Daemon thread: An asynchronous thread in the cryptographic service call system that is specifically used to periodically detect the status of the cryptographic service. It can promptly detect node failures and handle related request transfers.

[0054] Weight: A value assigned to a cryptographic service node through a linear regression algorithm based on factors such as connection time, request time, response time, and packet size. It is used to measure the performance and availability of the node to determine the allocation of cryptographic service calls.

[0055] Business Gateway: As the entry and hub for cryptographic service calls, it is responsible for coordinating the interaction between the client and the cryptographic service node, including starting TCP live detection tasks to grasp the node status and other functions. The business gateway can be implemented through nginx or apisix.

[0056] Metering and statistics module: a module used to count the data related to the cryptographic service call in the present invention. In the present invention, the module is used to pull the business gateway log and implement statistical analysis. Metering and statistics can be implemented through middleware including but not limited to ilogtail. It uses advanced technology to optimize the data collection process, effectively reduce resource usage in the face of high concurrency and large-scale data scenarios, and quickly and stably obtain log information.

[0057] Local escape mechanism: When all cryptographic service nodes are unavailable or the network fluctuates severely, it is activated and the cryptographic service provided within the solution is called to achieve seamless switching from remote cryptographic service calls to local cryptographic services to ensure business continuity.

[0058] Linear regression algorithm: A statistical method for analyzing the linear relationship between variables. In this invention, it is used to determine the weight of the cryptographic service node based on multiple variables such as connection time, request time, response time, packet size, etc. By establishing a linear model, the algorithm can quantitatively evaluate the relationship between these factors and node performance, thereby providing a scientific basis for the dynamic allocation of weights to optimize the selection of cryptographic service nodes.

[0059] Key management function: The ability of a cryptographic service node to generate, store, distribute, update, revoke, and perform other operations on keys.

[0060] Elastic expansion: refers to the ability and mechanism of the metering and statistics module in the present invention to automatically and flexibly adjust the number of instances and resource allocation of the cryptographic server according to the dynamic changes in the business load.

[0061] JCE: JCE (Java Cryptography Extension) is a powerful cryptography extension framework under the Java platform. It provides many cryptography-related functions, covering encryption, decryption, key generation and management, digital signatures, message authentication codes and other operations. In the present invention, the local cryptographic service is implemented based on JCE, and the local escape mechanism is activated when all service node networks are unavailable or network fluctuations occur. In addition, based on the traditional JCE, the present invention additionally expands the national secret algorithms, such as SM2, SM4, etc.

[0062] Multithreading technology: specifically refers to the ability to recalculate the weight of the cryptographic service node in the background according to a certain time period without blocking the main thread (i.e. the main business process called by the cryptographic service).

[0063] TCP protocol technology: Establish a business gateway and start the TCP live detection task synchronously when initiating the first cryptographic service call. TCP is a reliable connection-oriented transport layer protocol with high detection efficiency and high reliability. In the field of network communication, TCP is used to ensure reliable data transmission and connection stability.

[0064] Load balancing: A technology that evenly distributes workloads (such as network traffic, computing tasks, etc.) to multiple resources (such as servers, computing nodes). It intelligently schedules requests to avoid overloading a single resource while other resources are idle, thereby improving the overall performance and resource utilization of the system.

[0065] The principles and specific implementation methods of the present invention are introduced below:

[0066] 1. Overall system architecture:

[0067] See also Figure 1As shown, an embodiment of the present invention provides a cryptographic service calling system based on network intelligent switching and local escape mechanism, the system comprising: a cryptographic service request business module, an asynchronous thread module, a metering and statistics module, a business gateway and a local cryptographic service module, wherein:

[0068] In this system architecture, the processing of cryptographic service requests is mainly handled by the cryptographic service request business module. At the same time, the asynchronous thread module plays a key role in ensuring the reliability and efficiency of cryptographic services. It implements multiple important functions, including the detection of cryptographic services to ensure the availability of services; the allocation of call weights to optimize the use of service resources; and the determination of whether elastic expansion is needed to ensure that the system can be flexibly adjusted according to load conditions.

[0069] The metering and statistics module has close data interaction with various parts of the system. This module obtains the call log of the gateway and performs statistical analysis at certain time intervals. The statistical analysis is mainly based on real-time request data, which is aggregated according to minutes, hours, and days to calculate the average, maximum, and minimum values. The asynchronous thread module uses a linear programming algorithm to dynamically allocate cryptographic service weights for parameters such as requests, response time, and request body size in statistical data. This dynamic allocation mechanism can reasonably adjust the weights of each service node according to the actual service situation to ensure service quality. In addition, the asynchronous thread module analyzes the peak traffic and average traffic obtained by the metering and statistics module to determine whether it is necessary to elastically expand the service node.

