A load balancing method for server cryptographic machine

Abstract

The invention discloses a load balancing method for a server cryptographic machine, which is based on a server cryptographic machine cluster formed by a plurality of server cryptographic machines, and includes the following steps: S1: request cryptographic calculation; S2: allocate server cryptographic machines; S3: if the server cryptographic machine A to which the key belongs has insufficient resources, obtain the key from the server cryptographic machine A; S4: the server cryptographic machine A returns the ciphertext a of the key; S5: select a server cryptographic machine B with sufficient resources, forward the request, and attach the key ciphertext a; S6: the server cryptographic machine B decrypts the key ciphertext a and stores it in a temporary index x; S7: use the temporary index x to perform cryptographic calculation; S8: return the cryptographic calculation result. The invention can not only allocate cryptographic calculation to different cryptographic cards, obtain the expansion of the calculation capacity of multiple cryptographic cards, but also ensure that the cryptographic calculation is performed in the cryptographic card, thereby ensuring that the key plaintext does not appear in the memory of the server cryptographic machine in all processes.

Description

Technical Field

[0001] The present invention relates to the technical field of information security, and in particular to a load balancing method for a server cryptographic machine. Background Art

[0002] At present, the main key storage and password calculation of the server cryptographic machine are all performed in the password card. The password calculation capability of a single password card is limited. In this case, it is necessary to use multiple password cards to set up multiple server cryptographic machines to expand their computing power.

[0003] Increasing the overall computing power through multiple password cards also faces the following problem: the key is stored in the specified password card, and other password cards cannot use the key for password calculation. This makes the password calculation return to the password card that stores the corresponding key, resulting in load balancing failure and failure to expand the overall computing power of the system. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a load balancing method for a server cryptographic machine, which can expand the computing capabilities of multiple cryptographic cards.

[0005] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows.

[0006] A method for load balancing of a server cryptographic machine includes a server cryptographic machine cluster formed by a plurality of server cryptographic machines, wherein the method includes the following steps:

[0007] S1: Calculation request user, requesting password calculation;

[0008] S2: Load balancing distribution service, to distribute server cryptographic machines, first read record M, determine whether the server cryptographic machine A to which the key belongs has sufficient resources, if sufficient, directly distribute it to server cryptographic machine A;

[0009] S3: If the resources are insufficient, obtain the key from server cipher machine A;

[0010] S4: Server cipher machine A returns the ciphertext a of the key, which is encrypted by key index x;

[0011] S5: Load balancing distribution service, selects a server cipher machine B with sufficient resources, forwards the request, and attaches the key ciphertext a;

[0012] S6: Server cipher machine B distributes the cipher card, decrypts the key ciphertext a and stores it in the temporary index x;

[0013] S7: The password card uses the temporary index x to replace the index in record M to calculate the password;

[0014] S8: Server cryptographic machine B returns the cryptographic calculation result to the calculation requesting user and deletes the temporary index x.

[0015] Preferably, each of the password cards is provided with a key index x and a computing capability reserved for trans-encryption; the key index x of all the password cards stores the same key Y used for trans-encryption, and a set of records M are made for recording the location of the key used for the calculation request.

[0016] Preferably, the record M includes a user key identifier, a server cryptographic machine identifier, a password card identifier and a key index; the user key identifier is used to identify the key and is generated by the server cryptographic machine. Each user obtains multiple keys by having multiple user key identifiers. The server cryptographic machine binds the server cryptographic machine, the password card and the key index through the user key identifier; the server cryptographic machine identifier is used to identify the identifier of the server cryptographic machine where the key used for the user password calculation request is located; the password card identifier is used to identify the identifier of the password card where the key used for the user password calculation request is located.

[0017] Preferably, the server cryptographic machine cluster deployment scheme adopts a multi-active mode, that is, multiple nodes provide services simultaneously in a peer-to-peer mode, and each server cryptographic machine has load distribution and cryptographic service capabilities; the server cryptographic machine uses three networks for different communications, namely, a cryptographic service network, a cluster network and a load distribution network; the cryptographic service network provides cryptographic computing services to the outside world, the cluster network provides cluster establishment communication between server cryptographic machines, and the load distribution network provides scheduling communication within the server cryptographic machine cluster.

