Trusted Verification Method, Device, Readable Storage Medium and Electronic Device

Abstract

The present disclosure relates to a trusted verification method, apparatus, readable storage medium, and electronic device. The method includes: a client in a cluster can receive an encrypted shared key from a server in the cluster, generate an encryption key, a client initialization vector, and a server initialization vector based on the encrypted shared key, construct permission information of the client, encrypt the permission information using the encryption key and the client initialization vector to obtain encrypted permission information, and send the encrypted permission information to the server. The encrypted permission information is used to instruct the server to decrypt the encrypted permission information using the encryption key and the client initialization vector to obtain the permission information, and to instruct the server to verify the permission information to obtain a verification result, and encrypt the verification result using the encryption key and the server initialization vector to obtain an encrypted verification result; the client receives the encrypted verification result fed back by the server, and decrypts the encrypted verification result using the encryption key and the server initialization vector to obtain the verification result.

Description

Technical Field

[0001] The present disclosure relates to the field of communication encryption, and in particular, to a trusted verification method, apparatus, readable storage medium, and electronic device. Background Art

[0002] Cluster technology is a relatively new technology. Through cluster technology, relatively high benefits in terms of performance, reliability, and flexibility can be obtained at a relatively low cost. Its task scheduling is the core technology in a cluster system. A cluster includes a group of independent computers interconnected by a network. These computers form a group and are managed in the mode of a single system. When a client interacts with a cluster, the cluster can be regarded as an independent server. Cluster configuration is used to improve availability and scalability. However, there is currently no reliable method for verifying the reliability and security of computer devices in a cluster. Summary of the Invention

[0003] The purpose of the present disclosure is to provide a trusted verification method, apparatus, readable storage medium, and electronic device.

[0004] According to a first aspect of an embodiment of the present disclosure, a trusted verification method is provided, which is applied to a client in a cluster. The method includes: receiving an encrypted shared key from a server in the cluster; generating an encryption key, a client initialization vector, and a server initialization vector based on the encrypted shared key; constructing permission information of the client, and encrypting the permission information using the encryption key and the client initialization vector to obtain encrypted permission information; sending the encrypted permission information to the server; the encrypted permission information is used to instruct the server to decrypt the encrypted permission information using the encryption key and the client initialization vector to obtain the permission information, and to instruct the server to verify the permission information to obtain a verification result, and encrypt the verification result using the server initialization vector to obtain an encrypted verification result; receiving the encrypted verification result from the server, and decrypting the encrypted verification result using the server initialization vector to obtain the verification result.

[0005] Optionally, determine whether the client has the running permission according to the verification result; intercept a number at a specified position of the encrypted verification result to obtain a new server initialization vector; the new server initialization vector is used for the client to decrypt the encrypted verification result generated by the server next time.

[0006] Optionally, before the step of receiving the encrypted shared key from the server in the cluster, the method further includes: sending a connection establishment request to the server; after receiving the response of the server to the connection establishment request, sending a communication protocol and an encryption algorithm to the server; the communication protocol is used for communication between the client and the server, and the encryption algorithm is used to encrypt the shared key to obtain the encrypted shared key; after receiving the response of the server to the communication protocol and the encryption algorithm, generating a public key and a private key of the encryption algorithm, and sending the public key to the server.

[0007] Optionally, the generating the encryption key, the client initialization vector, and the server initialization vector based on the encrypted shared key includes: decrypting the encrypted shared key using the private key of the encryption algorithm to obtain the shared key; using the shared key as an initial value, generating a random string of a specified length using a pseudo-random algorithm, and intercepting the numbers at the specified positions of the random string as the encryption key, the client initialization vector, and the server initialization vector.

[0008] Optionally, the constructing the license information of the client, and encrypting the license information using the encryption key and the client initialization vector to obtain the encrypted license information includes: encrypting the client host information and the license information using the encryption key and the client initialization vector to generate the encrypted license information; sending the encrypted license information to the server; intercepting the numbers at the specified positions of the encrypted license information to obtain a new client initialization vector; the new client initialization vector is used to encrypt the license information generated by the client next time.

[0009] According to a second aspect of the embodiments of the present disclosure, a trusted verification method for a server in a cluster is provided. The method includes: encrypting a shared key to generate an encrypted shared key, and sending the encrypted shared key to a client; generating an encryption key, a client initialization vector, and a server initialization vector based on the shared key; receiving the encrypted license information sent by the client, and decrypting the encrypted license information using the encryption key and the client initialization vector to obtain the license information; verifying the license information to obtain a verification result, and encrypting the verification result using the encryption key and the server initialization vector to obtain an encrypted verification result; sending the encrypted verification result to the client.

[0010] Optionally, before the step of encrypting the shared key to generate an encrypted shared key and sending the encrypted shared key to the client, the method further includes: receiving a connection establishment request sent by the client; sending a response to the connection establishment request to the client; receiving the communication protocol and encryption algorithm sent by the client; the communication protocol is used for communication between the client and the server, and the encryption algorithm is used to encrypt the shared key to obtain the encrypted shared key; after responding to the communication protocol and the encryption algorithm sent by the client, receiving the public key of the encryption algorithm sent by the client.

[0011] Optionally, the generating the encryption key, the client initialization vector, and the server initialization vector based on the shared key includes: using the shared key as an initial value, generating a random string of a specified length using a pseudo-random algorithm, and intercepting the numbers at the specified positions of the random string as the encryption key, the client initialization vector, and the server initialization vector.