[0070] The service gateway not only assumes the function of service routing, but also performs TCP detection operations on the cryptographic service node. When the triple network detection mechanism composed of the service gateway and the daemon thread of the asynchronous thread module and the linear programming weight allocation determines that the overall network is abnormal, the cryptographic service business request module will immediately trigger the escape mechanism, that is, switch to the local cryptographic service module.

[0071] The local password service module is developed based on jce, but it additionally encapsulates national secret algorithms such as sm2 and sm4 on top of the encryption, decryption and signature verification algorithms implemented by jce. This jce expands the functions of the original jce, enriching its support for national secret algorithms while ensuring the previous functions. When the triple network detection mechanism determines that the network is restored, it will automatically switch from the local password service to the password service call.

[0072] Second, triple network detection mechanism:

[0073] The triple network detection mechanism is implemented based on the following technical solutions:

[0074] 1. The daemon thread unit periodically detects the status of the cryptographic service. When a cryptographic service is detected to be unavailable, the cryptographic service node is temporarily removed from the call list. If a request for the current node is found, the daemon thread unit will stop the request in time and re-initiate a request to a healthy node. This method is mainly implemented by calling the random number interface of the cryptographic service. When no response is obtained or the response times out, the cryptographic service node is considered unhealthy and the node is temporarily removed from the call list.

[0075] 2. Use artificial intelligence technology to build an intelligent cryptographic service node weight allocation module (i.e., linear programming weight allocation unit) to achieve dynamic autonomous learning and optimal allocation of weights to achieve efficient use of service resources. In this invention, a linear regression algorithm is used to dynamically allocate weights based on factors such as connection time, request time, response time, and data packet size, thereby optimizing the use of service resources. The specific process is as follows:

[0076] 2.1) The weight allocation module automatically collects the historical performance data of each cryptographic service node in the metering and statistics module. In the present invention, connection time (x1), request time (x2), response time (x3), data packet size (x4), request error rate (x5), number of requests (x6), and network bandwidth (x7) are selected as independent variables (features), and the historical weight (y) corresponding to each node is recorded as the dependent variable.

[0077] Collect relevant data for each request of each node within half an hour. For example, for a specific node, the collected data is as follows (x 11, x 21, x 31, x 41, x 51, x 61, x 71, y1),(x 12, x 22, x 32, x 42, x 52, x 62, x 72, y2), ..., where x ij represents the ith eigenvalue of the node at the jth call, y j Indicates the weight at the jth call. Then, to prevent the excessive impact of some features on the model due to the large range of values, the collected data is normalized by Z-score. For each feature x i , i represents the i-th feature, i∈[1,2,3,...,7]; its standardized value is:

[0078]

[0079] Among them, x' i is the value after feature normalization, is the mean of the feature, σ i is the standard deviation.

[0080] 2.2) Model training is performed by using the collected and preprocessed data set and the least squares method in the artificial intelligence algorithm to estimate the values ​​of the regression coefficients β0, β1, ..., β7. The goal of the least squares method is to minimize the sum of squared errors between the weights predicted by the model and the actual weights, that is, to minimize the following objective function:

[0081]

[0082] Where n is the number of samples in the data set. During the training process, the system can continuously adjust the regression coefficients based on the relationship between data features and weights, thereby achieving self-optimization and learning evolution of the model.

[0083] 2.3) The cryptographic service weight is predicted every minute through an asynchronous thread. Assume that the feature value of the node obtained in real time is The prediction weight The calculation formula is:

[0084]

[0085] The system continuously makes predictions and adjustments based on real-time data that is continuously updated every minute, so that the weight distribution of cryptographic service nodes can flexibly change according to the actual operating conditions to adapt to the complex and changeable network environment and service requirements, and continuously improve the overall service resource utilization efficiency and service quality. Moreover, with the continuous accumulation and processing of data, the model's prediction accuracy and the rationality of weight distribution will continue to improve, realizing the system's autonomous learning and evolution capabilities.

[0086] 3. Through the business gateway, when the first cryptographic service call is initiated, the TCP detection task is started synchronously. With its excellent detection efficiency and high reliability, TCP detection can quickly and accurately detect cryptographic service nodes. As the entrance and hub for cryptographic service calls, the business gateway can timely grasp the network connectivity and service response capabilities of each node with the help of TCP detection.

