A mimicry distributed storage system and a message synchronization distribution method thereof

Abstract

The application provides a mimicry distributed storage system synchronization message distribution method, comprising the following steps: an input agent module generates a first message number SID according to a first built-in marking generation mechanism every preset time interval, encapsulates the first message number SID into a synchronization SID data packet, and transmits the synchronization SID data packet to each heterogeneous MON execution body; after the heterogeneous MON execution body receives the synchronization SID data packet sent by the input agent module, the synchronization SID data packet is parsed, the first message number SID is obtained, and the first message number SID and a message to be synchronized are encapsulated into a ruling data packet and sent to a ruler; after the ruler receives the ruling data packet, the ruling data packets with the same message number SID are divided into a group, and the ruling data packets belonging to the same group are ruled and output according to a preset ruling strategy.

Description

Technical Field

[0001] This invention relates to a mimicry distributed storage system, and more specifically, to a method for synchronous message distribution in a mimicry distributed storage system. Background Technology

[0002] Academician Wu Jiangxing's invention of the cyberspace mimicry defense theory has overturned the traditional passive defense concept in cyberspace. Its dynamic redundancy architecture and feedback control mechanism for actively sensing unknown threats greatly enhance the inherent security characteristics of cyberspace, change the rules of the game in cyberspace defense, and provide a brand-new and creative solution for network security.

[0003] Mimicry defense technology has been included in the national strategy. As mimicry defense technology becomes more perfect and mature, more and more network elements are beginning to adopt the concept of mimicry defense to improve their own security and resist security threats based on unknown vulnerabilities and backdoors by enhancing their own inherent security characteristics.

[0004] CN202010645217.3 presents a mimicry distributed storage system, data reading and writing methods, and a readable storage medium. This paper improves upon existing distributed storage systems by mimicking the MON module in the distributed storage system. This prevents attacks from obtaining the storage system's data index and thus the stored data by controlling a specific MON service unit within a heterogeneous MON executor. This ensures the security and reliability of the MON service unit while shortening data access time.

[0005] It is understood that after the input proxy module receives the business request message sent by the client, it generates a mimicry request ID corresponding to the business request information, encapsulates the mimicry request ID and the business request information into a business request packet, and transmits it to N heterogeneous MON executors for response. The response result is then reassembled with the mimicry request ID into a response data packet and sent to the adjudication module for adjudication output.

[0006] However, the mimic executor MON service also spontaneously sends internal cluster messages to the outside of the mimic boundary. For example, when the authoritative OSDMap held by the mimic executor MON service changes, it needs to push the OSDMap to those OSD nodes that have detected the cluster change. In addition, the Monitor will also randomly select some OSDs to send OSDMaps. Because these push messages do not go through the input broker module, they lack a message ID (SID), which causes the adjudication service to be unable to distinguish the source and order of the push messages, thus making it unable to make adjudications.

[0007] In order to solve the above problems, people have been seeking an ideal technological solution. Summary of the Invention

[0008] The purpose of this invention is to address the shortcomings of existing technologies by providing a method for message synchronization and distribution in a mimicry distributed storage system.

[0009] To achieve the above objectives, the technical solution adopted by this invention is: a method for synchronous message distribution in a mimicry distributed storage system, comprising the following steps:

[0010] The input agent module generates a first message number (SID) according to the first built-in tag generation mechanism at preset time intervals, and encapsulates the first message number (SID) into a synchronization SID data packet, which is then transmitted to each heterogeneous MON execution entity.

[0011] When the heterogeneous MON executor receives the synchronization SID data packet sent by the input agent module, it parses the synchronization SID data packet, obtains the first message number SID, and encapsulates the first message number SID and the message to be synchronized into an adjudication data packet and sends it to the adjudicator.

[0012] After receiving the arbitration data packet, the arbitrator groups the arbitration data packets with the same message number (SID) into a group and outputs the arbitration results for the arbitration data packets belonging to the same group according to the preset arbitration strategy.

[0013] In one embodiment, after the heterogeneous MON executor generates a message to be synchronized, it determines whether the first message number (SID) has been obtained. If not, it continues to wait until the first message number (SID) is obtained. Then, the first message number (SID) and the message to be synchronized are encapsulated into an adjudication data packet, and the message to be synchronized is deleted.