[0012] Optionally, after the step of receiving the encrypted permission information sent by the client and decrypting the encrypted permission information according to the encryption key and the client initialization vector to obtain the permission information, the method further includes: recording the number of times of decrypting the encrypted permission information; in the case where the number of times is greater than a predetermined threshold, clearing the shared key and the key pair of the encryption algorithm, generating a new key pair of the encryption algorithm and a new shared key; in the case where the number of times is less than or equal to the predetermined threshold, verifying the permission information to obtain the verification result, encrypting the verification result according to the encryption key and the server initialization vector to obtain an encrypted verification result; intercepting the numbers at the specified positions of the encrypted verification result to obtain a new server initialization vector; the new server initialization vector is used to encrypt the verification result generated by the server next time.

[0013] Optionally, after the step of receiving the encrypted permission information sent by the client, the method further includes: intercepting the numbers at the specified positions of the encrypted permission information to obtain a new client initialization vector; the new client initialization vector is used by the server to decrypt the encrypted permission information generated by the client next time.

[0014] According to a third aspect of the embodiments of the present disclosure, a trusted verification device is provided, which is applied to a client in a cluster. The device includes: a receiving module, configured to receive an encrypted shared key from a server in the cluster; a first generating module, configured to generate an encryption key, a client initialization vector, and a server initialization vector based on the encrypted shared key; an encrypting module, configured to construct permission information of the client, and encrypt the permission information using the encryption key and the client initialization vector to obtain encrypted permission information; a first sending module, configured to send the encrypted permission information to the server; the encrypted permission information is used to instruct the server to decrypt the encrypted permission information using the encryption key and the client initialization vector to obtain the permission information, and to instruct the server to verify the permission information to obtain a verification result, and encrypt the verification result using the encryption key and the server initialization vector to obtain an encrypted verification result; a first decrypting module, configured to receive the encrypted verification result from the server, and decrypt the encrypted verification result using the encryption key and the server initialization vector to obtain the verification result.

[0015] According to a fourth aspect of the embodiments of the present disclosure, a trusted verification device is provided, which is applied to a server in a cluster. The device includes: a second generating module, configured to encrypt a shared key to generate an encrypted shared key, and send the encrypted shared key to a client; the second generating module is further configured to generate an encryption key, a client initialization vector, and a server initialization vector based on the shared key; a second decrypting module, configured to receive an encrypted permission request sent by the client, and decrypt the encrypted permission information using the encryption key and the client initialization vector to obtain the permission information; a verifying module, configured to verify the permission information to obtain a verification result, and encrypt the verification result using the encryption key and the server initialization vector to obtain an encrypted verification result; a second sending module, configured to send the encrypted verification result to the client.

[0016] According to a fifth aspect of the embodiments of the present disclosure, a non-transitory computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the trusted verification method provided in the foregoing first aspect or second aspect are implemented.

[0017] According to a sixth aspect of the embodiments of the present disclosure, an electronic device is provided, including: a memory, on which a computer program is stored; a processor, configured to execute the computer program in the memory to implement the steps of the trusted verification method provided in the foregoing first aspect or second aspect.

[0018] The technical solutions provided by the embodiments of the present disclosure may include the following beneficial effects: The client in the cluster can receive the encrypted shared key from the server in the cluster, generate an encryption key, a client initialization vector, and a server initialization vector based on the encrypted shared key, construct the license information of the client, encrypt the license information using the encryption key and the client initialization vector to obtain the encrypted license information, send the encrypted license information to the server, where the encrypted license information is used to instruct the server to decrypt the encrypted license information using the encryption key and the client initialization vector to obtain the license information, and to instruct the server to verify the license information to obtain a verification result, and encrypt the verification result using the encryption key and the server initialization vector to obtain the encrypted verification result; The client receives the encrypted verification result fed back by the server, decrypts the encrypted verification result using the encryption key and the server initialization vector to obtain the verification result; Taking one node in the cluster as the server and other nodes as clients, the client sends the encrypted license information to the server, the server decrypts the encrypted license information to obtain the license information, verifies the license information to obtain the verification result, encrypts the verification result to obtain the encrypted verification result, the client receives the encrypted verification result, and decrypts the encrypted verification result to obtain the verification result, thereby obtaining the reliability and security of the client license information. By encrypting the license information and the verification result through an encryption algorithm, the security of node communication in the cluster is ensured.

[0019] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings are used to provide a further understanding of the present disclosure, and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present disclosure, but do not constitute a limitation to the present disclosure. In the drawings:

[0021] Figure 1 is a schematic structural diagram of a cluster shown in an exemplary embodiment of the present disclosure.

[0022] Figure 2 is a flowchart of a trusted verification method shown in an exemplary embodiment of the present disclosure.

[0023] Figure 3 is a flowchart of a trusted verification method shown in an exemplary embodiment of the present disclosure.

[0024] Figure 4 is a flowchart of a trusted verification method shown in an exemplary embodiment of the present disclosure.

[0025] Figure 5 is a block diagram of a trusted verification device shown in an exemplary embodiment of the present disclosure.

[0026] Figure 6 It is a block diagram of a trust verification device shown in an exemplary embodiment of the present disclosure.

[0027] Figure 7 It is a block diagram of an electronic device shown in an exemplary embodiment of the present disclosure. Detailed implementation manners

[0028] The following will describe the detailed implementation manners of the present disclosure with reference to the accompanying drawings. It should be understood that the detailed implementation manners described herein are only for the purpose of illustrating and explaining the present disclosure, and are not used to limit the present disclosure.