[0018] Preferably, the server cryptographic machine cluster formation strategy adopts a multicast / broadcast mode. Each server cryptographic machine connects to the same message queue Q, binds to the same exchange EX, generates a queue t, and sends its own machine's key and key index information to the exchange EX in a broadcast mode, so that each node can obtain a copy of the key information of the entire cluster.

[0019] Preferably, the load balancing strategy adopts a peer-to-peer contention strategy with priority.

[0020] Due to the adoption of the above technical scheme, the technical progress achieved by the present invention is as follows.

[0021] The present invention can not only distribute cryptographic calculations to different cryptographic cards to expand the computing capabilities of multiple cryptographic cards, but also ensure that cryptographic calculations are performed in the cryptographic cards, thereby ensuring that the key plaintext does not appear in the memory of the server cryptographic machine during all processes. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1It is a structural block diagram of the record M of the present invention;

[0023] Figure 2 This is a schematic diagram of the deployment of a server cryptographic machine cluster of the present invention;

[0024] Figure 3 It is a schematic diagram of message distribution principle of the present invention;

[0025] Figure 4 This is a load balancing flow chart of the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0027] A load balancing method for a server cryptographic machine is based on a server cryptographic machine cluster composed of several server cryptographic machines. The computing power of the cryptographic card of each server cryptographic machine needs to be reserved. The computing power of the key card is reserved for trans-encryption use. Each cryptographic card can reserve computing power within 5%; all cryptographic cards are provided with a key index x, and the key index x stores the same key Y for trans-encryption. At the same time, a group of records M is made to record the position of the key used for the calculation request.

[0028] like Figure 1 As shown, record M includes a user key identifier, a server cryptographic machine identifier, a password card identifier and a key index, wherein the user key identifier is used to identify the key and is generated by the server cryptographic machine. Each user obtains multiple keys by having multiple user key identifiers. The server cryptographic machine binds the server cryptographic machine, the password card and the key index through the user key identifier. For user use, it is sufficient to know the user key identifier to use the key for cryptographic calculations. The system shields the device details inside the cluster for the user.

[0029] The server cryptographic machine identifier is used to identify the server cryptographic machine identifier where the key used for the user password calculation request is located.

[0030] Password card identifier, used to identify the password card containing the key used in the user password calculation request.

[0031] like Figure 2 As shown in the figure, the server cryptographic machine cluster deployment scheme adopts a multi-active mode, that is, multiple nodes provide services in a peer-to-peer mode at the same time, and each server cryptographic machine has load distribution and cryptographic service capabilities. The server cryptographic machine uses three networks for different communications, namely the cryptographic service network, the cluster network, and the load distribution network. The cryptographic service network provides cryptographic computing services to the outside world, the cluster network provides cluster building communication between server cryptographic machines, and the load distribution network provides internal scheduling communication for the server cryptographic machine cluster.

[0032] The server cipher machine cluster formation strategy adopts multicast / broadcast mode, such as the fanout mode in rabbitmq. Each server cipher machine connects to the same message queue Q, binds to the same exchange EX, generates a queue t, and sends its own machine's key, key index and other information to the exchange EX in broadcast mode. In this way, each node can obtain a copy of the key information of the entire cluster. The message distribution principle Figure 3 shown.

[0033] The load balancing strategy adopts a peer-to-peer competition strategy with priority. Priority means that the cryptographic calculation will give priority to the server cryptographic machine and cryptographic card where the key is located. If the resources of the device are insufficient, peer competition will be adopted in the future. Peer competition means that the cryptographic calculation request and the key ciphertext are sent to the load scheduling message queue at the same time, and each server cryptographic machine competes for it. The cluster that grabs the request will process the request. There is no need for secondary scheduling of the server cryptographic machine with "priority" to participate in the peer competition. If it is grabbed, then the resources are sufficient at this time and it should handle this service. If it is not grabbed, it will be processed by other devices.

[0034] like Figure 4 As shown in the figure, the overall load balancing process is:

[0035] S1: Calculation request user, requesting password calculation.