[0014] In another embodiment, after the heterogeneous MON executor generates a message to be synchronized, it determines whether the first message number SID has been obtained. If not, the message to be synchronized is encapsulated into an adjudication data packet and sent to the adjudicator.

[0015] Upon receiving the arbitration data packet, the arbitrator finds that there is no first message number (SID), discards the arbitration data packet, and sends an exception message to the input agent module and the corresponding heterogeneous MON executor.

[0016] After receiving the abnormal message, the input agent module generates a first message number (SID) according to the first built-in tag generation mechanism, and encapsulates the first message number (SID) into a synchronization SID data packet, which is then transmitted to each heterogeneous MON execution entity.

[0017] After receiving the exception message, the heterogeneous MON executor continues to wait until it obtains the first message number (SID). Then, it encapsulates the first message number (SID) and the previous message to be synchronized into an adjudication data packet and sends it to the adjudicator, and deletes the message to be synchronized.

[0018] The present invention also provides a mimicry distributed storage system, comprising:

[0019] The input agent includes a first built-in tag generation module, a second built-in tag generation module, and a replication and distribution module. The first built-in tag generation module is configured to generate a first message number (SID) according to a first built-in tag generation mechanism at preset time intervals. The second built-in tag generation module is configured to generate a second message tag (SID) according to a second built-in tag generation mechanism after receiving a front-end request. The replication and distribution module is configured to encapsulate the first message number (SID) into a synchronization SID data packet and transmit it to each heterogeneous MON execution entity. It is also configured to encapsulate the second message tag (SID) and the front-end request into a front-end request data packet and transmit it to each heterogeneous MON execution entity.

[0020] The heterogeneous MON executor is configured to receive a synchronization SID data packet sent by the input proxy module, parse the synchronization SID data packet to obtain a first message number SID, encapsulate the first message number SID and the message to be synchronized into an adjudication data packet and send it to the adjudicator; and is also configured to receive a front-end request data packet sent by the input proxy module, parse the front-end request data packet to obtain a second message number SID and the front-end request, generate response information in response to the front-end request, and encapsulate the second message number SID and the response information into an adjudication data packet and send it to the adjudicator.

[0021] The arbiter is configured to receive arbitration data packets, group arbitration data packets with the same message number (SID) into a group, and arbitrate the arbitration data packets belonging to the same group according to a preset arbitration strategy.

[0022] This invention has significant substantive features and remarkable progress compared to existing technologies. Specifically, by having the input agent module generate a first message number (SID) at preset time intervals and distribute it to heterogeneous MON executors, the heterogeneous MON executors can encapsulate the first message number (SID) and the message to be synchronized into a decision data packet and send it to the arbitrator. After receiving the decision data packet, the arbitrator groups decision data packets with the same message number (SID) and outputs the decision data packets belonging to the same group according to a preset decision strategy. This allows messages that are spontaneously synchronized by heterogeneous MON executors to be decided, improving the security and integrity of the mimicry distributed storage system.

[0023] In one embodiment of the present invention, after the heterogeneous MON executor generates a message to be synchronized, it will not encapsulate the first message number SID and the message to be synchronized into a decision data packet until it obtains the first message number SID. This mechanism ensures that the message to be synchronized will not be sent to the arbitrator separately, thus preventing the decision service from being unable to make decisions because it cannot distinguish the source and order of the pushed messages.

[0024] In one embodiment of the present invention, after a heterogeneous MON executor generates a message to be synchronized, the message to be synchronized is encapsulated into an adjudication data packet and sent to an adjudicator. The adjudicator then sends an exception message to the input agent module and the corresponding heterogeneous MON executor to accelerate the generation of the first message number (SID) and avoid the situation where the heterogeneous MON executor cannot synchronize the message to the outside of the mimicry boundary in a timely manner due to waiting for the first message number (SID) for a long time.

