Access method, device and equipment of cluster node and storage medium

Abstract

The application provides a cluster node access method and device, equipment and storage medium. It relates to the technical field of data processing. The method comprises: obtaining an access request of a user, the access request comprising first authentication information and second authentication information, the first authentication information comprising a first secret key and a first authentication factor; in the case that the first secret key matches a pre-stored first certificate ciphertext, judging whether the second authentication information matches a pre-stored second authentication ciphertext, the first certificate ciphertext being obtained by encrypting the first authentication factor by a first rule; if the second authentication information matches the second certificate ciphertext, starting a current node, and in the case that the first authentication factor is obtained by decrypting the first certificate ciphertext by the first rule, executing the access request. The application effectively guarantees the security of cluster certificate authentication by means of double cluster certificate authentication of the user.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method, apparatus, device and storage medium for accessing cluster nodes. Background Technology

[0002] A cluster is a set of loosely integrated computer software and / or hardware connected together to perform computational tasks in a highly collaborative manner. Simply put, it's about bringing several servers together to perform the same business logic; a node is equivalent to a server in the cluster. The advantages of a cluster are that when one machine fails, it doesn't affect the execution of other servers. Furthermore, it allows a business logic to be broken down into multiple sub-businesses, or different businesses to be deployed on different servers, thereby shortening the execution time of individual tasks, improving efficiency, and offering easy scalability and high reusability.

[0003] Existing cluster certificate authentication methods rely on a single cluster certificate authentication program to complete the authentication of cluster certificates, which is highly vulnerable to attacks and compromises authentication security. Furthermore, existing methods do not restrict the operational permissions of implementers, making it easy for unauthorized operations to occur, and thus failing to meet the requirements for cluster certificate authentication. Summary of the Invention

[0004] This application provides a method, apparatus, device, and storage medium for accessing cluster nodes, in order to solve the problems of single cluster certificate authentication methods and low security in the prior art.

[0005] A first aspect of this application provides a method for accessing cluster nodes, comprising:

[0006] Obtain a user's access request, the access request including first authentication information and second authentication information, the first authentication information including a first key and a first authentication factor;

[0007] If the first key matches the pre-stored first certificate ciphertext, it is determined whether the second authentication information matches the pre-stored second authentication ciphertext. The first certificate ciphertext is obtained by encrypting the first authentication factor using the first rule.

[0008] If the second authentication information matches the second certificate ciphertext, the current node is started, and the access request is executed after the first authentication factor is obtained by decrypting the first certificate ciphertext according to the first rule.

[0009] Optionally, the first authentication factor includes the user's identity information and the valid time period during which the user is allowed to access the current node.

[0010] Optionally, the method further includes:

[0011] If the first authentication factor is obtained by decrypting the first certificate ciphertext using the first rule, the current time is obtained, and it is determined whether the current time is within the valid time period.

[0012] If the current time is within the specified valid time period, execute the access request.

[0013] Optionally, the second authentication information includes:

[0014] Second key and second authentication factor;

[0015] The second certificate ciphertext is obtained by encrypting the second authentication factor using the second rule. The second authentication factor includes the user's identity information.

[0016] Optionally, the second authentication factor is a unique identifier generated after encrypting the user's identity information using a third rule.

[0017] Optionally, if the second authentication information matches the second certificate ciphertext, the current node is started, including:

[0018] If the second key matches the second certificate ciphertext, obtain the second authentication factor;

[0019] If the second authentication factor is determined to have permission to access the current node through a preset permission mapping table, the current node is started.

[0020] The permission mapping table includes at least the correspondence between different second authentication factors and the different nodes that can be accessed.

[0021] Optionally, the method further includes obtaining the current time, the valid usage time of the current node, and the authorization identifier of the current node; and, if it is determined through a preset permission mapping table that the second authentication factor has permission to access the current node, starting the current node, including:

[0022] If the second authentication factor is determined to have permission to access the current node through a preset permission mapping table, and if the current time is within the valid usage time of the current node, and the current node is determined to have permission to execute the access request through the authorization identifier of the current node, then the current node is started.

[0023] Optionally, the second authentication information further includes a third key, and the method further includes: encrypting the second certificate ciphertext according to a third rule; if the second authentication information matches the second certificate ciphertext, the method further includes:

[0024] The encrypted second certificate ciphertext is decrypted using the third key to obtain the second certificate ciphertext.

