A Linux kernel-based password device master-slave cluster load balancing method

Abstract

The application discloses a kind of based on Linux kernel's cryptographic device master-standby cluster load balancing method, it is related to information security and high-availability cluster technical field, including the following steps: step one, at least one main cryptographic device node is configured with at least one backup cryptographic device node, and cryptographic service program is deployed on all nodes to initialize cluster configuration, Keepalived service module is deployed in main cryptographic device node and backup cryptographic device node, periodically send heartbeat message by groupcast mode, and real-time perception node state;Step two, set up health detection module, and adopt dual detection mechanism of node survival detection and cryptographic service availability detection;It can realize that cryptographic device master-standby automatically switches quickly, load intelligent distribution, security context real-time synchronization, comprehensively improve the availability of cryptographic service, reliability, efficiency and security, meet the high-level security needs of critical information system.

Description

Technical Field

[0001] This invention relates to the field of information security and high availability cluster technology, specifically to a load balancing method for a primary / backup cluster of cryptographic devices based on the Linux kernel. Background Technology

[0002] In critical information systems, cryptographic devices are core components that ensure the security of data transmission and storage. Their service continuity directly determines the availability of the entire system. With the surge in business data volume and the increase in security requirements, the processing capacity and single point of failure risk of a single cryptographic device can no longer meet the needs of actual applications. Therefore, the clustered deployment of cryptographic devices has become the mainstream solution.

[0003] Existing cryptographic device cluster deployments mainly adopt dual-machine hot standby or dual-machine cold standby modes, but both have significant drawbacks: In the dual-machine hot standby mode, both cryptographic devices need to provide services to the outside world at the same time, requiring the upper-layer business system to send data to both devices and maintain the primary and backup status at the same time, which greatly increases the implementation complexity and power consumption of the business system; In the dual-machine cold standby mode, the backup machine is in a power-off state, and when the primary machine fails, the backup machine must be powered on first before the switchover is completed, resulting in excessively long service interruption time, which cannot meet the business scenarios with high real-time requirements.

[0004] Therefore, in view of this, the present invention proposes a load balancing method for master-slave clusters of cryptographic devices based on the Linux kernel to make up for and improve the shortcomings of the existing technology. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a Linux kernel-based primary / standby cluster load balancing method for cryptographic devices. This method enables automatic and rapid switching between primary and standby cryptographic devices, intelligent load distribution, and real-time synchronization of security contexts, comprehensively improving the availability, reliability, efficiency, and security of cryptographic services and meeting the high-level security requirements of critical information systems.

[0006] To achieve the above objectives, the technical solution adopted by this invention is: a load balancing method for a primary / standby cluster of cryptographic devices based on the Linux kernel, comprising the following steps: Step 1: Configure at least one primary cryptographic device node and at least one backup cryptographic device node, and deploy cryptographic service programs that support core cryptographic operations such as encryption / decryption and signature verification on all nodes to initialize the cluster configuration. Deploy the Keepalived service module on both the primary and backup cryptographic device nodes, and periodically send heartbeat messages via multicast to monitor the node status in real time. Step 2: Set up a health check module and adopt a dual check mechanism of node liveness check and password service availability check. The password service process status is checked periodically by executing a check script, and the node priority is adjusted according to the check results. Step 3: Deploy a security synchronization module on both the primary cryptographic device node and the backup cryptographic device node, and build an encrypted transmission channel based on the SSL protocol. The primary cryptographic device node writes the real-time updated security context data to the shared storage module, and the backup cryptographic device node completes the synchronization update of local data by periodically reading the data from the shared storage module. Step 4: Configure the load balancing scheduling module to achieve intelligent allocation of traffic between primary and backup nodes and seamless migration in case of failure. It works in real time with the health detection module and Keepalived service module. When a node fails, it stops allocating requests to the failed node and migrates traffic to the healthy node.

[0007] As a preferred option, In step one, The VIP is located on the primary cryptographic device node, undertakes all cryptographic service requests and distributes the requests to the backup cryptographic device node for processing through the load balancing scheduling module. The backup cryptographic device node synchronizes the security context data of the primary cryptographic device node in real time and is in a ready state. The election and state synchronization of primary and backup nodes are completed based on the VRRP protocol. The core parameters of the Keepalived service module are set for cluster management, including virtual route ID and node priority. The primary cryptographic device node has a higher priority than the backup cryptographic device node.