[0025] Furthermore, this invention also provides a mimicry distributed storage system that enables the adjudication of both messages spontaneously pushed by heterogeneous MON executors and response messages generated in response to external requests, thereby improving the security and integrity of the mimicry distributed storage system. Moreover, this method can maintain the existing mimicry storage cluster unchanged, facilitating secure upgrades and transformations, and has good applicability. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating the synchronous message distribution method of the present invention.

[0027] Figure 2 This is a schematic diagram of the structure of the mimicry distributed storage system of the present invention. Detailed Implementation

[0028] The technical solution of the present invention will be further described in detail below through specific embodiments.

[0029] Example 1

[0030] like Figure 1 As shown, this embodiment provides a method for synchronous message distribution in a mimicry distributed storage system, including the following steps:

[0031] The input agent module generates a first message number (SID) according to the first built-in tag generation mechanism at preset time intervals, and encapsulates the first message number (SID) into a synchronization SID data packet, which is then transmitted to each heterogeneous MON execution entity.

[0032] When the heterogeneous MON executor receives the synchronization SID data packet sent by the input agent module, it parses the synchronization SID data packet, obtains the first message number SID, and encapsulates the first message number SID and the message to be synchronized into an adjudication data packet and sends it to the adjudicator.

[0033] After receiving the arbitration data packet, the arbitrator groups the arbitration data packets with the same message number (SID) into a group and outputs the arbitration results for the arbitration data packets belonging to the same group according to the preset arbitration strategy.

[0034] It is understood that the first message number SID includes the sequence marker variable requests and the random marker seed corresponding to the synchronization message. The purpose is to give each message to be synchronized a unique number, so that the adjudicator can distinguish the source and order of the messages to be synchronized based on the message number SID, thereby facilitating adjudication.

[0035] In this embodiment, the input agent module generates a first message number (SID) at preset time intervals and distributes it to the heterogeneous MON executors. This allows the heterogeneous MON executors to encapsulate the first message number (SID) and the message to be synchronized into a decision data packet and send it to the arbitrator. After receiving the decision data packet, the arbitrator groups decision data packets with the same message number (SID) and outputs decision data packets belonging to the same group according to a preset decision strategy. This allows messages that are spontaneously synchronized by the heterogeneous MON executors to be decided, improving the security and integrity of the mimicry distributed storage system.

[0036] In specific implementation, the preset adjudication strategy can be designed according to specific needs. For example, a majority adjudication strategy can be adopted, in which the majority of consistent adjudication data packets are used as the adjudication result. Alternatively, a multi-strategy fusion approach can be adopted. For example, when the number of received adjudication data packets is 1, the adjudication data packet is used as the trusted adjudication result. When the number of received adjudication data packets is greater than 1 and is odd, the adjudication data packets with consistent content and a majority are used as the trusted adjudication result. When the number of received adjudication data packets is even: if all adjudication data packets are consistent, any adjudication data packet is used as the trusted adjudication result. If all adjudication data packets are inconsistent, and the voting result is M:N, the adjudication data packets with consistent content and a majority are used as the trusted adjudication result. Here, M is not equal to N. If all adjudication data packets are inconsistent, the voting result is P*(1:1), and the trusted weights corresponding to the heterogeneous MON cluster executors are the same, then no trusted adjudication result is output. If all adjudication data packets are inconsistent, the voting result is P*(1:1), and the trusted weights corresponding to the heterogeneous MON cluster executors are inconsistent, then the adjudication data packet corresponding to the heterogeneous MON cluster executor with the largest trusted weight is used as the trusted adjudication result.

[0037] It is understandable that the first message number SID is generated by the input agent module at preset time intervals according to the first built-in tag generation mechanism, while the message to be synchronized is generated by the heterogeneous MON executor according to the changes in the cluster state. Since the generation devices and generation mechanisms of the two are different, they cannot be completely synchronized and there will inevitably be a situation where they are generated one after the other.

[0038] For the case where the message to be synchronized is generated first and the first message ID (SID) is generated later, the following mechanism is designed: When the heterogeneous MON execution body generates the message to be synchronized, it determines whether the first message ID (SID) has been obtained. If not, it continues to wait until the first message ID (SID) is obtained. Then, the first message ID (SID) and the message to be synchronized are encapsulated into an adjudication data packet, and the message to be synchronized is deleted.

