Redundant fault-tolerant method, system and device for cryptographic machine of server and storage medium

Abstract

The invention discloses a server cipher machine redundancy fault tolerance method, system and device and a storage medium. The method comprises the steps that a client sends a cipher operation request to a load balancing cluster through an interface; after the load balancing cluster receives the cryptographic operation request, whether the server cryptographic machine breaks down or not is judged according to the working state of TCP connection of the server cryptographic machine; if the server cryptographic machine breaks down, the server cryptographic machine which breaks down is automatically removed, a normal server cryptographic machine is selected for scheduling service, and the cryptographic operation request is forwarded to the selected server cryptographic machine; and the selected server cryptographic machine performs cryptographic operation processing on the cryptographic operation request, and returns a processed cryptographic operation result to the client through the load balancing cluster. According to the method, real-time detection can be carried out, the fault machines can be automatically removed, it is ensured that the server cipher machines in the normal state can be selected for service scheduling, and the performance advantages of each server cipher machine are fully utilized.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a redundant fault-tolerant method, system, device and storage medium for a server cryptographic machine. Background Art

[0002] With the rapid development of Internet technology, the business expansion of enterprises has gradually touched the field of e-commerce, among which the nationwide overseas shopping warehouse business has become an important growth point. In the overseas shopping warehouse business, data security and interactive reliability are the cornerstones to ensure the stable operation of the business. However, with the continuous growth of business volume, the traditional server cryptographic machine master-slave redundancy solution has obvious performance bottlenecks and resource waste problems. For example, the encryption and decryption performance is limited by the performance of the main server, and the backup server is idle most of the time, unable to give full play to its performance advantages, resulting in a waste of backup machine resources; in addition, when the main server fails, it needs to be manually switched to the backup machine, which takes a long time. The above problems need to be solved. Summary of the invention

[0003] The main purpose of this application is to overcome the shortcomings and deficiencies of the prior art, and to provide a redundant fault-tolerant method, system, device and storage medium for a server cryptographic machine. Cryptographic operation requests are distributed by utilizing a load balancing cluster, and key configuration information is backed up and restored through an IC management card. At the same time, a TCP connection pool is used for communication connection and fault detection between server cryptographic machines, ensuring that the machine can automatically and quickly recover and continue to provide services when a fault occurs, thereby making full use of the performance advantages of each server cryptographic machine.

[0004] In order to achieve the above objectives, this application adopts the following technical solutions:

[0005] In a first aspect, the present application provides a server cryptographic machine redundancy fault tolerance method, comprising the following steps:

[0006] The client sends the cryptographic operation request to the load balancing cluster through the interface;

[0007] After receiving the cryptographic operation request, the load balancing cluster determines whether the server cryptographic machine is faulty according to the working status of the TCP connection of the server cryptographic machine; if the server cryptographic machine is faulty, the faulty server cryptographic machine is automatically removed, and a normal server cryptographic machine is selected for scheduling service, and the cryptographic operation request is forwarded to the selected server cryptographic machine;

[0008] The selected server cryptographic machine performs cryptographic operation processing on the cryptographic operation request and returns the processed cryptographic operation result to the client through the load balancing cluster.

[0009] As a preferred technical solution, the server cryptographic machine includes multiple units.

[0010] As a preferred technical solution, it also includes synchronizing the key configuration information in multiple server cryptographic machines.

[0011] As a preferred technical solution, the steps of synchronizing the key configuration information in the cryptographic machines of multiple servers include:

[0012] Using the corresponding first IC management card on the first server cryptographic machine to back up the configuration information and generate a backup configuration file;

[0013] On the remaining server cryptographic machines, using the first IC management card to restore the backup configuration file;

[0014] After restoring the backup configuration file, replace the first IC management card of the remaining server cryptographic machine with the original corresponding IC management card.

[0015] As a preferred technical solution, the selection of a normal server cryptographic machine for scheduling service is performed using a scheduling algorithm.

[0016] As a preferred technical solution, the scheduling algorithm includes: polling method, random method, weighted polling method, source address hash method, and weighted random method.

[0017] As a preferred technical solution, the server cryptographic machine automatically creates a TCP connection pool when it is started, which is used for communication connections between the server cryptographic machines.