[0087] 3. Elastic expansion:

[0088] In the embodiment of the present invention, the metering and statistics module can count the traffic generated in the cryptographic service call data. In the present invention, the traffic aggregated by minute, TPS peak, flow rate peak, average request time, and maximum request time are mainly counted. Furthermore, the elastic expansion unit in the asynchronous thread module determines the elastic expansion opportunity through moving average calculation;

[0089] In the present invention, if the actual business flow is relatively slow, the window size (c) is set to 30 minutes. If the actual business is highly real-time and the verified data fluctuates greatly, the window size (c) is set to 5 minutes. For flow data, the moving average of the flow in t minutes is:

[0090]

[0091] Among them, F o is the flow rate at minute o.

[0092] Similarly, the TPS peak moving average MA for t minutes TPSP,t , flow rate peak MA V,t , Average request time MA RAT,t , request maximum time MA RMT,t Calculated by the following formulas:

[0093]

[0094] Among them, TPSP o 、V o , RAT o 、RMT o They represent the TPS peak, flow rate peak, average request duration, and maximum request duration in the oth minute respectively.

[0095] In a specific implementation, thresholds are set for the above five indicators. In the present invention, the threshold is set to 80%, that is, attention is paid when the moving average approaches 80% of the system processing capacity.

[0096] Preferably, the elastic expansion asynchronous thread checks the relationship between the moving average of each indicator and the corresponding threshold every five minutes. When two or more of the five indicators rise in two consecutive check cycles, a new service node is added to the service call list and an initial call weight is assigned.

[0097] Preferably, when three or more of the five indicators decrease in two consecutive inspection cycles, a capacity reduction operation is performed to temporarily remove the newly added service nodes.

[0098] 4. Escape strategy:

[0099] In the embodiment of the present invention, if the TCP detection through the daemon thread or the gateway fails, the cryptographic service node will be temporarily removed from the call list. min(set to 5 in the present invention) or the cryptographic service call list is empty, it is considered that the current network has serious fluctuations or network anomalies, and the escape strategy will be enabled to convert all subsequent calls from calling cryptographic services to calling local cryptographic services to ensure normal business operation.

[0100] In the next detection cycle, if a normal node is found, it will be added back to the call list and the default weight (set to 25 in the present invention) will be reallocated. At this time, subsequent calls will be changed from local cryptographic services to cryptographic service node calls.

[0101] V. Specific application examples:

[0102] In the power industry, equipment is usually equipped with dual network cards, which are often called A / B networks. These two network segments play a vital role in ensuring the normal operation of the business. Under normal circumstances, the two network segments work together to ensure smooth data transmission. However, due to the complexity of the network environment, one of the network segments may be abnormal. When this happens, the system must ensure that the other network segment can be called normally without interference to maintain business continuity.

[0103] Furthermore, if an abnormality occurs in both network segments, the system must also have sufficient emergency response capabilities to ensure business continuity. In order to better deal with these potential network risks, the present invention adopts a three-node deployment strategy. Under this strategy, the three nodes have their own division of labor, one of which is set as an expansion node, and the other two nodes are used as normal business nodes to undertake daily business processing work.

[0104] When the first service call is initiated, the service gateway will immediately start the TCP detection mechanism, and at the same time, the daemon thread will also start running. In this process, the system will dynamically allocate weights according to the actual operation of different cryptographic service nodes. This dynamic weight allocation mechanism can adjust the weight of the node in service processing in real time according to factors such as node performance and network connection status, ensuring that the service can run efficiently and stably.

[0105] When a network segment is detected to be abnormal through the triple network detection mechanism, the abnormal network segment will be removed from the call list. This operation can automatically switch subsequent business calls to another normal network segment without affecting the current business. After verification by a large number of actual situations, in the most ideal case, this network switching operation can be completed in a very short time, minimizing the impact of network failures on business.

[0106] When a sharp increase in business volume or a significant increase in traffic is detected, the system will accurately determine whether it is necessary to implement elastic expansion operations on the cryptographic service call nodes based on the preset strategy. In this way, the cryptographic service can always maintain high availability, thereby ensuring the smooth and normal operation of the business.

[0107] When both network segments AB are abnormal, the system will immediately activate the local escape mechanism. This mechanism can quickly call the local password service to ensure that the business will not be interrupted due to the failure of the network segment. After actual verification, this escape strategy can take effect immediately. During the whole process, the business will not have any delays, thus ensuring the continuity and stability of the business and avoiding various losses that may be caused by network failures.