[0029] When the following description involves the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the present disclosure. On the contrary, they are only examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0030] A cluster includes a group of independent computers interconnected through a network. These computers form a group and are managed in the mode of a single system. Take one node in the cluster as the server and other nodes as the clients. The server can verify the information of the clients, such as Figure 1 As shown, please refer to Figure 1 , Figure 1 It shows a schematic structural diagram of a cluster provided by an exemplary embodiment of the present disclosure. The computer system includes a client 120 and a server 140.

[0031] The client 120 and the server 140 are interconnected with each other through a wired or wireless network.

[0032] The client 120 includes a first memory and a first processor. A first program is stored in the first memory; the first program is called and executed by the first processor to implement the trust verification method provided by the present disclosure. The first memory may include, but is not limited to, the following several types: Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), and Electric Erasable Programmable Read-Only Memory (EEPROM).

[0033] The first processor may be composed of one or more integrated circuit chips. Optionally, the first processor may be a general-purpose processor, such as a Central Processing Unit (CPU) or a Network Processor (NP).

[0034] The server 140 includes a second memory and a second processor. A second program is stored in the second memory, and the second program is called by the second processor to implement the trusted verification method provided by the present disclosure. Optionally, the second memory may include, but is not limited to, the following: RAM, ROM, PROM, EPROM, EEPROM. Optionally, the second processor may be a general-purpose processor, such as a CPU or an NP.

[0035] Please refer to Figure 2 , Figure 2 which is a flowchart of a trusted verification method shown in an exemplary embodiment of the present disclosure. This method is executed by a computer device, for example, by Figure 1 the client in the cluster shown Figure 2 The trusted verification method shown includes the following steps:

[0036] In step S201, an encrypted shared key is received from the server in the cluster.

[0037] Exemplarily, a node in the cluster can be selected as the server, and other nodes as clients, so that the server can verify the license information of the clients. The license information can be embodied as a license file, which includes information such as whether the client can run, which software can be run, and what functions can be used.

[0038] The client receives the encrypted shared key sent by the server in the cluster; the encrypted shared key is obtained by the server encrypting the shared key using an encryption algorithm, and the shared key is generated by the server. In one implementation, the server can randomly generate a 256-bit shared key through an algorithm, and the encryption algorithm can be, but is not limited to, the RSA encryption algorithm. For example, the server can use the public key of the RSA encryption algorithm to encrypt the shared key to obtain the encrypted shared key; the shared key is used to generate the encryption key, the client initialization vector, and the server initialization vector. Among them, the encryption key and the client initialization vector can be used together to encrypt / decrypt the client's license information, and the encryption key and the server initialization vector can be used together to encrypt / decrypt the server's verification result. Specifically: the client can encrypt the license information generated by the client through the cipher block chaining mode in combination with the client initialization vector and the encryption key, and decrypt the encrypted verification result generated by the server through the cipher block chaining mode in combination with the server initialization vector and the encryption key; the server can encrypt the verification result generated by the server through the cipher block chaining mode in combination with the server initialization vector and the encryption key, and decrypt the encrypted license information generated by the client through the cipher block chaining mode in combination with the client initialization vector and the encryption key. In one implementation, the encryption key is an encryption key generated based on the Advanced Encryption Standard (AES) algorithm and can be referred to as the AES key.

[0039] It should be noted that the cipher block chaining mode refers to an encryption method in which a ciphertext block and a plaintext block are XORed bit by bit and then encrypted through a block cipher to obtain the ciphertext, also known as the CBC mode.

[0040] In step S202, an encryption key, a client initialization vector, and a server initialization vector are generated based on the encrypted shared key.

[0041] Since the encrypted shared key is obtained by the server encrypting the shared key using an encryption algorithm, first decrypt the encrypted shared key based on the same encryption algorithm as the server to obtain the shared key, and then generate the encryption key, the client initialization vector, and the server initialization vector based on the shared key. Exemplarily, using the shared key as the initial value, use a pseudo-random algorithm to generate a random string of a specified length, and intercept the numbers at the specified positions of the random string as the encryption key, the client initialization vector, and the server initialization vector respectively. It should be noted that the specified length and the specified position can be determined based on human experience or other feasible methods, and the present disclosure does not limit this.

[0042] In step S203, the license information of the client is constructed, and the license information is encrypted using the encryption key and the client initialization vector to obtain the encrypted license information.

[0043] The license information constructed by the client can be embodied as a license file, which includes at least one of the following information: the authorization information of the client, the node information of the client, and the restriction information of the client. Among them, the authorization information of the client is the information used to measure whether the client can be authorized, the node information of the client is the node location and the number of nodes of the client, and the restriction information of the client is the individual restriction information for each client, such as allowing the client to use some software and functions or prohibiting the client from using some software and functions. After constructing the license information, the license information is encrypted by combining the encryption key and the client initialization vector in the cipher block chaining mode to obtain the encrypted license information.

[0044] In step S204, the encrypted license information is sent to the server.

[0045] The encrypted license information is sent to the server, and the server receives the encrypted license information. The encrypted license information instructs the server to decrypt the encrypted license information by combining the encryption key and the client initialization vector in the cipher block chaining mode to obtain the license information, and then verifies the license information to obtain a verification result. The verification result is encrypted by combining the encryption key and the server initialization vector in the cipher block chaining mode to obtain the encrypted verification result. The server is also used to send the encrypted verification result to the client.

[0046] It should be noted that the verification result is obtained by the server according to the license information verification, which includes information such as whether the client can run, which software can be run, and what functions can be used.

[0047] In step S205, the encrypted verification result from the server is received, and the encrypted verification result is decrypted using the encryption key and the server initialization vector to obtain the verification result.