[0039] This mechanism ensures that messages to be synchronized are not sent to the arbitrator separately, eliminating the situation where the arbitrator service cannot make a decision because it cannot distinguish the source and order of the pushed messages.

[0040] For the scenario where the message to be synchronized is generated first, and the first message ID (SID) is generated later, the following mechanism is designed in another embodiment:

[0041] When the heterogeneous MON execution body generates a message to be synchronized, it determines whether the first message number SID has been obtained. If not, the message to be synchronized is encapsulated into an adjudication data packet and sent to the adjudicator.

[0042] Upon receiving the arbitration data packet, the arbitrator finds that there is no first message number (SID), discards the arbitration data packet, and sends an exception message to the input agent module and the corresponding heterogeneous MON executor.

[0043] After receiving the abnormal message, the input agent module generates a first message number (SID) according to the first built-in tag generation mechanism, and encapsulates the first message number (SID) into a synchronization SID data packet, which is then transmitted to each heterogeneous MON execution entity.

[0044] After receiving the exception message, the heterogeneous MON executor continues to wait until it obtains the first message number (SID). Then, it encapsulates the first message number (SID) and the previous message to be synchronized into an adjudication data packet and sends it to the adjudicator, and deletes the message to be synchronized.

[0045] In this mechanism, when a heterogeneous MON executor generates a message to be synchronized, the message is encapsulated into an adjudication data packet and sent to the adjudicator. The adjudicator then sends an exception message to the input agent module and the corresponding heterogeneous MON executor to accelerate the generation of the first message number (SID) and avoid the situation where the heterogeneous MON executor cannot synchronize the message to the outside of the mimicry boundary in a timely manner due to waiting for the first message number (SID) for a long time.

[0046] For the case where the first message ID (SID) is generated first and the message to be synchronized is generated later, the following mechanism is designed: when the heterogeneous MON execution entity obtains the first message ID (SID) by parsing the synchronization SID data packet, it determines whether there is a message to be synchronized. If not, the first message ID (SID) is discarded.

[0047] In this mechanism, by promptly deleting the first message number SID, it prevents the first message number SID generated earlier from being sent again before it is used, thereby occupying the memory of the heterogeneous MON execution entity.

[0048] For the case where the first message ID (SID) is generated first and the message to be synchronized is generated later, the following mechanism is designed: The validity period of the first message ID (SID) can also be set. When the heterogeneous MON execution entity obtains the first message ID (SID) by parsing the synchronization SID data packet, it determines whether there is a message to be synchronized. If there is no message, it continues to wait. If the validity period of the first message ID (SID) expires and no message to be synchronized is generated, the first message ID (SID) is deleted.

[0049] Example 2

[0050] This embodiment provides a pseudo-distributed storage system, such as Figure 2 As shown, it includes:

[0051] The input agent includes a first built-in tag generation module, a second built-in tag generation module, and a replication and distribution module. The first built-in tag generation module is configured to generate a first message number (SID) according to a first built-in tag generation mechanism at preset time intervals. The second built-in tag generation module is configured to generate a second message tag (SID) according to a second built-in tag generation mechanism after receiving a front-end request. The replication and distribution module is configured to encapsulate the first message number (SID) into a synchronization SID data packet and transmit it to each heterogeneous MON execution entity. It is also configured to encapsulate the second message tag (SID) and the front-end request into a front-end request data packet and transmit it to each heterogeneous MON execution entity.

[0052] The heterogeneous MON executor is configured to receive a synchronization SID data packet sent by the input proxy module, parse the synchronization SID data packet to obtain a first message number SID, encapsulate the first message number SID and the message to be synchronized into an adjudication data packet and send it to the adjudicator; and is also configured to receive a front-end request data packet sent by the input proxy module, parse the front-end request data packet to obtain a second message number SID and the front-end request, generate response information in response to the front-end request, and encapsulate the second message number SID and the response information into an adjudication data packet and send it to the adjudicator.

[0053] The arbiter is configured to receive arbitration data packets, group arbitration data packets with the same message number (SID) into a group, and arbitrate the arbitration data packets belonging to the same group according to a preset arbitration strategy.