[0008] As a preferred option, In step two, When the detection result is abnormal, the priority of the faulty node is automatically reduced to provide a basis for judgment in the subsequent primary / backup switchover.

[0009] As a preferred option, In step three, The security context data includes the session key and the business session status; The shared storage module uses distributed storage nodes and is used to store the security context data required for master-slave failover.

[0010] As a preferred option, In step one, It also includes a virtual IP management module that is uniformly managed by the Keepalived service module. The virtual IP management module is used to allocate a unique virtual IP to the primary and backup clusters as an external service entry point. When the master cryptographic device node is operating normally, the virtual IP is bound to the master cryptographic device node; When the primary cryptographic device node fails, the virtual IP automatically migrates to the backup cryptographic device node. The backup cryptographic device node immediately takes over all cryptographic service requests and continues to distribute tasks to other healthy backup cryptographic device nodes through the load balancing scheduling module, enabling seamless access to cryptographic services by upper-layer business systems.

[0011] As a preferred option, In step four, The load balancing scheduling module allocates cryptographic service requests according to node weights, supports weighted round-robin algorithms, and allows manual configuration of weights to adapt to the differences in hardware performance between primary and backup nodes. When the primary cryptographic device node is operating normally, it undertakes all cryptographic service requests and distributes the tasks to the backup cryptographic device nodes through the load balancing scheduling module.

[0012] Compared with existing technologies, the beneficial effects of this invention are as follows: It deeply integrates Linux kernel high-performance load balancing technology, Keepalived high availability technology, and cryptographic device clusters to construct a full-link optimization system of "precise perception, efficient scheduling, secure synchronization, and flexible expansion"; it adopts dual detection of "node liveness + service availability" to avoid fault omissions in single heartbeat detection, ensuring reliable cluster status perception; it incorporates dynamic load scheduling, achieving smooth load migration synchronously during primary / backup switching; it combines the VRRP protocol to build a unified virtual IP entry point, enabling seamless switching within 1 second without business system adaptation, improving switching efficiency and resource utilization, and solving load accumulation bottlenecks; it ensures consistent and secure security context data through primary write / backup read permission control and encrypted synchronization, filling the synchronization shortcomings of existing technologies; it supports elastic deployment with one primary and multiple backups, enabling multi-node election through priority configuration, and allowing customized detection scripts to adapt to different cryptographic devices, improving cluster scalability and compatibility. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the overall structure of a preferred embodiment of the present invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] Embodiments of the present invention: Please refer to Figure 1 As shown, a load balancing method for a primary / standby cluster of cryptographic devices based on the Linux kernel includes the following steps: Step 1: Configure at least one primary cryptographic device node and at least one backup cryptographic device node, and deploy cryptographic service programs that support core cryptographic operations such as encryption / decryption and signature verification on all nodes to initialize the cluster configuration. Deploy the Keepalived service module on both the primary and backup cryptographic device nodes, and periodically send heartbeat messages via multicast to monitor the node status in real time. Step 2: Set up a health check module and adopt a dual check mechanism of node liveness check and password service availability check. The password service process status is checked periodically by executing a check script, and the node priority is adjusted according to the check results. Step 3: Deploy a security synchronization module on both the primary cryptographic device node and the backup cryptographic device node, and build an encrypted transmission channel based on the SSL protocol. The primary cryptographic device node writes the real-time updated security context data to the shared storage module, and the backup cryptographic device node completes the synchronization update of local data by periodically reading the data from the shared storage module. Step 4: Configure the load balancing scheduling module to achieve intelligent allocation of traffic between primary and backup nodes and seamless migration in case of failure. It works in real time with the health detection module and Keepalived service module. When a node fails, it stops allocating requests to the failed node and migrates traffic to the healthy node.

[0016] In step one, The VIP is located on the primary cryptographic device node, undertakes all cryptographic service requests and distributes the requests to the backup cryptographic device node for processing through the load balancing scheduling module. The backup cryptographic device node synchronizes the security context data of the primary cryptographic device node in real time and is in a ready state. The election and state synchronization of primary and backup nodes are completed based on the VRRP protocol. The core parameters of the Keepalived service module are set for cluster management, including virtual route ID and node priority. The primary cryptographic device node has a higher priority than the backup cryptographic device node.