[0048] The client receives the encrypted verification result feedback from the server, decrypts the encrypted verification result by combining the encryption key and the server initialization vector in the cipher block chaining mode to obtain the verification result, and determines whether it can run itself, which software can be run, and what functions can be used according to the verification result.

[0049] Please refer to Figure 3 , Figure 3 which is a flowchart of a trusted verification method shown in an exemplary embodiment of the present disclosure. This method is executed by a computer device, for example, by a Figure 1 client in the cluster shown. Figure 3 The trusted verification method shown includes the following steps:

[0050] In step S301, a connection establishment request is sent to the server.

[0051] Exemplarily, a node in the cluster can be selected as the server, and other nodes as the clients, so that the server can verify the license information of the clients.

[0052] The client first sends a connection establishment request to the server. The connection establishment request is used to request a connection to the server. After receiving the connection establishment request, the server can respond to the connection establishment request or reject the connection establishment request.

[0053] In step S302, after receiving the response from the server to the connection establishment request, send the communication protocol and the encryption algorithm to the server.

[0054] When the server receives the connection establishment request sent by the client and agrees to the client's connection establishment request, it issues a response to the connection establishment request; when the client receives the response from the server to the connection establishment request, it sends the communication protocol and the encryption algorithm to the server to enable the server to confirm the communication protocol and the encryption algorithm.

[0055] It should be noted that the communication protocol is the communication protocol between the client and the server. The communication protocol contains information such as the name and version number of the protocol. The encryption algorithm can be, but is not limited to, the RSA encryption algorithm, and can also be other asymmetric encryption algorithms. The present disclosure does not limit this.

[0056] In step S303, after receiving the response from the server to the communication protocol and the encryption algorithm, generate the public key and private key of the encryption algorithm, and send the public key to the server.

[0057] The client sends the communication protocol and the encryption algorithm to the server. The server confirms the communication protocol and the encryption algorithm, and sends a confirmation response to the client. After the client receives the response from the server to the communication protocol and the encryption algorithm, it generates the public key and private key of the encryption algorithm, and sends the public key to the server in plain text. The encryption algorithm can be, but is not limited to, the RSA encryption algorithm. In one implementation, after receiving the public key, the server generates a 256-bit shared key, and then generates an encryption key, a client initialization vector, and a server initialization vector based on the shared key. Specifically: using the shared key as the initial value, generating a random string of a specified length using a pseudo-random algorithm, and intercepting the numbers at the specified positions of the random string as the encryption key, the client initialization vector, and the server initialization vector. The public key is used for the server to encrypt the generated shared key, and the private key is used for the client to decrypt the encrypted shared key. The server encrypts the shared key using the public key to obtain an encrypted shared key, and then sends the encrypted shared key to the client.

[0058] In step S304, collect the encrypted shared key of the server in the cluster.

[0059] The client receives the encrypted shared key sent by the server in the cluster; the encrypted shared key is obtained by the server encrypting the shared key using an encryption algorithm. For example, the public key of the RSA encryption algorithm can be used to encrypt the shared key to obtain the encrypted shared key; the shared key is used to generate an encryption key, a client initialization vector, and a server initialization vector in subsequent steps.

[0060] In step S305, an encryption key, a client initialization vector, and a server initialization vector are generated based on the encrypted shared key.

[0061] First, decrypt the encrypted shared key based on the same encryption algorithm as the server to obtain the shared key, and then generate an encryption key, a client initialization vector, and a server initialization vector based on the shared key. Exemplarily, assuming that the server encrypts the shared key using the public key of the RSA encryption algorithm to obtain the encrypted shared key, then the client can decrypt the encrypted shared key using the private key of the RSA encryption algorithm to obtain the shared key, and then use the shared key as the initial value to generate a random string of a specified length using a pseudo-random algorithm, and intercept the numbers at the specified positions of the random string as the encryption key, the client initialization vector, and the server initialization vector respectively. It should be noted that the specified length and the specified position can be determined based on human experience or other feasible methods, and the present disclosure does not limit this.

[0062] In step S306, construct the license information of the client, and encrypt the license information using the encryption key and the client initialization vector to obtain the encrypted license information.

[0063] The meaning of the license information in this step is the same as that described in step S203, and specific reference can be made to the above description.

[0064] After constructing the license information, encrypt the license information by combining the encryption key and the client initialization vector in the cipher block chaining mode to obtain the encrypted license information. Exemplarily, encrypt the client host information and the license information by combining the encryption key and the client initialization vector in the cipher block chaining mode to generate the encrypted license information, and intercept the numbers at the specified positions of the encrypted license information to obtain a new client initialization vector, and the new client initialization vector is used to encrypt the license information generated by the client next time. It should be noted that the host information can be information such as the host name or IP address of the client; the specified position can be determined based on human experience or other feasible methods, and the present disclosure does not limit this.

[0065] In step S307, send the encrypted license information to the server.

[0066] The encrypted license information is used to instruct the server to decrypt the encrypted license information by using the cipher block chaining mode in combination with the encryption key and the client initialization vector to obtain the license information, and to verify the license information to obtain a verification result, and to encrypt the verification result by using the cipher block chaining mode in combination with the encryption key and the server initialization vector to obtain an encrypted verification result.

[0067] Exemplarily, the client sends the encrypted license information to the server. The server receives the encrypted license information and decrypts the encrypted license information by using the cipher block chaining mode in combination with the encryption key and the client initialization vector to obtain the license information and the client host information. Then, the server verifies the license information and the client host information to obtain a verification result, encrypts the verification result by using the cipher block chaining mode in combination with the encryption key and the server initialization vector to obtain an encrypted verification result, and intercepts the digits at the specified position of the encrypted verification result to obtain a new server initialization vector. The server is also used to send the encrypted verification result to the client, where the new server initialization vector is used by the server to encrypt the verification result generated next time.