[0018] In a second aspect, the present application provides a server cryptographic machine redundant fault-tolerant system, which is applied to a server cryptographic machine redundant fault-tolerant method, including a request sending module, a scheduling module and a processing module;

[0019] The request sending module is used for the client to send the cryptographic operation request to the load balancing cluster through the interface;

[0020] The scheduling module is used to determine whether the server cryptographic machine fails according to the working status of the TCP connection of the server cryptographic machine after the load balancing cluster receives the cryptographic operation request; if the server cryptographic machine fails, the failed server cryptographic machine is automatically removed, and a normal server cryptographic machine is selected for scheduling service, and the cryptographic operation request is forwarded to the selected server cryptographic machine;

[0021] The processing module is used for the selected server cryptographic machine to perform cryptographic operation processing on the cryptographic operation request, and return the processed cryptographic operation result to the client through the load balancing cluster.

[0022] In a third aspect, the present application provides an electronic device, the electronic device comprising:

[0023] at least one processor; and,

[0024] a memory communicatively connected to the at least one processor; wherein,

[0025] The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the server cryptographic machine redundant fault tolerance method.

[0026] In a fourth aspect, the present application provides a computer-readable storage medium storing a program, which, when executed by a processor, implements the redundant fault-tolerant method of a server cryptographic machine.

[0027] In summary, compared with the prior art, the effective effects brought about by the technical solution provided by this application include at least:

[0028] The present application proposes a redundant fault-tolerant method for server cryptographic machines. Through a load balancing cluster, the TCP connection working status of each server cryptographic machine is automatically checked, and the faulty machine can be detected in real time and automatically removed from the service list to ensure that when a cryptographic operation request is received, a server cryptographic machine in normal status can be selected for service scheduling. The performance advantages of each server cryptographic machine are fully utilized, and the problem of backup servers being idle most of the time is avoided, thereby achieving rational utilization of resources and improving the encryption and decryption performance of the entire system. In addition, the automatic switching of server cryptographic machine failures does not require manual intervention, which greatly simplifies the fault switching process and shortens the fault recovery time. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A flowchart of a server cryptographic machine redundancy fault tolerance method provided by an embodiment of the present application;

[0031] Figure 2 A block diagram of a server cryptographic machine redundant fault-tolerant system is provided for one embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0033] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0034] Example:

[0035] See also Figure 1 In one embodiment of the present application, a server cryptographic machine redundancy fault tolerance method is provided, comprising the following steps:

[0036] S1. The client sends a cryptographic operation request to the load balancing cluster through the interface.

[0037] S2. After receiving the cryptographic operation request, the load balancing cluster will check the working status of the TCP connection of each server cryptographic machine, and determine whether the server cryptographic machine is faulty based on the working status of the TCP connection of each server cryptographic machine; if the server cryptographic machine is faulty, the faulty server cryptographic machine will be automatically removed, and a normal server cryptographic machine will be selected for scheduling service, and the cryptographic operation request will be forwarded to the selected server cryptographic machine.

[0038] The load balancing cluster of this embodiment is a high-availability architecture. Its main function is to evenly distribute client requests to multiple servers. At the same time, it will continuously monitor the connection pool status of each server cipher machine, automatically eliminate faulty server cipher machines, and ensure that traffic can be distributed to server cipher machines with normal service status, thereby improving availability and ensuring high availability.

[0039] Furthermore, the server cryptographic machines include multiple ones; wherein, the key configuration information in the multiple server cryptographic machines needs to be synchronized manually to ensure that the configurations of the server cryptographic machines are the same.

[0040] The key configuration information in the cryptographic machines of multiple servers is synchronized, and the steps include:

[0041] (1) The first server cryptographic machine generates the required key information, and uses the corresponding first IC management card on the first server cryptographic machine to back up the system and generate a backup configuration file;

[0042] (2) Using the first IC management card of the first server cryptographic machine on the second server cryptographic machine to the nth server cryptographic machine to restore the backup configuration file, so that the configurations of the second server cryptographic machine to the nth server cryptographic machine are consistent with those of the first server cryptographic machine;

[0043] (3) After restoring the backup configuration file, the first IC management card is replaced by the corresponding second to nth IC management cards on the second to nth server cryptographic machines, so as to reuse the IC management cards of the original server cryptographic machines.