[0025] Optionally, the access request may also include the user's IP address and hostname, and the method may further include:

[0026] The IP address and hostname of the user terminal are stored in a preset storage location of the current node.

[0027] A second aspect of this application provides an access device for a cluster node, comprising:

[0028] The data acquisition module is configured to acquire user access requests, the access requests including first authentication information and second authentication information, the first authentication information including a first key and a first authentication factor;

[0029] The matching module is configured to, if the first key matches the pre-stored first certificate ciphertext, determine whether the second authentication information matches the pre-stored second authentication ciphertext, wherein the first certificate ciphertext is obtained by encrypting the first authentication factor using a first rule; and

[0030] If the second authentication information matches the second certificate ciphertext, the current node is started, and the access request is executed after the first authentication factor is obtained by decrypting the first certificate ciphertext according to the first rule.

[0031] A third aspect of this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0032] The memory stores computer-executed instructions;

[0033] The processor executes computer execution instructions stored in the memory to implement the above-described method.

[0034] A fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, are used to implement the above-described method.

[0035] A fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0036] This application employs a dual cluster certificate authentication method. First, the user's encrypted first certificate is verified. After the first encrypted certificate is verified, the second encrypted certificate is verified. Only after the second encrypted certificate is verified can the accessed node be started. After the node is started, the encrypted first certificate is decrypted using the same encryption algorithm as the first encrypted certificate. Only when the first authentication factor is obtained through decryption will the relevant project be started and the corresponding request executed, thereby effectively ensuring the security of cluster certificate authentication. Attached Figure Description

[0037] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0038] Figure 1 This is a schematic diagram of an existing load balancing cluster structure;

[0039] Figure 2 A flowchart illustrating the cluster node access method provided in this application embodiment;

[0040] Figure 3 The logic of the cluster node access method provided in the embodiments of this application Figure 1 ;

[0041] Figure 4 The logic of the cluster node access method provided in the embodiments of this application Figure 2 ;

[0042] Figure 5 The logic of the cluster node access method provided in the embodiments of this application Figure 3 ;

[0043] Figure 6 The logic of the cluster node access method provided in the embodiments of this application Figure 4 ;

[0044] Figure 7 A schematic block diagram of a cluster node access device provided in an embodiment of this application;

[0045] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0046] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0048] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0049] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0050] A cluster is a group of independent computers connected by a high-speed communication network. Each cluster node, or computer within the cluster, is an independent server running its own processes. These processes can communicate with each other, appearing to network clients as a single system that works together to provide users with applications, system resources, and data, and is managed in a unified system manner.

[0051] Currently, commonly used cluster models on the Internet include load-balanced clusters and high-availability clusters. Load-balanced clusters distribute client access request pressure and load as evenly as possible across the computer cluster. Client access request load typically includes application processing load and network traffic load. Load-balanced cluster systems are suitable for serving a large number of users using the same set of applications. Each node in the cluster can handle a certain amount of access request load, and access requests can be dynamically distributed among the nodes to achieve load balancing. When a load-balanced cluster is running, it typically uses one or more front-end load balancers to distribute client access requests to a set of back-end servers, thereby achieving high performance and high availability for the entire system.

[0052] like Figure 1 The diagram illustrates a typical load-balanced cluster architecture, comprising a front-end load balancing layer, a middle server group layer, and a bottom-end shared data storage layer. The load balancing layer, located at the front of the entire cluster system, consists of one or more load balancers, acting like routers to distribute user requests to the application servers in the server group layer. The server group layer comprises a group of machines actually running application services. These application servers can be one or more of the following: web servers, email servers, FTP servers, DNS servers, and video servers. Each application server is connected via a high-speed LAN or a distributed WAN. The shared data storage layer provides shared storage space and content consistency for all application servers, typically composed of disk array devices.

[0053] A high-availability cluster typically refers to a cluster where, if any node fails, its tasks are automatically transferred to other healthy nodes, without affecting the overall operation of the cluster. The primary purpose of a high-availability cluster is to ensure the overall service availability of the cluster is as high as possible. If the primary node in a high-availability cluster fails, a secondary node will take over during this period. The secondary node is usually a mirror image of the primary node; when it takes over, it can completely take over its identity, including its IP address and other resources, thus ensuring a consistent cluster system environment for users.

[0054] To ensure the secure operation of cluster nodes, implementers often need to perform corresponding operations on target nodes based on identity authentication results when accessing nodes in a distributed cluster, such as configuring nodes and configuring node permissions. However, existing cluster node authentication methods are simplistic and have low security.