[0068] It should be noted that the verification result is obtained by the server according to the verification of the license information, including information such as whether the client has the running permission, which software can be run, and what functions can be used. For example, if the license information of the client is incorrect or exceeds the license limit of the server, the client cannot run.

[0069] In step S308, receive the encrypted verification result from the server, and decrypt the encrypted verification result by using the encryption key and the server initialization vector to obtain the verification result.

[0070] The client receives the encrypted verification result fed back by the server. After receiving the encrypted verification result fed back by the server, intercept the digits at the specified position of the encrypted verification result to obtain a new server initialization vector; the new server initialization vector is used by the client to decrypt the encrypted verification result generated by the server next time.

[0071] The client decrypts the encrypted verification result by using the cipher block chaining mode in combination with the encryption key and the server initialization vector to obtain the verification result, and determines whether it has the running permission and which software can be run and what functions can be used according to the verification result.

[0072] After the client obtains the verification result of the current license information, after waiting for a certain period of time, it can construct new license information, encrypt the new license information by using the encryption key and the new client initialization vector to generate new encrypted license information, and send it to the server, and repeat steps S306 - 308 to ensure the authorization of the new license information.

[0073] Please refer to Figure 4 ,Figure 4 The flowchart of a trust verification method shown in an exemplary embodiment of the present disclosure. This method is executed by a computer device, for example, by Figure 1 the server in the cluster shown. The server first receives a connection establishment request sent by the client, sends a response to the connection establishment request to the client. After receiving the response, the client sends the communication protocol and encryption algorithm to the server for confirmation. The server receives the communication protocol and encryption algorithm sent by the client and conducts confirmation. After the client receives the confirmation response from the server for the communication protocol and encryption algorithm, it generates an encryption algorithm key pair, that is, the public key and private key of the encryption algorithm, and sends the public key to the server in plain text. After receiving the public key, the server executes the steps as Figure 4 shown:

[0074] In step S401, encrypt the shared key to generate an encrypted shared key, and send the encrypted shared key to the client.

[0075] After receiving the public key, the server generates an encrypted shared key and sends the encrypted shared key to the client. The encrypted shared key is obtained by encrypting the shared key using the encryption algorithm. In one implementation, after receiving the public key, the server generates a 256-bit shared key, encrypts the 256-bit shared key using the public key to obtain the encrypted shared key, and sends the encrypted shared key to the client.

[0076] In step S402, generate an encryption key, a client initialization vector, and a server initialization vector based on the shared key.

[0077] Exemplarily, use the shared key as the initial value, use the same pseudo-random algorithm as the client to generate a random string of a specified length, and intercept the numbers at the specified positions of the random string as the encryption key, the client initialization vector, and the server initialization vector respectively. It should be noted that the specified length and the specified positions can be determined based on empirical data or other feasible methods, and the present disclosure does not limit this. Among them, the meanings and functions of the encryption key, the client initialization vector, and the server initialization vector are the same as those of the encryption key, the client initialization vector, and the server initialization vector described in step S201. Specifically, reference can be made to the description in step S201.

[0078] In step S403, receive the encrypted permission information sent by the client, and decrypt the encrypted permission information according to the encryption key and the client initialization vector to obtain the permission information.

[0079] After receiving the encrypted permission information sent by the client, intercept the numbers at the specified positions of the encrypted permission information to obtain a new client initialization vector; the new client initialization vector is used by the server to decrypt the encrypted permission information generated by the client next time.

[0080] After receiving the encrypted license information sent by the client, use the cipher block chaining mode in combination with the encryption key and the client initialization vector to decrypt the encrypted license information to obtain the client host information and the license information, and record the client host information. The client host information may be the host name, IP address, etc. of the client.

[0081] It should be noted that the license information may be embodied as a license file, and this license file includes at least one of the following information: the authorization information of the client, the node information of the client, and the restriction information of the client. Among them, the authorization information of the client is the information used to measure whether the client can be authorized, the node information of the client is the node location and the number of nodes of the client, and the restriction information of the client is the individual restriction information for each client, such as allowing the client to use some software and functions or prohibiting the client from using some software and functions.

[0082] It should be noted that after using the cipher block chaining mode in combination with the encryption key and the client initialization vector to decrypt the encrypted license information to obtain the license information, it further includes: recording the number of times of decrypting the encrypted license information. When the number of times is greater than a predetermined threshold, it indicates that the shared key has reached the upper limit of use, and using it again may pose a security risk. At this time, a reset response needs to be sent, that is, clearing the key pair of the shared key and the encryption algorithm, generating a new encryption algorithm key pair and a new shared key, and generating a first encryption key, a first client initialization vector, and a first server initialization vector based on the new shared key. The first encryption key and the first client initialization vector can be used together to encrypt / decrypt the new license information of the client, and the first encryption key and the first server initialization vector can be used together to encrypt / decrypt the new verification result of the server to ensure the security of data interaction between the client and the server; when the number of times is less than or equal to the predetermined threshold, step S404 is executed.

[0083] In step S404, verify the license information to obtain a verification result, and encrypt the verification result according to the encryption key and the server initialization vector to obtain an encrypted verification result.

[0084] The server verifies the license information of the client to obtain a verification result. Exemplarily, the server obtains the verification result according to the license information of the client and the host information of the client; then uses the cipher block chaining mode in combination with the encryption key and the server initialization vector to encrypt the verification result to obtain an encrypted verification result, and intercepts the number at the specified position of the encrypted verification result to obtain a new server initialization vector. The server is also used to send the encrypted verification result to the client. Among them, the new server initialization vector is used by the server to encrypt the next generated verification result.