[0108] From the description of the above embodiments, those skilled in the art can know that the present invention provides a cryptographic service calling system based on network intelligent switching and local escape mechanism, and the specific advantages are as follows:

[0109] ① Strong ability to cope with network failures:

[0110] In a complex and unstable network environment, traditional cryptographic service calls are highly dependent on network connections and are prone to call failures due to network problems. This solution uses a triple network detection solution, which can monitor the network status of multiple cryptographic service node IPs in real time through rules + model prediction.

[0111] When part of the network experiences interruptions, congestion, high latency, or attacks, the system can quickly detect and switch to available network connections or nodes to ensure that the call of cryptographic services is not affected, greatly improving the reliability of cryptographic service calls.

[0112] ② Dynamic adjustment to avoid waste of resources:

[0113] Traditional solutions often cannot dynamically adjust the number of cryptographic service instances called according to business load, which may lead to resource waste or insufficient service capacity. This solution can automatically adjust the number of cryptographic service instances called according to the dynamic changes in business load.

[0114] When the business load is low, the number of cryptographic service instances called is reduced to avoid unnecessary resource occupation; when the business load is high, the number of called instances is increased to meet service needs. This dynamic adjustment mechanism effectively improves resource utilization.

[0115] ③Multi-node configuration ensures high availability calls:

[0116] This solution supports configuring multiple cryptographic service node IPs at the same time. Combined with the triple network detection solution, it can select available service nodes from multiple nodes for calling. Even if some nodes or networks have problems, there are still other nodes that can provide cryptographic services, thus ensuring the high availability of cryptographic services in various complex network environments and meeting the needs of many information systems and applications for frequent cryptographic service calls.

[0117] ④ Local escape mechanism ensures uninterrupted business:

[0118] When the overall network is abnormal and all remote password services are inaccessible, the local escape mechanism of this solution can be activated in time. By calling the local password service, it is ensured that the business can continue to perform password-related operations such as encryption and decryption during the network failure.

[0119] Further, refer to Figure 2 As shown, an embodiment of the present invention also provides an electronic device, which uses the above-mentioned cryptographic service calling system based on network intelligent switching and local escape mechanism to ensure that the calling of cryptographic services is not affected. The electronic device includes a processor 10, a memory 11, a communication bus 12 and a communication interface 13, and may also include a computer program stored in the memory 11 and executable on the processor 10.

[0120] The processor 10 may be composed of an integrated circuit in some embodiments, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 10 is the control core (Control Unit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes various functions of the electronic device and processes data by running or executing programs or modules stored in the memory 11 (computer-readable storage medium), and calling data stored in the memory 11.

[0121] Examples of computer-readable storage media include: read-only memory (ROM), random access programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), flash memory, non-volatile memory, CD-ROM, DVD-ROM, Blu-ray or optical disk memory, hard disk drive (HDD), solid state drive (SSD), card memory (such as, multimedia card, secure digital (SD) card or extreme digital (XD) card), magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid state disk and any other device, any of which is configured to store computer programs and any associated data, data files and data structures in a non-temporary manner and provide the computer programs and any associated data, data files and data structures to a processor or computer so that the processor or computer can execute the computer programs. The computer programs in the above-mentioned computer-readable storage media can be run in an environment deployed in a computer device such as a client, a host, an agent device, a server, etc.

[0122] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as products such as software systems or electronic devices. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0123] It should be noted that the word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several distinct components, and by means of a suitably programmed computer.

[0124] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0125] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A cryptographic service calling system based on network intelligent switching and local escape mechanism, characterized in that: The system includes: a cryptographic service request business module, an asynchronous thread module, a metering and statistics module, a business gateway and a local cryptographic service module, wherein: The cryptographic service request business module is used to process cryptographic service requests and switch to the local cryptographic service module when the network is abnormal; The asynchronous thread module is used to perform the detection operation of the cryptographic service, perform call weight allocation, and analyze and determine whether to elastically expand the service node based on the data obtained by the measurement and statistics module; The metering and statistics module is used to obtain the call log of the service gateway and perform statistical analysis on the traffic generated in the cryptographic service call data; The service gateway is used to assume the function of service routing and perform TCP detection operations on the cryptographic service node; The local password service module is used to call the local password service when the network is abnormal.