[0055] To solve the above problems, such as Figure 2 and Figure 3 As shown, in a first aspect of this application, a method for accessing cluster nodes is provided, comprising:

[0056] Obtain the user's access request, which includes first authentication information and second authentication information. The first authentication information includes a first key and a first authentication factor.

[0057] If the first key matches the pre-stored first certificate ciphertext, determine whether the second authentication information matches the pre-stored second authentication ciphertext. The first certificate ciphertext is obtained by encrypting the first authentication factor using the first rule.

[0058] If the second authentication information matches the second certificate ciphertext, the current node is started. After decrypting the first certificate ciphertext using the first rule to obtain the first authentication factor, the access request is executed.

[0059] Thus, this application employs a dual cluster certificate authentication method. First, the user's first certificate ciphertext is verified. After the first certificate ciphertext is verified, the second certificate ciphertext is verified. Only after the second certificate ciphertext is verified can the accessed node be started. After the node is started, the first certificate ciphertext is decrypted using the same encryption algorithm as the first certificate ciphertext. Only when the first authentication factor is obtained through decryption can the relevant project be started and the corresponding request executed, thereby effectively ensuring the security of cluster certificate authentication.

[0060] Specifically, the method of this application can be applied to a web service cluster developed based on JAVA. This service cluster includes several nodes, and implementers can access the cluster nodes through a user terminal. The method of this application can be applied to any node. In this embodiment, the implementer first registers a first authentication factor on the server and stores the registered first authentication factor on each node of the cluster to generate a first certificate ciphertext. Simultaneously, a second certificate ciphertext is generated on each node and stored. It is understood that a single node can pre-store the first certificate ciphertext and second certificate ciphertext generated from the first authentication factors of multiple different users. The first authentication factor belongs to the implementer and may include relevant information used to characterize the user's identity. After receiving the first authentication factor, each node encrypts the first authentication factor according to a preset first rule to generate the first certificate ciphertext. The first rule is an encryption algorithm, which can employ existing symmetric or asymmetric encryption algorithms. For example, the RSA encryption algorithm can be used to encrypt the first authentication factor; this embodiment does not limit this. The second certificate ciphertext can also be obtained by encrypting the user's relevant information using the same or different encryption algorithms as the first rule. For example, the second certificate ciphertext can be obtained by encrypting the user's permission information using an encryption algorithm, or it can be obtained by encrypting part of the user's identity information. For example, in one specific instance, the user's identity information can be divided into two parts: the first certificate ciphertext is obtained by encrypting the first part of the user's identity information, such as the username, using an encryption algorithm, and the second certificate ciphertext is obtained by encrypting the second part of the user's identity information, such as the user's ID, using an encryption algorithm; in another specific instance, the first certificate ciphertext can also be obtained by encrypting the user's identity information, such as the username and / or user ID, using an encryption algorithm, and the second certificate ciphertext is obtained by encrypting the user's permission information, such as the user's time access permissions and / or node access permissions, using an encryption algorithm.

[0061] When an implementer sends an access request to the current node, an initial verification is performed. The implementer needs to enter a first key. If the first key matches the first certificate ciphertext, the verification passes. If the first key does not match the first certificate ciphertext, the implementer cannot decrypt the first certificate ciphertext, and the verification fails, and the current node will not start. After passing the first verification, a second authentication ciphertext is further verified. For example, the second authentication information includes the user's access permissions. If the user's access permissions match the user's access permissions in the second authentication ciphertext, the verification passes; otherwise, the verification fails. Access permissions can be node access permissions. For example, if the current user is user A, and their node access permissions allow access to nodes 1 and 2, and the current node is node 3, and the second authentication ciphertext allows access to users B and C, then the user's access permissions do not match those in the second authentication ciphertext, and verification fails. Conversely, if the current user is user A, and their node access permissions allow access to nodes 1 and 2, and the current node is node 1, and the second authentication ciphertext allows access to users A and C, then the user's access permissions match those in the second authentication ciphertext, and verification succeeds. After the second verification, the current node starts. Following startup, a third verification of the visitor's identity is performed. Specifically, the current node uses the same encryption algorithm as the first authentication factor to decrypt the first certificate ciphertext. If the decrypted first authentication factor matches the first authentication factor included in the user's access request, the perpetrator is deemed legitimate. Only after confirming the perpetrator's legitimacy does the current node execute the specific operations requested in the access request. This three-stage authentication effectively ensures the security of node access and prevents unauthorized node operations.