[0085] It should be noted that the verification result is obtained by the server based on the license information verification, including information such as whether the client has the running permission, which software can be run, and what functions can be used.

[0086] In step S405, the encrypted verification result is sent to the client.

[0087] The server sends the encrypted verification result to the client. After receiving the encrypted verification result, the client uses the cipher block chaining mode in combination with the encryption key and the server initialization vector to decrypt the encrypted verification result to obtain the verification result, and determines whether it has the running permission and which software can be run and what functions can be used based on the verification result. For example, if the license information of the client is incorrect or exceeds the license limit of the server, the client cannot run.

[0088] It should be noted that after the server sends the encrypted verification result to the client, after waiting for a certain period of time, new encrypted license information can be received, and then steps S401 - 405 are repeated, that is, the new encrypted license information is decrypted using the cipher block chaining mode in combination with the encryption key and the new client initialization vector to obtain the new license information, then the new license information is verified to obtain the new verification result, and the new verification result is encrypted using the encryption key and the new server initialization vector to obtain the new encrypted verification result, and the new encrypted verification result is sent to the client.

[0089] In summary, the trusted verification method provided by the present disclosure includes: a client in a cluster can receive an encrypted shared key from a server in the cluster, generate an encryption key, a client initialization vector, and a server initialization vector based on the encrypted shared key, construct permission information of the client, encrypt the permission information using the encryption key and the client initialization vector to obtain encrypted permission information, send the encrypted permission information to the server, where the encrypted permission information is used to instruct the server to decrypt the encrypted permission information using the encryption key and the client initialization vector to obtain the permission information, and to instruct the server to verify the permission information to obtain a verification result, and encrypt the verification result using the encryption key and the server initialization vector to obtain an encrypted verification result; the client receives the encrypted verification result fed back by the server, and decrypts the encrypted verification result using the encryption key and the server initialization vector to obtain the verification result; taking one node in the cluster as the server and other nodes as clients, the client sends the encrypted permission information to the server, the server decrypts the encrypted permission information to obtain the permission information, verifies the permission information to obtain a verification result, encrypts the verification result to obtain an encrypted verification result, the client receives the encrypted verification result, and decrypts the encrypted verification result to obtain the verification result, thereby obtaining the reliability and security of the client permission information. Encrypting the permission information and the verification result through an encryption algorithm ensures the security of node communication in the cluster.

[0090] Figure 5 It is a block diagram of a trusted verification device shown in an exemplary embodiment of the present disclosure. Referring to Figure 5 , the trusted verification device 50 includes a receiving module 501, a first generating module 502, an encrypting module 503, a first sending module 504, and a first decrypting module 505.

[0091] The receiving module 501 is configured to receive an encrypted shared key from a server in the cluster;

[0092] The first generating module 502 is configured to generate an encryption key, a client initialization vector, and a server initialization vector based on the encrypted shared key;

[0093] The encrypting module 503 is configured to construct permission information of the client, and encrypt the permission information using the encryption key and the client initialization vector to obtain encrypted permission information;

[0094] The first sending module 504 is configured to send the encrypted permission information to the server; the encrypted permission information is used to instruct the server to decrypt the encrypted permission information using the encryption key and the client initialization vector to obtain the permission information, and to instruct the server to verify the permission information to obtain a verification result, and encrypt the verification result using the encryption key and the server initialization vector to obtain an encrypted verification result;

[0095] The first decryption module 505 is configured to receive the encrypted verification result from the server, decrypt the encrypted verification result using the encryption key and the server initialization vector to obtain the verification result.

[0096] Optionally, the first decryption module 505 is further configured to determine whether the client has the running permission according to the verification result; intercept the numbers at the specified position of the encrypted verification result to obtain a new server initialization vector; the new server initialization vector is used for the client to decrypt the encrypted verification result generated by the server next time.

[0097] Optionally, the first sending module 504 is further configured to send a connection establishment request to the server;

[0098] The receiving module 501 is further configured to, after receiving the response of the server to the connection establishment request, send a communication protocol and an encryption algorithm to the server; the communication protocol is used for communication between the client and the server, and the encryption algorithm is used to encrypt the shared key to obtain the encrypted shared key;

[0099] After receiving the response of the server to the communication protocol and the encryption algorithm, generate a public key and a private key of the encryption algorithm, and send the public key to the server.

[0100] Optionally, the first generation module 502 is further configured to decrypt the encrypted shared key using the private key of the encryption algorithm to obtain the shared key;

[0101] Use the shared key as the initial value, generate a random string with a specified length using a pseudo-random algorithm, and intercept the numbers at the specified position of the random string as the encryption key, the client initialization vector, and the server initialization vector.

[0102] Optionally, the first sending module 504 is further configured to encrypt the client host information and the license information using the encryption key and the client initialization vector to generate encrypted license information;

[0103] Send the encrypted license information to the server;

[0104] Intercept the numbers at the specified position of the encrypted license information to obtain a new client initialization vector; the new client initialization vector is used to encrypt the license information generated by the client next time.

[0105] Figure 6 It is a block diagram of a trusted verification device shown in an exemplary embodiment of the present disclosure. Refer to Figure 6, the trusted verification device 60 includes a second generation module 601, a second decryption module 602, a verification module 603, and a second sending module 604.