[0044] Through the deployment of the above steps, the key information stored in a single server cryptographic machine can be horizontally expanded to multiple server cryptographic machines.

[0045] After all server cryptographic machines have implemented the same configuration, you only need to find one machine among the multiple server cryptographic machines, generate a certificate application file based on its internal key information, and then submit this file to the certificate authority to apply for a certificate. The issued certificate will finally be saved on the client; when the client communicates with other server cryptographic machines, it can use this issued certificate to ensure the security of communication.

[0046] In addition, when the server cryptographic machine is started, a TCP connection pool is automatically created for communication connections between the server cryptographic machines, so as to quickly respond to client requests.

[0047] In this embodiment, whether the server cryptographic machine has a fault is determined based on the working status of the TCP connection of each server cryptographic machine. This means determining whether the TCP connection has an abnormal disconnection or timeout. If there is a problem with the TCP connection, it is considered that the server cryptographic machine has a fault, and the flow removal operation is automatically performed to eliminate the faulty server cryptographic machine.

[0048] Furthermore, in this embodiment, the normal server cryptographic machine is selected for scheduling service by adopting a scheduling algorithm, and the scheduling algorithms include: polling method, random method, weighted polling method, source address hash method, weighted random method, least connection number method, etc.

[0049] The load balancing cluster of this embodiment adopts a scheduling algorithm to decide which server cryptographic machine to forward the cryptographic operation request to, which can balance the load of each server cryptographic machine and ensure that all servers can process requests evenly, avoiding overload of a certain server, thereby improving the processing capacity of the entire system; at the same time, the TCP connection pool is used for communication connection and fault detection between server cryptographic machines. When a server cryptographic machine fails, the load balancing cluster can select other normal server cryptographic machines to provide services according to the scheduling algorithm, ensuring that the system can continue to provide services.

[0050] S3. The selected server cryptographic machine performs cryptographic operation processing on the cryptographic operation request and returns the processed cryptographic operation result to the client through the load balancing cluster.

[0051] Among them, in the cryptographic operation process, the server cipher machine uses the public key for encryption and the private key for decryption.

[0052] It should be noted that, for the sake of convenience of description, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited to the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously.

[0053] Based on the same idea as the redundant fault-tolerant method for a server cryptographic machine in the above embodiment, the present application also provides a redundant fault-tolerant system for a server cryptographic machine, which can be used to execute the redundant fault-tolerant method for a server cryptographic machine. For ease of explanation, the structural diagram of an embodiment of a redundant fault-tolerant system for a server cryptographic machine only shows the parts related to the embodiment of the present application. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown in the diagram, or combine certain components, or arrange the components differently.

[0054] See also Figure 2 In another embodiment of the present application, a server cryptographic machine redundant fault-tolerant system 100 is provided, the system comprising a request sending module 101, a scheduling module 102 and a processing module 103;

[0055] The request sending module 101 is used for the client to send the cryptographic operation request to the load balancing cluster through the interface;

[0056] The scheduling module 102 is used to determine whether the server cryptographic machine fails according to the working status of the TCP connection of the server cryptographic machine after the load balancing cluster receives the cryptographic operation request; if the server cryptographic machine fails, the failed server cryptographic machine is automatically removed, and a normal server cryptographic machine is selected for scheduling service, and the cryptographic operation request is forwarded to the selected server cryptographic machine;

[0057] The processing module 103 is used for the selected server cryptographic machine to perform cryptographic operation processing on the cryptographic operation request, and return the processed cryptographic operation result to the client through the load balancing cluster.

[0058] It should be noted that a server cryptographic machine redundant fault-tolerant system of the present application corresponds one-to-one to a server cryptographic machine redundant fault-tolerant method of the present application. The technical features and beneficial effects described in the embodiment of the above-mentioned server cryptographic machine redundant fault-tolerant method are applicable to the embodiment of a server cryptographic machine redundant fault-tolerant system. For specific contents, please refer to the description in the embodiment of the method of the present application. It will not be repeated here. This is hereby declared.