[0017] In step two, When the detection result is abnormal, the priority of the faulty node is automatically reduced to provide a basis for judgment in the subsequent primary / backup switchover.

[0018] In step three, The security context data includes the session key and the business session status; The shared storage module uses distributed storage nodes and is used to store the security context data required for master-slave failover.

[0019] In step one, It also includes a virtual IP management module that is uniformly managed by the Keepalived service module. The virtual IP management module is used to allocate a unique virtual IP to the primary and backup clusters as an external service entry point. When the master cryptographic device node is operating normally, the virtual IP is bound to the master cryptographic device node; When the primary cryptographic device node fails, the virtual IP automatically migrates to the backup cryptographic device node. The backup cryptographic device node immediately takes over all cryptographic service requests and continues to distribute tasks to other healthy backup cryptographic device nodes through the load balancing scheduling module, enabling seamless access to cryptographic services by upper-layer business systems.

[0020] In step four, The load balancing scheduling module allocates cryptographic service requests according to node weights, supports weighted round-robin algorithms, and allows manual configuration of weights to adapt to the differences in hardware performance between primary and backup nodes. When the primary cryptographic device node is operating normally, it undertakes all cryptographic service requests and distributes the tasks to the backup cryptographic device nodes through the load balancing scheduling module.

[0021] By deeply integrating load balancing and high availability technologies with cryptographic device clusters, and leveraging dual detection, load scheduling, security synchronization, and elastic deployment, we can overcome existing bottlenecks in cluster detection and switching, improve the reliability of cryptographic services, and achieve seamless business integration.

[0022] In this embodiment, the present invention consists of primary and backup cryptographic device nodes, a Keepalived service module, a health detection module, a security synchronization module, a shared storage module, a virtual IP management module, and a load balancing scheduling module. The core of the invention is to achieve primary and backup switching, dynamic load balancing, and security assurance through the collaboration of Keepalived and the node load awareness mechanism. Furthermore, the present invention has the following advantages: Achieve automatic and rapid primary / backup failover: Based on Keepalived's VRRP protocol and dual health check mechanism, it can accurately identify password service failures, with a fast failover response speed. The entire failover process takes ≤1 second, effectively ensuring the continuity of business services.

[0023] Reduce the complexity of business systems: By building a unified service entry point through virtual IP, the upper-layer business systems do not need to maintain the status of primary and backup nodes, and no access configuration needs to be modified during the switchover process, which solves the problem of high complexity in business system development and operation and maintenance.

[0024] Ensuring data consistency and security: Real-time synchronization of security contexts is achieved through encrypted transmission channels and shared storage modules to ensure the continuity and consistency of business data processing after the switchover.

[0025] Flexible and scalable configuration: It supports a cluster deployment architecture with one master and multiple backups, and can flexibly increase the number of backup nodes according to business reliability requirements. By adjusting the Keepalived priority, it can achieve multi-node master-slave election, further improving cluster reliability. It supports custom health detection scripts, which can adapt to the service detection requirements of different models and types of cryptographic devices.

[0026] By deeply integrating Linux kernel high-performance load balancing technology, Keepalived high availability technology, and cryptographic device clusters, a full-link optimization system of "precise perception, efficient scheduling, secure synchronization, and flexible expansion" is constructed. Dual detection of "node liveness + service availability" avoids the failure omissions of single heartbeat detection, ensuring reliable cluster status perception. Dynamic load scheduling is incorporated, enabling smooth load migration during primary / standby switching. A unified virtual IP entry point is built using the VRRP protocol, allowing seamless switching within one second without business system adaptation, improving switching efficiency and resource utilization, and resolving load accumulation bottlenecks. Primary write / standby read permission control and encrypted synchronization ensure consistent and secure security context data, filling the synchronization shortcomings of existing technologies. Elastic deployment with one primary and multiple standby nodes is supported, enabling multi-node election through priority configuration and custom detection scripts adapted to different cryptographic devices, improving cluster scalability and compatibility.

[0027] In summary, this invention overcomes the core bottlenecks of existing cryptographic device clusters in terms of detection, switching, synchronization, and expansion, significantly improving the availability, security, and stability of cryptographic services, and adapting to the high-level requirements of critical information infrastructures such as finance and government.