[0106] The second generation module 601 is configured to encrypt the shared key to generate an encrypted shared key, and send the encrypted shared key to the client;

[0107] The second generation module 601 is further configured to generate an encryption key, a client initialization vector, and a server initialization vector based on the shared key;

[0108] The second decryption module 602 is configured to receive the encrypted permission information sent by the client, and decrypt the encrypted permission information according to the encryption key and the client initialization vector to obtain the permission information;

[0109] The verification module 603 is configured to verify the permission information to obtain a verification result, and encrypt the verification result according to the encryption key and the server initialization vector to obtain an encrypted verification result;

[0110] The second sending module 604 is configured to send the encrypted verification result to the client.

[0111] Optionally, the second decryption module 602 is further configured to receive a connection establishment request sent by the client;

[0112] The second sending module 604 is further configured to send a response to the connection establishment request to the client;

[0113] The second decryption module 602 is further configured to receive the communication protocol and encryption algorithm sent by the client; the communication protocol is used for communication between the client and the server, and the encryption algorithm is used to encrypt the shared key to obtain the encrypted shared key;

[0114] After responding to the communication protocol and the encryption algorithm sent by the client, the public key of the encryption algorithm sent by the client is received.

[0115] Optionally, the second generation module 601 is further configured to use the shared key as an initial value, generate a random string of a specified length using a pseudo-random algorithm, and intercept the numbers at the specified positions of the random string as the encryption key, the client initialization vector, and the server initialization vector.

[0116] Optionally, the verification module 603 is further configured to record the number of times of decrypting the encrypted permission information;

[0117] In the case that the number of times is greater than a predetermined threshold, clear the shared key and the key pair of the encryption algorithm, and generate a new key pair of the encryption algorithm and a new shared key;

[0118] In the case that the number of times is less than or equal to the predetermined threshold, verify the license information to obtain the verification result, and encrypt the verification result according to the server initialization vector to obtain an encrypted verification result;

[0119] Intercept the number at a specified position of the encrypted verification result to obtain a new server initialization vector; the new server initialization vector is used to encrypt the verification result generated by the server next time.

[0120] Optionally, the verification module 603 is further configured to intercept the number at a specified position of the encrypted license information to obtain a new client-side vector; the new client initialization vector is used by the server to decrypt the encrypted license information generated by the client next time.

[0121] Regarding the device in the above embodiments, the specific manners in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0122] Figure 7 It is a block diagram of an electronic device 500 shown according to an exemplary embodiment. For example, the electronic device 500 may be provided as Figure 1 the client or server shown. Referring to Figure 7 , the electronic device 500 includes a processor 522, the number of which may be one or more, and a memory 532 for storing computer programs executable by the processor 522. The computer programs stored in the memory 532 may include one or more modules each corresponding to a set of instructions. In addition, the processor 522 may be configured to execute the computer program to perform the above-mentioned trusted verification method.

[0123] In addition, the electronic device 500 may further include a power supply component 526 and a communication component 550. The power supply component 526 may be configured to perform power management of the electronic device 500, and the communication component 550 may be configured to implement communication of the electronic device 500, for example, wired or wireless communication. In addition, the electronic device 500 may further include an input / output (I / O) interface 558. The electronic device 500 may operate based on an operating system stored in the memory 532, such as Windows Server TM , Mac OSX TM , Unix TM , Linux TM and so on.

[0124] In another exemplary embodiment, there is also provided a computer-readable storage medium including program instructions, which, when executed by a processor, implement the steps of the above-described trusted verification method. For example, the non-transitory computer-readable storage medium may be the above-described memory 532 including program instructions, and the above program instructions may be executed by the processor 522 of the electronic device 500 to complete the above-described trusted verification method.

[0125] In another exemplary embodiment, there is also provided a computer program product, which includes a computer program executable by a programmable device, and the computer program has a code portion for executing the above-described trusted verification method when executed by the programmable device.

[0126] The preferred embodiments of the present disclosure have been described in detail above in conjunction with the accompanying drawings. However, the present disclosure is not limited to the specific details in the above embodiments. Within the scope of the technical concept of the present disclosure, various simple modifications can be made to the technical solutions of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0127] In addition, it should be noted that, in the above specific embodiments, the various specific technical features described can be combined in any appropriate manner without conflict. To avoid unnecessary repetition, the present disclosure will not separately describe various possible combination manners.

[0128] In addition, any combination can be made between various different embodiments of the present disclosure, as long as it does not violate the idea of the present disclosure, and it should also be regarded as the content disclosed by the present disclosure.

Claims

1. A trusted verification method, characterized in that Applied to a client in a cluster, the method includes: Receiving an encrypted shared key from a server in the cluster; Generating an encryption key, a client initialization vector, and a server initialization vector based on the encrypted shared key; Constructing the license information of the client, and encrypting the license information using the encryption key and the client initialization vector to obtain encrypted license information; Sending the encrypted license information to the server; the encrypted license information is used to instruct the server to decrypt the encrypted license information using the encryption key and the client initialization vector to obtain the license information, and to instruct the server to verify the license information to obtain a verification result, and encrypting the verification result using the encryption key and the server initialization vector to obtain an encrypted verification result; Receiving the encrypted verification result from the server, and decrypting the encrypted verification result using the encryption key and the server initialization vector to obtain the verification result.

2. The method according to claim 1, wherein The method further includes: Determining whether the client has the running permission according to the verification result; Intercepting the numbers at the specified positions of the encrypted verification result to obtain a new server initialization vector; the new server initialization vector is used for the client to decrypt the encrypted verification result generated by the server next time.