[0059] In addition, in the implementation of a redundant fault-tolerant system for a server cryptographic machine in the above-mentioned embodiment, the logical division of each program module is only an example. In actual applications, the above-mentioned functions can be assigned to different program modules as needed, for example, for the configuration requirements of the corresponding hardware or the convenience of software implementation. That is, the internal structure of the redundant fault-tolerant system for a server cryptographic machine is divided into different program modules to complete all or part of the functions described above.

[0060] In another embodiment, an electronic device for implementing a redundant fault-tolerant method for a server cryptographic machine is provided, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, a redundant fault-tolerant method for a server cryptographic machine of any embodiment of the present application is implemented.

[0061] Exemplarily, in this embodiment, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present application. The one or more module elements may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the device.

[0062] The device may be a computing device such as a desktop computer, a notebook, a palm computer, a cloud server, etc. The device may include, but is not limited to, a processor and a memory.

[0063] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the device, and various interfaces and lines are used to connect various parts of the entire device.

[0064] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; in addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0065] Accordingly, the present application also provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a server cryptographic machine redundant fault-tolerant method as described in any one of the above embodiments.

[0066] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0067] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0068] The above embodiments are preferred implementation modes of the present application, but the implementation modes of the present application are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present application should be equivalent replacement methods and are included in the protection scope of the present application.

Claims

1. A server cryptographic machine redundancy fault tolerance method, characterized in that: The steps include: The client sends the cryptographic operation request to the load balancing cluster through the interface; After receiving the cryptographic operation request, the load balancing cluster determines whether the server cryptographic machine is faulty based on the working status of the TCP connection of the server cryptographic machine; If a server cipher fails, the faulty server cipher will be automatically removed, and a normal server cipher will be selected for dispatch service, and the cipher operation request will be forwarded to the selected server cipher; The selected server cryptographic machine performs cryptographic operation processing on the cryptographic operation request and returns the processed cryptographic operation result to the client through the load balancing cluster.

2. According to claim 1, a server cryptographic machine redundancy fault tolerance method is characterized in that: The server cryptographic machine includes multiple ones.

3. According to claim 2, a server cryptographic machine redundancy fault tolerance method is characterized in that: It also includes synchronizing key configuration information in multiple server cryptographic machines.

4. According to claim 3, a server cryptographic machine redundancy fault tolerance method is characterized in that: The steps of synchronizing the key configuration information in the cryptographic machines of the multiple servers include: Backing up the configuration information on the first server cryptographic machine using the corresponding first IC management card to generate a backup configuration file; On the remaining server cryptographic machines, using the first IC management card to restore the backup configuration file; After restoring the backup configuration file, replace the first IC management card of the remaining server cryptographic machine with the original corresponding IC management card.

5. According to claim 1, a server cryptographic machine redundancy fault tolerance method is characterized in that: The selection of a normal server cryptographic machine for scheduling service is performed by adopting a scheduling algorithm.

6. A server cryptographic machine redundancy fault tolerance method according to claim 5, characterized in that: The scheduling algorithms include: polling method, random method, weighted polling method, source address hash method, and weighted random method.

7. A server cryptographic machine redundancy fault tolerance method according to claim 1, characterized in that: When the server cryptographic machine is started, a TCP connection pool is automatically created for communication connections between the server cryptographic machines.

8. A server cryptographic machine redundant fault-tolerant system, characterized in that: A server cryptographic machine redundancy fault tolerance method applied to any one of claims 1-7, comprising a request sending module, a scheduling module and a processing module; The request sending module is used for the client to send the cryptographic operation request to the load balancing cluster through the interface; The scheduling module is used to determine whether the server cryptographic machine fails according to the working status of the TCP connection of the server cryptographic machine after the load balancing cluster receives the cryptographic operation request; If a server cipher fails, the faulty server cipher will be automatically removed, and a normal server cipher will be selected for dispatch service, and the cipher operation request will be forwarded to the selected server cipher; The processing module is used for the selected server cryptographic machine to perform cryptographic operation processing on the cryptographic operation request, and return the processed cryptographic operation result to the client through the load balancing cluster.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute a server cryptographic machine redundant fault tolerance method as described in any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by the processor, a server cryptographic machine redundant fault-tolerant method as described in any one of claims 1 to 7 is implemented.

Images