[0028] The size of the interval and threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by those skilled in the art for each set of sample data; as long as it does not affect the ratio between the parameter and the quantized value.

[0029] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation. In the two embodiments provided in this application, it should be understood that the disclosed apparatus and system can be implemented in other ways; for example, the apparatus embodiments described above are merely illustrative, and the division of modules is merely a logical functional division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed; furthermore, the coupling or direct coupling or communication connection between the shown or discussed mutuals can be through some interfaces, and the indirect coupling or communication connection between the apparatus or modules can be electrical, mechanical or other forms. The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A load balancing method for a primary / standby cluster of cryptographic devices based on the Linux kernel, characterized in that, Includes the following steps: Step 1: Configure at least one primary cryptographic device node and at least one backup cryptographic device node, and deploy the cryptographic service program on all nodes to initialize the cluster configuration. Deploy the Keepalived service module on both the primary and backup cryptographic device nodes, and periodically send heartbeat messages via multicast to monitor the node status in real time. Step 2: Set up a health check module and adopt a dual check mechanism of node liveness check and password service availability check. The password service process status is checked periodically by executing a check script, and the node priority is adjusted according to the check results. Step 3: Deploy a security synchronization module on both the primary cryptographic device node and the backup cryptographic device node, and build an encrypted transmission channel based on the SSL protocol. The primary cryptographic device node writes the real-time updated security context data to the shared storage module, and the backup cryptographic device node completes the synchronization update of local data by periodically reading the data from the shared storage module. Step 4: Configure the load balancing scheduling module to achieve intelligent allocation of traffic between primary and backup nodes and seamless migration in case of failure. It works in real time with the health detection module and Keepalived service module. When a node fails, it stops allocating requests to the failed node and migrates traffic to the healthy node.

2. The method for load balancing of a primary / standby cluster of cryptographic devices based on the Linux kernel according to claim 1, characterized in that, In step one, The VIP is located on the primary cryptographic device node, undertakes all cryptographic service requests and distributes the requests to the backup cryptographic device node for processing through the load balancing scheduling module. The backup cryptographic device node synchronizes the security context data of the primary cryptographic device node in real time and is in a ready state. The election and state synchronization of primary and backup nodes are completed based on the VRRP protocol. The core parameters of the Keepalived service module are set for cluster management, including virtual route ID and node priority. The primary cryptographic device node has a higher priority than the backup cryptographic device node.

3. The method for load balancing of a primary / standby cluster of cryptographic devices based on the Linux kernel according to claim 1, characterized in that, In step two, When the detection result is abnormal, the priority of the faulty node is automatically reduced to provide a basis for judgment in the subsequent primary / backup switchover.

4. The method for load balancing of a primary / standby cluster of cryptographic devices based on the Linux kernel according to claim 1, characterized in that, In step three, The security context data includes the session key and the business session status; The shared storage module uses distributed storage nodes and is used to store the security context data required for master-slave failover.

5. A load balancing method for a primary / standby cluster of cryptographic devices based on the Linux kernel, as described in claim 2, is characterized in that... In step one, It also includes a virtual IP management module that is uniformly managed by the Keepalived service module. The virtual IP management module is used to allocate a unique virtual IP to the primary and backup clusters as an external service entry point. When the master cryptographic device node is operating normally, the virtual IP is bound to the master cryptographic device node; When the primary cryptographic device node fails, the virtual IP automatically migrates to the backup cryptographic device node. The backup cryptographic device node immediately takes over all cryptographic service requests and continues to distribute tasks to other healthy backup cryptographic device nodes through the load balancing scheduling module, enabling seamless access to cryptographic services by upper-layer business systems.

6. The method for load balancing of a primary / standby cluster of cryptographic devices based on the Linux kernel according to claim 1, characterized in that, In step four, The load balancing scheduling module allocates cryptographic service requests according to node weights, supports weighted round-robin algorithms, and allows manual configuration of weights to adapt to the differences in hardware performance between primary and backup nodes. When the primary cryptographic device node is operating normally, it undertakes all cryptographic service requests and distributes the tasks to the backup cryptographic device nodes through the load balancing scheduling module.

Images