[0062] In this embodiment, the first authentication factor includes the user's identity information and the valid time period during which the user is allowed to access the current node. The user's identity information may include a username and user ID, etc. The valid time period during which the user is allowed to access the current node can be the time period within a day during which the user is allowed to access the current node, such as 8:00-22:00, meaning the current user is allowed to access the current node from 8:00 to 22:00 every day; or the valid time period during which the user is allowed to access the current node can be the time period within a date during which the user is allowed to access the current node, such as 2022.1.1-2022.12.31, meaning the current user is allowed to access the current node from January 1, 2022 to December 31, 2022. It is understood that the valid time period during which the user is allowed to access the current node can also be a combination of the time period within a day during which the user is allowed to access the current node and the time period within a date during which the user is allowed to access the current node.

[0063] like Figure 4As shown, in order to further improve the security of access authentication, the method of this embodiment further includes: obtaining the current time after decrypting the first certificate ciphertext through the first rule to obtain the first authentication factor, and determining whether the current time is within a valid time period; if the current time is within a valid time period, executing the access request.

[0064] Since the first certificate ciphertext is obtained by encrypting the first authentication factor using the encryption algorithm of the first rule, if decrypting the first certificate ciphertext using the first rule yields the same first authentication factor as in the access request, it indicates that the current user is a legitimate user, meaning the current user and the user who started the current node are the same user. In this case, the current time is further obtained and matched with the valid time period in the first authentication factor during which the user is allowed to access the current node. If the current time falls within this valid time period, the access request and the user's subsequent corresponding operations are executed. Thus, by verifying the current user again before executing the access request after the two verifications during the node startup phase, malicious access to the current node can be further prevented. Furthermore, after determining that the current user is legitimate, it is further determined whether the current user's access time falls within the allowed access time. Only when the current user's access time falls within the allowed access time, i.e., when it is determined that the current user has permission to access the current node at the current time, is the access request and subsequent related operations allowed.

[0065] In this embodiment, the second authentication information includes: a second key and a second authentication factor; the second certificate ciphertext is obtained by encrypting the second authentication factor using the second rule, and the second authentication factor includes the user's identity information and a unique identifier. It is understood that the second rule can be the same encryption algorithm as the first rule, or it can be a different encryption algorithm. For example, both the first and second rules can be asymmetric encryption algorithms such as RSA; or both the first and second rules can be symmetric encryption algorithms such as AES; or the first rule is an asymmetric encryption algorithm and the second rule is a symmetric encryption algorithm; or the first rule is a symmetric encryption algorithm and the second rule is an asymmetric encryption algorithm. Taking the first and second rules, both using the RSA encryption algorithm, as an example, when deploying the first certificate ciphertext, the client generates a first public key and a first private key. Each node obtains the first public key and encrypts the first authentication factor stored on the node to generate the first certificate ciphertext. During the first verification, the user can only decrypt the first certificate ciphertext using the first private key, i.e., the first secret key. Similarly, when deploying the second certificate ciphertext, the client generates a second public key and a second private key. Each node obtains the second public key and encrypts the second authentication factor stored on the node to generate the second certificate ciphertext. During the second verification, the user can only decrypt the second certificate ciphertext using the second private key, i.e., the second secret key.

[0066] The second authentication factor can be used to characterize a user's operational permissions. It includes the user's identity information, such as a username or user ID. In this embodiment, the second authentication factor is a unique ID obtained by encrypting the username using a third rule (UUID). The third rule can be an MD5 encryption algorithm or other encryption algorithms. For example, the second authentication factor can be obtained by calculating the MD5 hash of the username and the namespace, thereby ensuring the uniqueness of different names within the same namespace, as well as the uniqueness of different namespaces.

[0067] In this embodiment, before starting the current node, the user's identity needs to be verified a second time. If the second authentication information matches the second certificate ciphertext, the current node is started, including: if the second key matches the second certificate ciphertext, obtaining the second authentication factor; and starting the current node if it is determined through a preset permission mapping table that the second authentication factor has the permission to access the current node. The permission mapping table includes at least the correspondence between different second authentication factors and different nodes that can be accessed.