[0036] S2: Load balancing distribution service, to distribute server cipher machines, first read record M, determine whether the server cipher machine A to which the key belongs has sufficient resources, if sufficient, directly distribute it to server cipher machine A.

[0037] S3: If the resources are insufficient, obtain the key from server cipher machine A.

[0038] S4: Server cipher machine A returns the ciphertext a of the key, which is encrypted using the key index x.

[0039] S5: Load balancing distribution service, selects a server cipher machine B with sufficient resources, forwards the request, and attaches the key ciphertext a.

[0040] S6: Server cipher machine B distributes the cipher card, decrypts the key ciphertext a and stores it in the temporary index x.

[0041] S7: The password card uses the temporary index x to replace the index in record M to perform password calculation.

[0042] S8: Server cryptographic machine B returns the cryptographic calculation result to the calculation requesting user and deletes the temporary index x.

[0043] When the present invention is in use, the above method can not only distribute the cryptographic calculation to different cryptographic cards to obtain the expansion of the computing power of multiple cryptographic cards, but also ensure that the cryptographic calculation is performed in the cryptographic card, thereby ensuring that the key plaintext does not appear in the memory of the server cryptographic machine in all processes.

Claims

1. A load balancing method for a server cryptographic machine, based on a server cryptographic machine cluster formed by a plurality of server cryptographic machines, characterized in that: Each password card is provided with a key index x and a computing capacity reserved for trans-encryption; the key index x of all password cards stores the same key Y used for trans-encryption, and a set of records M are made for recording the location of the key used for the calculation request; the load balancing method comprises the following steps: S1: Calculation request user, requesting password calculation; S2: Load balancing distribution service, to distribute server cryptographic machines, first read record M, determine whether the server cryptographic machine A to which the key belongs has sufficient resources, if sufficient, directly distribute it to server cryptographic machine A; S3: If the resources are insufficient, obtain the key from server cipher machine A; S4: Server cipher machine A returns the ciphertext a of the key, which is encrypted by key index x; S5: Load balancing distribution service, selects a server cipher machine B with sufficient resources, forwards the request, and attaches the key ciphertext a; S6: Server cipher machine B distributes the cipher card, decrypts the key ciphertext a and stores it in the temporary index x; S7: The password card uses the temporary index x to replace the index in record M to calculate the password; S8: Server cryptographic machine B returns the cryptographic calculation result to the calculation requesting user and deletes the temporary index x.

2. A load balancing method for a server cryptographic machine according to claim 1, characterized in that: The record M includes a user key identifier, a server cryptographic machine identifier, a password card identifier and a key index; the user key identifier is used to identify the key and is generated by the server cryptographic machine. Each user obtains multiple keys by having multiple user key identifiers. The server cryptographic machine binds the server cryptographic machine, the password card and the key index through the user key identifier; the server cryptographic machine identifier is used to identify the identifier of the server cryptographic machine where the key used for the user password calculation request is located; the password card identifier is used to identify the identifier of the password card where the key used for the user password calculation request is located.

3. The load balancing method of a server cryptographic machine according to claim 1, characterized in that: The server cryptographic machine cluster deployment solution adopts a multi-active mode, that is, multiple nodes provide services simultaneously in a peer-to-peer mode, and each server cryptographic machine has load distribution and cryptographic service capabilities; the server cryptographic machine uses three networks for different communications, namely, a cryptographic service network, a cluster network and a load distribution network; the cryptographic service network provides cryptographic computing services to the outside world, the cluster network provides cluster building communication between server cryptographic machines, and the load distribution network provides scheduling communication within the server cryptographic machine cluster.

4. A load balancing method for a server cryptographic machine according to claim 3, characterized in that: The server cryptographic machine cluster formation strategy adopts a multicast / broadcast mode. Each server cryptographic machine connects to the same message queue Q, binds to the same exchange EX, generates a queue t, and sends its own machine's key and key index information to the exchange EX in broadcast mode, so that each node can obtain a copy of the key information of the entire cluster.

5. The load balancing method of a server cryptographic machine according to claim 1, characterized in that: The load balancing strategy adopts a peer-to-peer competition strategy with priority.

Images