[0054] After the decision is made, the arbiter sends the decision result with the first message number (SID) to the target OSD for information synchronization; and sends the decision result with the second message number (SID) to the backend to respond to the frontend request.

[0055] In specific implementation, the first message number SID includes the sequence marker variable requests and the random marker seed corresponding to the synchronization message; the second message number SID includes the client's IP address, port identifier, the sequence marker variable requests and the random marker seed corresponding to the service request message.

[0056] In one embodiment, after the heterogeneous MON executor generates a message to be synchronized, it determines whether the first message number (SID) has been obtained. If not, it continues to wait until the first message number (SID) is obtained. Then, the first message number (SID) and the message to be synchronized are encapsulated into an adjudication data packet, and the message to be synchronized is deleted. This ensures that the message to be synchronized is not sent to the adjudicator separately, and prevents the adjudication service from being unable to distinguish the source and order of the pushed messages, thus avoiding the situation where the adjudication service cannot make adjudications.

[0057] In another embodiment, after the heterogeneous MON executor generates a message to be synchronized, it determines whether the first message number SID has been obtained. If not, the message to be synchronized is encapsulated into an adjudication data packet and sent to the adjudicator for adjudication output.

[0058] Upon receiving the arbitration data packet, the arbitrator finds that there is no first message number (SID), discards the arbitration data packet, and sends an exception message to the input agent module and the corresponding heterogeneous MON executor.

[0059] After receiving the abnormal message, the input agent module generates a first message number (SID) according to the first built-in tag generation mechanism, and encapsulates the first message number (SID) into a synchronization SID data packet, which is then transmitted to each heterogeneous MON execution entity.

[0060] After receiving an exception message, the heterogeneous MON executor continues to wait until it obtains the first message number (SID). Then, it encapsulates the first message number (SID) and the previous message to be synchronized into an adjudication data packet and sends it to the adjudicator, and deletes the message to be synchronized. This embodiment can avoid the situation where the message to be synchronized cannot be synchronized to the outside of the mimicry boundary in a timely manner due to the heterogeneous MON executor waiting for the first message number (SID) for a long time.

[0061] In another embodiment, after the heterogeneous MON executor obtains the first message number SID by parsing the synchronization SID data packet, it determines whether there is a message to be synchronized. If not, the first message number SID is discarded.

[0062] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for synchronous message distribution in a mimicry distributed storage system, characterized in that, Includes the following steps: The input agent module generates a first message number (SID) according to a first built-in tag generation mechanism at preset time intervals, and encapsulates the first message number (SID) into a synchronization SID data packet, which is then transmitted to each heterogeneous MON execution entity. The first message number (SID) includes the sequential tag variable requests and the random tag seed corresponding to the synchronization message. When the heterogeneous MON executor receives the synchronization SID data packet sent by the input agent module, it parses the synchronization SID data packet, obtains the first message number SID, and encapsulates the first message number SID and the message to be synchronized into an adjudication data packet and sends it to the adjudicator; the message to be synchronized is generated by the heterogeneous MON executor according to the changes in the cluster state; After receiving the arbitration data packet, the arbitrator groups the arbitration data packets with the same message number (SID) into a group and outputs the arbitration results for the arbitration data packets belonging to the same group according to the preset arbitration strategy.

2. The method for synchronous message distribution in a mimicry distributed storage system according to claim 1, characterized in that: When the heterogeneous MON executor generates a message to be synchronized, it determines whether the first message number (SID) has been obtained. If not, it continues to wait until the first message number (SID) is obtained. Then, it encapsulates the first message number (SID) and the message to be synchronized into an adjudication data packet and deletes the message to be synchronized.