[0068] A pre-built permission mapping table, which includes the correspondence between different second authentication factors and the nodes that each second authentication factor can access, is stored on the server or on each node. For example, the permission mapping table includes: ID1—node 1, node 3, node 4, node 5; ID2—node 1, node 2, node 3, node 5, etc., where ID1 and ID2 represent unique IDs corresponding to different second authentication factors. During verification, the user decrypts the second certificate ciphertext using a pre-generated second key. If the second authentication factor can be obtained by decrypting the second certificate ciphertext, the pre-built permission mapping table is retrieved, and the decrypted second authentication factor is matched with the permission mapping table. For example, if the decrypted second authentication factor is ID1 and the current node is node 2, the permission mapping table is searched for the same ID1. If it exists, the accessible nodes corresponding to ID1 in the permission mapping table are further queried to see if node 2 is included. If node 2 is included, it is determined that the current user has the permission to access the current node, and the current node is started.

[0069] like Figure 5As shown, to further improve the security of cluster node authentication, in this embodiment, the method further includes obtaining the current time, the valid usage time of the current node, and the authorization identifier of the current node; and starting the current node when it is determined through a preset permission mapping table that the second authentication factor has the permission to access the current node, including: if the second authentication factor has the permission to access the current node when it is determined through the preset permission mapping table that the second authentication factor has the permission to access the current node, and if the current time is within the valid usage time of the current node, and the authorization identifier of the current node determines that the current node has the permission to execute the access request, then start the current node. Here, the valid usage time of the current node represents the valid time during which the current node is allowed to start, and the authorization identifier indicates that the current node has been authorized to start and execute the corresponding operation.

[0070] In a specific example of this embodiment, the effective usage time and authorization identifier of the current node can be pre-stored on the current node. During the second verification before starting the node, if it is determined that the current user has permission to access the current node, the permissions of the current node need to be further verified. For example, the current time is matched with the effective usage time of the current node pre-stored on the current node. If the current time is July 11, 2022, and the effective usage time of the current node is from January 1, 2022 to July 1, 2022, then the current time is outside the effective usage time of the current node. Therefore, the current node cannot be started, the current user cannot be granted permission to use the cluster, and the user is redirected to a reminder page and informed that the implementation personnel's request lacks permission. If the current time is June 11, 2022, and the effective usage time of the current node is from January 1, 2022 to July 1, 2022, then the current time is within the effective usage time of the current node. In this case, the authorization identifier is used to further determine whether the current node is authorized to execute the corresponding operation of the current access request. For example, an authorization identifier can correspond to different operation requests, indicating that the current node has the permission to execute the operation corresponding to the authorization identifier. If the operation corresponding to the current access request does not belong to the set of operations corresponding to the authorization identifier, the current node cannot be started. Conversely, if the operation corresponding to the current access request belongs to the set of operations corresponding to the authorization identifier, the current node can be started. Alternatively, the authorization identifier can indicate whether the current node is authorized to start and execute the corresponding operation. If the authorization identifier of the current node is obtained, it means that the current node has the permission to execute the corresponding operation, and the current node is started. If the authorization identifier of the current node is not obtained, it means that the current node does not have the permission to execute the corresponding operation, the current node cannot be started, the current user cannot be granted permission to use the cluster, and the user is redirected to a notification page and informed that the implementation personnel's request lacks permission.

[0071] like Figure 6As shown, in a specific instance of this embodiment, to further ensure the security of the certificate ciphertext and prevent it from being cracked or stolen, the second authentication information also includes a third key. The method further includes: encrypting the second certificate ciphertext using a third rule; if the second authentication information matches the second certificate ciphertext, the method further includes: decrypting the encrypted second certificate ciphertext using the third key to obtain the second certificate ciphertext. Specifically, when deploying the second certificate ciphertext, after encrypting the second authentication factor using the second rule to generate the second certificate ciphertext, this embodiment further encrypts the second certificate ciphertext using a third rule and stores it on the node. The third rule can be an existing asymmetric or symmetric encryption algorithm, for example, the third rule can also be the RSA encryption algorithm. The user generates a third public key and a third private key. Each node obtains the third public key to encrypt the second certificate ciphertext stored on the node and stores it. After passing the first verification, before performing the second verification, the user needs to decrypt the second certificate ciphertext using the third private key to obtain the second certificate ciphertext, thereby performing the second verification using the second certificate ciphertext. In this way, by encrypting and storing the second certificate ciphertext, the protection of the second certificate ciphertext can be strengthened and the anti-attack capability can be improved if the first certificate ciphertext is not compromised.