3. The method according to claim 1, characterized in that, Before the step of receiving the encrypted shared key from the server in the cluster, it further includes: Sending a connection establishment request to the server; After receiving the response of the server to the connection establishment request, sending a communication protocol and an encryption algorithm to the server; the communication protocol is used for communication between the client and the server, and the encryption algorithm is used to encrypt the shared key to obtain the encrypted shared key; After receiving the response of the server to the communication protocol and the encryption algorithm, generating a public key and a private key of the encryption algorithm, and sending the public key to the server.

4. The method according to claim 3, characterized in that, The generating an encryption key, a client initialization vector, and a server initialization vector based on the encrypted shared key includes: Decrypting the encrypted shared key using the private key of the encryption algorithm to obtain the shared key; Using the shared key as an initial value, generating a random string of a specified length using a pseudo-random algorithm, and intercepting the numbers at the specified positions of the random string as the encryption key, the client initialization vector, and the server initialization vector.

5. The method according to claim 1, wherein The constructing the license information of the client, and encrypting the license information using the encryption key and the client initialization vector to obtain encrypted license information includes: Encrypting the client host information and the license information using the encryption key and the client initialization vector to generate encrypted license information; Sending the encrypted license information to the server; Intercepting the numbers at the specified positions of the encrypted license information to obtain a new client initialization vector; the new client initialization vector is used to encrypt the license information generated by the client next time.

6. A trusted verification method, characterized in that, Applied to a server in a cluster, the method includes: Encrypt the shared key to generate an encrypted shared key, and send the encrypted shared key to the client, where the client is any node other than the server in the cluster; Generate an encryption key, a client initialization vector, and a server initialization vector based on the shared key; Receive the encrypted permission information sent by the client, and decrypt the encrypted permission information according to the encryption key and the client initialization vector to obtain the permission information; Verify the permission information to obtain a verification result, and encrypt the verification result according to the encryption key and the server initialization vector to obtain an encrypted verification result; Send the encrypted verification result to the client.

7. The method according to claim 6, characterized in that, Before the step of encrypting the shared key to generate an encrypted shared key and sending the encrypted shared key to the client, it further includes: Receive the connection establishment request sent by the client; Send a response to the connection establishment request to the client; Receive the communication protocol and encryption algorithm sent by the client; the communication protocol is used for communication between the client and the server, and the encryption algorithm is used to encrypt the shared key to obtain the encrypted shared key; After responding to the communication protocol and the encryption algorithm sent by the client, receive the public key of the encryption algorithm sent by the client.

8. The method according to claim 7, wherein The generating an encryption key, a client initialization vector, and a server initialization vector based on the shared key includes: Use the shared key as the initial value, generate a random string of a specified length using a pseudo-random algorithm, and intercept the numbers at the specified positions of the random string as the encryption key, the client initialization vector, and the server initialization vector.

9. The method according to claim 6, wherein After the step of receiving the encrypted permission information sent by the client and decrypting the encrypted permission information according to the encryption key and the client initialization vector to obtain the permission information, it further includes: Record the number of times of decrypting the encrypted permission information; In the case where the number of times is greater than a predetermined threshold, clear the shared key and the key pair of the encryption algorithm, and generate a new key pair of the encryption algorithm and a new shared key; In the case where the number of times is less than or equal to the predetermined threshold, verify the permission information to obtain the verification result, and encrypt the verification result according to the encryption key and the server initialization vector to obtain the encrypted verification result; Intercept the numbers at the specified positions of the encrypted verification result to obtain a new server initialization vector; the new server initialization vector is used to encrypt the verification result generated by the server next time.

10. The method according to claim 6, characterized in that After the step of receiving the encrypted permission information sent by the client, it further includes: Intercept the numbers at the specified positions of the encrypted permission information to obtain a new client initialization vector; the new client initialization vector is used by the server to decrypt the encrypted permission information generated by the client next time.

11. A trusted verification device, characterized in that, Applied to a client in a cluster, the device includes: A receiving module, configured to receive the encrypted shared key from the server in the cluster; A first generating module, configured to generate an encryption key, a client initialization vector, and a server initialization vector based on the encrypted shared key; An encryption module, configured to construct the license information of the client, and encrypt the license information by using the encryption key and the client initialization vector to obtain encrypted license information; A first sending module, configured to send the encrypted license information to the server; the encrypted license information is used to instruct the server to decrypt the encrypted license information by using the encryption key and the client initialization vector to obtain the license information, and to instruct the server to verify the license information to obtain a verification result, and encrypt the verification result by using the encryption key and the server initialization vector to obtain an encrypted verification result; A first decryption module, configured to receive the encrypted verification result from the server, and decrypt the encrypted verification result by using the encryption key and the server initialization vector to obtain the verification result.

12. A trusted verification device, characterized in that, Applied to a server in a cluster, the apparatus includes: A second generation module, configured to encrypt a shared key to generate an encrypted shared key, and send the encrypted shared key to a client, where the client is any node other than the server in the cluster; The second generation module is further configured to generate an encryption key, a client initialization vector, and a server initialization vector based on the shared key; A second decryption module, configured to receive an encrypted license request sent by the client, and decrypt the encrypted license information by using the encryption key and the client initialization vector to obtain the license information; A verification module, configured to verify the license information to obtain a verification result, and encrypt the verification result by using the encryption key and the server initialization vector to obtain an encrypted verification result; A second sending module, configured to send the encrypted verification result to the client.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-5, or when executed by a processor, it implements the steps of the method according to any one of claims 6-10.

14. An electronic device, characterized in that, Including: A memory, on which a computer program is stored; A processor, configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1-5, or execute the computer program in the memory to implement the steps of the method according to any one of claims 6-10.

Images