3. The method for synchronous message distribution in a mimicry distributed storage system according to claim 1, characterized in that: When the heterogeneous MON executor generates a message to be synchronized, it determines whether the first message number SID has been obtained. If not, the message to be synchronized is encapsulated into a decision data packet and sent to the decision arbitrator for decision output. Upon receiving the arbitration data packet, the arbitrator finds that there is no first message number (SID), discards the arbitration data packet, and sends an exception message to the input agent module and the corresponding heterogeneous MON executor. After receiving the abnormal message, the input agent module generates a first message number (SID) according to the first built-in tag generation mechanism, and encapsulates the first message number (SID) into a synchronization SID data packet, which is then transmitted to each heterogeneous MON execution entity. After receiving the exception message, the heterogeneous MON executor continues to wait until it obtains the first message number (SID). Then, it encapsulates the first message number (SID) and the previous message to be synchronized into an adjudication data packet and sends it to the adjudicator, and deletes the message to be synchronized.

4. The method for synchronous message distribution in a mimicry distributed storage system according to claim 2 or 3, characterized in that: When the heterogeneous MON executor obtains the first message number SID by parsing the synchronization SID data packet, it determines whether there is a message to be synchronized. If not, it discards the first message number SID.

5. A mimicry distributed storage system, characterized in that, include: The input agent includes a first built-in tag generation module, a second built-in tag generation module, and a replication and distribution module. The first built-in tag generation module is configured to generate a first message number SID according to the first built-in tag generation mechanism at preset time intervals. The second built-in tag generation module is configured to generate a second message tag SID according to the second built-in tag generation mechanism after receiving a front-end request; the replication and distribution module is configured to encapsulate the first message number SID into a synchronization SID data packet and transmit it to each heterogeneous MON execution body respectively; and is configured to encapsulate the second message tag SID and the front-end request into a front-end request data packet and transmit it to each heterogeneous MON execution body respectively; the first message number SID includes the sequential tag variable requests and the random tag seed corresponding to the synchronization message; The heterogeneous MON executor is configured to receive a synchronization SID data packet sent by the input proxy module, parse the synchronization SID data packet to obtain a first message number SID, encapsulate the first message number SID and the message to be synchronized into an adjudication data packet and send it to the adjudicator; and is also configured to receive a front-end request data packet sent by the input proxy module, parse the front-end request data packet to obtain a second message number SID and the front-end request, respond to the front-end request to generate response information, and encapsulate the second message number SID and the response information into an adjudication data packet and send it to the adjudicator; the message to be synchronized is generated by the heterogeneous MON executor according to the changes in the cluster state; The arbiter is configured to receive arbitration data packets, group arbitration data packets with the same message number (SID) into a group, and arbitrate the arbitration data packets belonging to the same group according to a preset arbitration strategy.

6. The mimicry distributed storage system according to claim 5, characterized in that: The first message number SID includes the sequence marker variable requests and the random marker seed corresponding to the synchronous message; the second message number SID includes the client's IP address, port identifier, the sequence marker variable requests and the random marker seed corresponding to the service request message.

7. The mimicry distributed storage system according to claim 5, characterized in that: When the heterogeneous MON executor generates a message to be synchronized, it determines whether the first message number (SID) has been obtained. If not, it continues to wait until the first message number (SID) is obtained. Then, it encapsulates the first message number (SID) and the message to be synchronized into an adjudication data packet and deletes the message to be synchronized.

8. The mimicry distributed storage system according to claim 5, characterized in that: When the heterogeneous MON executor generates a message to be synchronized, it determines whether the first message number SID has been obtained. If not, the message to be synchronized is encapsulated into a decision data packet and sent to the decision arbitrator for decision output. Upon receiving the arbitration data packet, the arbitrator finds that there is no first message number (SID), discards the arbitration data packet, and sends an exception message to the input agent module and the corresponding heterogeneous MON executor. After receiving the abnormal message, the input agent module generates a first message number (SID) according to the first built-in tag generation mechanism, and encapsulates the first message number (SID) into a synchronization SID data packet, which is then transmitted to each heterogeneous MON execution entity. After receiving the exception message, the heterogeneous MON executor continues to wait until it obtains the first message number (SID). Then, it encapsulates the first message number (SID) and the previous message to be synchronized into an adjudication data packet and sends it to the adjudicator, and deletes the message to be synchronized.

9. The mimicry distributed storage system according to claim 7 or 8, characterized in that: When the heterogeneous MON executor obtains the first message number SID by parsing the synchronization SID data packet, it determines whether there is a message to be synchronized. If not, it discards the first message number SID.

Images