[0072] To further enhance node security and enable traceability of node operations, the access request in this embodiment also includes the user's IP address and hostname. The method further includes storing the user's IP address and hostname in a preset storage location on the current node. After the current user is authorized to use the cluster, the current node obtains the user's IP address and hostname and stores them in the node usage record list to facilitate subsequent traceability of the current node's operations. To further enhance cluster access security, in this embodiment, after the user passes authentication or completes the corresponding operation, the current node will also clear the key entered by the implementer for certificate encryption verification to prevent leakage.

[0073] like Figure 7 As shown, a second aspect of this application provides an access device for a cluster node, comprising: a data acquisition module configured to acquire a user's access request, the access request including first authentication information and second authentication information, the first authentication information including a first key and a first authentication factor; a matching module configured to, if the first key matches a pre-stored first certificate ciphertext, determine whether the second authentication information matches a pre-stored second authentication ciphertext, the first certificate ciphertext being obtained by encrypting the first authentication factor using a first rule; and if the second authentication information matches the second certificate ciphertext, start the current node, and, if the first authentication factor is obtained by decrypting the first certificate ciphertext using the first rule, execute the access request.

[0074] In some specific instances, the first authentication factor includes the user's identity information and the valid time period during which the user is allowed to access the current node.

[0075] In some specific instances, the matching module is also configured to: obtain the current time and determine whether the current time is within a valid time period after decrypting the first certificate ciphertext using the first rule to obtain the first authentication factor; if the current time is within a valid time period, execute the access request.

[0076] In some specific instances, the second authentication information includes: a second key and a second authentication factor; the second certificate ciphertext is obtained by encrypting the second authentication factor using the second rule; and the second authentication factor includes the user's identity information.

[0077] In some specific instances, the second authentication factor is a unique identifier generated after encrypting the user's identity information using a third rule.

[0078] In some specific instances, the matching module is also configured to: if the second key matches the second certificate ciphertext, obtain the second authentication factor; if the second authentication factor has the permission to access the current node as determined by a preset permission mapping table, start the current node; the permission mapping table includes at least the correspondence between different second authentication factors and the different nodes that can be accessed.

[0079] In some specific instances, the data acquisition module is also configured to: acquire the current time, the effective usage time of the current node, and the authorization identifier of the current node; the matching module is also configured to: if the second authentication factor has the permission to access the current node through a preset permission mapping table, and if the current time is within the effective usage time of the current node, and the authorization identifier of the current node determines that the current node has the permission to execute the access request, then start the current node.

[0080] In some specific instances, the second authentication information also includes a third key, and the matching module is also configured to encrypt the second certificate ciphertext using a third rule; and to decrypt the encrypted second certificate ciphertext using the third key before the second authentication information matches the second certificate ciphertext, so as to obtain the second certificate ciphertext.

[0081] In some specific instances, the access request also includes the client's IP address and hostname, and the matching module is also configured to store the client's IP address and hostname in a preset storage location of the current node.

[0082] The cluster node access device provided in this application embodiment can be used to execute the technical solution of the cluster node access method in the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0083] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing elements; they can be fully implemented in hardware; or some modules can be implemented by processing elements calling software, while others are implemented in hardware. For example, the data acquisition module can be a separate processing element, or it can be integrated into a chip in the above device. Alternatively, it can be stored as program code in the memory of the above device, and its functions can be called and executed by a processing element. The implementation of other modules is similar. Moreover, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.

[0084] A third aspect of this application provides an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the above-described method.

[0085] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 As shown, the electronic device may include: transceiver 121, processor 122, and memory 123.

[0086] Processor 122 executes computer execution instructions stored in memory, causing processor 122 to perform the scheme in the above embodiments. Processor 122 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0087] The memory 123 is connected to the processor 122 via the system bus and completes communication between them. The memory 123 is used to store computer program instructions.

[0088] Transceiver 121 can be used to obtain the task to be run and its configuration information.

[0089] The system bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the diagram, but this does not indicate that there is only one bus or one type of bus. Transceivers are used to enable communication between database access devices and other computers (e.g., clients, read-write libraries, and read-only libraries). Memory may include random access memory (RAM) and may also include non-volatile memory.

[0090] The electronic device provided in this application embodiment can be the terminal device described in the above embodiments.