2. According to claim 1, a cryptographic service calling system based on network intelligent switching and local escape mechanism is characterized in that: The asynchronous thread module includes: a daemon thread unit, a linear programming weight allocation unit and an elastic expansion unit, wherein: The daemon thread unit periodically detects the cryptographic service status, and when it detects that a cryptographic service is unavailable, temporarily removes the cryptographic service node from the call list; The linear programming weight allocation unit dynamically allocates weights according to the performance data of the cryptographic service node; The elastic expansion unit determines the elastic expansion opportunity according to the dynamic changes of the business load and adjusts the number of instances and resource allocation of the cryptographic server.

3. According to claim 2, a cryptographic service calling system based on network intelligent switching and local escape mechanism is characterized in that: The linear programming weight allocation unit dynamically allocates weights according to the performance data of the cryptographic service node through a linear regression algorithm. The specific process includes: 1) Collect the historical performance data of each cryptographic service node, select the connection time x1, request time x2, response time x3, data packet size x4, request error rate x5, number of requests x6, network bandwidth x7 as features, i.e., independent variables; record the historical weight y corresponding to each node as the dependent variable; perform Z-score standardization on the collected data; for each feature x i , and its standardized value is: Among them, x' i is the value after feature normalization, is the mean of the feature, σ i is the standard deviation, i represents the i-th feature, i∈[1,2,3,...,7]; 2) Using the processed data, the least squares method is used to estimate the values ​​of regression coefficients β0, β1, …, β7, that is, to minimize the objective function: Where n is the number of samples in the dataset, x ij represents the ith eigenvalue of the node at the jth call, y j Represents the weight at the jth call; 3) Predict the weight of the cryptographic service, and assume that the feature value of the node obtained in real time is Prediction weight The calculation formula is: Continuously make predictions and adjustments based on the constantly updated real-time data, so that the weight distribution of cryptographic service nodes is adjusted according to the actual operating conditions.

4. According to claim 3, a cryptographic service calling system based on network intelligent switching and local escape mechanism is characterized in that: The elastic expansion unit determines the elastic expansion timing by moving average calculation according to the dynamic change of the business load. The specific method of moving average calculation includes: Set the window size according to the actual business traffic. For traffic data, the traffic moving average MA of t minutes F,t The calculation formula is: Among them, F o is the flow rate in the oth minute, c is the window size; TPS peak moving average MA in t minutes TPSP,t , flow rate peak MA V,t , Average request time MA RAT,t , request maximum time MA RMT,t , calculated by the following formula: Among them, TPSP o 、V o , RAT o 、RMT o They represent the TPS peak, flow rate peak, average request duration, and maximum request duration in the oth minute respectively.

5. According to claim 4, a cryptographic service calling system based on network intelligent switching and local escape mechanism is characterized in that: In this system, thresholds are set for indicators, and the relationship between the moving average of each indicator and the corresponding threshold is checked at intervals; based on the relationship between the moving average of the indicator and the corresponding threshold, new cryptographic service nodes are added to the service call list and initial call weights are assigned, or capacity reduction operations are performed to temporarily remove the previously added new cryptographic service nodes.

6. A cryptographic service calling system based on network intelligent switching and local escape mechanism according to claim 5, characterized in that: In this system, the indicator threshold is set at 80%. When two or more of the indicators rise in two consecutive inspection cycles, a new cryptographic service node is added to the service call list and an initial call weight is assigned; When three or more of the indicators decrease in two consecutive inspection cycles, the capacity reduction operation is performed to temporarily remove the newly added cryptographic service nodes.

7. A cryptographic service calling system based on network intelligent switching and local escape mechanism according to claim 6, characterized in that: In this system, when the TCP detection of the daemon thread unit or the business gateway fails, the detected cryptographic service node is temporarily removed from the call list; if the weight of each cryptographic service node in the call list is lower than the weight threshold or the cryptographic service call list is empty, it is determined that the current network has serious fluctuations or network anomalies, and the escape strategy is enabled to convert the call to the cryptographic service to the call to the local cryptographic service to ensure the normal operation of the business; and in the next detection cycle, if a normal cryptographic service node is found, it will be re-added to the call list and the default weight will be reallocated. At this time, subsequent calls will be changed from local cryptographic services to cryptographic service node calls.

8. According to claim 1, a cryptographic service calling system based on network intelligent switching and local escape mechanism is characterized in that: The local cryptographic service module is developed based on jce and encapsulates the national cryptographic algorithms of sm2 and sm4.

Images