[0091] This application also provides a chip for executing instructions, which is used to execute the task scheduling method described in the above embodiments.

[0092] A fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the above-described method.

[0093] A fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0094] In summary, this application employs a dual-certificate authentication method. First, the implementation personnel are verified using the encrypted first certificate. Only after the first certificate is verified does the second certificate's encrypted text undergo verification, effectively ensuring the security of cluster certificate authentication. Simultaneously, without compromising the first certificate's encrypted text, the protection of the second certificate's encrypted text is enhanced, improving attack resistance and preventing data leakage. Furthermore, the implementation personnel's operations undergo permission verification to ensure all operations are within their authorized scope, preventing unauthorized actions and safeguarding access rights for cluster usage.

[0095] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0096] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for accessing cluster nodes, characterized in that, include: Obtain a user's access request, the access request including first authentication information and second authentication information, the first authentication information including a first key and a first authentication factor; If the first key matches the pre-stored first certificate ciphertext, it is determined whether the second authentication information matches the pre-stored second certificate ciphertext. The first certificate ciphertext is obtained by encrypting the first authentication factor using the first rule. If the second authentication information matches the second certificate ciphertext, the current node is started, and the access request is executed after the first authentication factor is obtained by decrypting the first certificate ciphertext according to the first rule. The first authentication factor includes the user's primary identity information; The second authentication information includes: Second key and second authentication factor; The second certificate ciphertext is obtained by encrypting the second authentication factor using the second rule. The second authentication factor includes the user's second identity information, and the first identity information and the second identity information are different identity information. The second authentication factor is a unique identifier generated after the second identity information is encrypted using the third rule.

2. The method for accessing cluster nodes according to claim 1, characterized in that, The first authentication factor includes the valid time period during which access to the current node is permitted.

3. The method for accessing cluster nodes according to claim 2, characterized in that, The method further includes: If the first authentication factor is obtained by decrypting the first certificate ciphertext using the first rule, the current time is obtained, and it is determined whether the current time is within the valid time period. If the current time is within the specified valid time period, execute the access request.

4. The method for accessing cluster nodes according to claim 1, characterized in that, If the second authentication information matches the second certificate ciphertext, start the current node, including: If the second key matches the second certificate ciphertext, obtain the second authentication factor; If the second authentication factor is determined to have permission to access the current node through a preset permission mapping table, the current node is started. The permission mapping table includes at least the correspondence between different second authentication factors and the different nodes that can be accessed.

5. The method for accessing cluster nodes according to claim 4, characterized in that, The method also includes obtaining the current time, the valid usage time of the current node, and the authorization identifier of the current node; If, after determining through a preset permission mapping table that the second authentication factor has permission to access the current node, the current node is started, including: If the second authentication factor is determined to have permission to access the current node through a preset permission mapping table, and if the current time is within the valid usage time of the current node, and the current node is determined to have permission to execute the access request through the authorization identifier of the current node, then the current node is started.

6. The method for accessing cluster nodes according to claim 1, characterized in that, The second authentication information also includes a third key, and the method further includes: encrypting the second certificate ciphertext according to a third rule; if the second authentication information matches the second certificate ciphertext, the method further includes: The encrypted second certificate ciphertext is decrypted using the third key to obtain the second certificate ciphertext.

7. The method for accessing cluster nodes according to claim 1, characterized in that, The access request also includes the user's IP address and hostname, and the method further includes: The IP address and hostname of the user terminal are stored in a preset storage location of the current node.

8. An access device for a cluster node, characterized in that, include: The data acquisition module is configured to acquire user access requests, the access requests including first authentication information and second authentication information, the first authentication information including a first key and a first authentication factor; The matching module is configured to determine whether the second authentication information matches the pre-stored second certificate ciphertext if the first key matches the pre-stored first certificate ciphertext. The first certificate ciphertext is obtained by encrypting the first authentication factor using the first rule. as well as If the second authentication information matches the second certificate ciphertext, the current node is started, and the access request is executed after the first authentication factor is obtained by decrypting the first certificate ciphertext according to the first rule. The first authentication factor includes the user's primary identity information; The second authentication information includes: Second key and second authentication factor; The second certificate ciphertext is obtained by encrypting the second authentication factor using the second rule. The second authentication factor includes the user's second identity information, and the first identity information and the second identity information are different identity information. The second authentication factor is a unique identifier generated after the second identity information is encrypted using the third rule.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-7.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-7.

Images