Decentralization multi-machine synchronization method and device, equipment and storage medium

Abstract

The invention discloses a decentralized multi-machine synchronization method and device, equipment and a storage medium, and relates to the technical field of information, and the method comprises the steps: broadcasting local first feature information, so that other cipher machines receive the first feature information, judging whether a broadcast initiating cipher machine is synchronizable equipment or not, and if yes, replying local second feature information; receiving and verifying second feature information sent by other cryptographic machines, if the other cryptographic machines pass the verification, determining the cryptographic machines passing the verification as synchronizable devices, and recording the corresponding second feature information to obtain a current synchronizable device list; and sending the received to-be-synchronized data to the synchronizable cipher machine in the current synchronizable equipment list. According to the method, the information of the cipher machines passing verification is stored, the synchronizable equipment list is obtained, the to-be-synchronized data are forwarded by any cipher machine in the cluster through the synchronizable equipment list, and the problem that the information cannot be synchronized due to the fault of the central control node is avoided.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a decentralized multi-machine synchronization method, device, equipment and storage medium. Background Art

[0002] With the increasing popularity of information systems, the security issues of key data in various applications have become prominent. Information systems need to use cryptographic algorithms to protect the confidentiality, integrity, validity and non-repudiation of a large amount of key sensitive data. A cryptographic machine is a special device that uses passwords to encrypt (decrypt) and authenticate information, including but not limited to the so-called financial data cryptographic machines, server cryptographic machines, signature verification servers, timestamp servers, cloud server cryptographic machines, etc. They have broad application prospects in the fields of network security and data processing.

[0003] In order to meet the data processing requirements of large-scale application systems, the cipher machines need to be deployed in clusters. Currently, the synchronization of multiple cipher machines depends on a centralized control node. Information must be sent from the control node to other nodes to complete information synchronization. This may cause problems such as the inability to synchronize information when problems occur in the central control node. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a decentralized multi-machine synchronization method, device, equipment and storage medium, which can store the information of the verified cryptographic machine and obtain a list of synchronizable devices. Through the list of synchronizable devices, any cryptographic machine in the cluster can forward the data to be synchronized, avoiding the problem of information failure due to central control node failure. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a decentralized multi-machine synchronization method, which is applied to any cipher machine in a cipher machine cluster, comprising:

[0006] The local first characteristic information is broadcasted so that other cipher machines in the cipher machine cluster receive the first characteristic information, and judge whether the broadcast initiating cipher machine is a synchronizable device according to the first characteristic information, and if so, send the local second characteristic information to the broadcast initiating cipher machine; the broadcast initiating cipher machine is the cipher machine in the cipher machine cluster that broadcasts the first characteristic information;

[0007] Receive and verify the second characteristic information sent by the other cryptographic machines, if there is a verified target cryptographic machine among the other cryptographic machines, determine the target cryptographic machine as a synchronizable device, and record the corresponding second characteristic information to obtain a current synchronizable device list;

[0008] The received data to be synchronized is encrypted to obtain encrypted data corresponding to the data to be synchronized, and the encrypted data is sent to the target synchronizable cryptographic machine in the current synchronizable device list so that the target synchronizable cryptographic machine can decrypt the encrypted data and store the decrypted data to be synchronized.

[0009] Optionally, before broadcasting the local first characteristic information, the method further includes:

[0010] A group identifier is set for each cryptographic machine, and a device certificate of a preset elliptic curve cryptographic algorithm is determined using the same certificate issuing authority to store the device certificate and a preset root certificate chain.

[0011] Optionally, broadcasting the local first characteristic information so that other cipher machines in the cipher machine cluster receive the first characteristic information, and judging whether the cipher machine initiating the broadcast is a synchronizable device according to the first characteristic information, includes:

[0012] Calculating a local first device group identifier by using a preset hash algorithm to obtain a first digest value corresponding to the first device identifier;

[0013] Splitting the first digest value, performing an XOR operation on the obtained split data, and using the obtained operation result as the first key;

[0014] Encrypting the first device group identifier by using a preset group symmetric algorithm and the first key to obtain a first device group identifier ciphertext, and signing the first device group identifier ciphertext by using a local first private key to obtain a first signature value;

[0015] The local first public key certificate, the first device group identification ciphertext, and the first signature value are used as the first characteristic information, and the first characteristic information is broadcasted, so that after receiving the first characteristic information, other cipher machines in the cipher machine cluster use the local root certificate chain to verify the first public key certificate, and after the first public key certificate passes the verification, verify the first signature value, and after the first signature value passes the verification, use the local second key and the preset group symmetric encryption algorithm to decrypt the first device group identification ciphertext, and compare the decrypted first device group identification with the local second device group identification. If the first device group identification is the same as the local second device group identification, the broadcast initiating cipher machine is determined as a synchronizable device;

[0016] Among them, the second key is the key obtained by the other cryptographic machine using a preset hash algorithm to calculate the second digest value corresponding to the local second device group identifier, and dividing the second digest value to perform an XOR operation on the obtained divided data.

[0017] Optionally, the receiving and verifying the second characteristic information sent by the other cryptographic machine includes:

[0018] The second public key certificate and the second signature value included in the second characteristic information are verified; the second public key certificate is the public key certificate of the other cryptographic machine; the second signature value is the signature value obtained by the other cryptographic machine encrypting the second data ciphertext using the local second private key; the second data ciphertext is the data ciphertext obtained by the other cryptographic machine encrypting the local device information through the first public key certificate.

[0019] Optionally, before encrypting the received data to be synchronized to obtain encrypted data corresponding to the data to be synchronized, and sending the encrypted data to a target syncable cryptographic machine in the current syncable device list so that the target syncable cryptographic machine decrypts the encrypted data and stores the decrypted data to be synchronized, the method further includes:

[0020] If a data synchronization request is received, determining the data to be synchronized corresponding to the data synchronization request;

[0021] Determine a request arrival time when the data synchronization request is received, and add the to-be-synchronized data to a to-be-synchronized data list based on the request arrival time.

[0022] Optionally, encrypting the received data to be synchronized to obtain encrypted data corresponding to the data to be synchronized includes:

[0023] Generate a random key, and encrypt the random key using the second public key certificate to obtain a random key ciphertext;

[0024] The data to be synchronized in the list of data to be synchronized is encrypted by a preset group symmetric encryption algorithm and the random key to obtain a first data ciphertext, and the first data ciphertext and the random key ciphertext are used as encrypted data.

[0025] Optionally, sending the encrypted data to a target syncable cryptographic machine in the current syncable device list so that the target syncable cryptographic machine decrypts the encrypted data and stores the data to be synchronized obtained after decryption, includes:

[0026] The encrypted data is sent to the target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine uses the local second private key to decrypt the random key ciphertext in the encrypted data. If the decryption is successful, the first data ciphertext in the encrypted data is decrypted using the decrypted random key and the preset group symmetric encryption algorithm, and the obtained data to be synchronized is stored locally.

[0027] In a second aspect, the present application provides a decentralized multi-machine synchronization device, which is applied to any cipher machine in a cipher machine cluster, including:

[0028] An information sending module, used for broadcasting the local first characteristic information so that other cipher machines in the cipher machine cluster receive the first characteristic information, and judging whether the broadcast initiating cipher machine is a synchronizable device according to the first characteristic information, and if so, sending the local second characteristic information to the broadcast initiating cipher machine;

[0029] An information storage module, used for receiving and verifying the second characteristic information sent by the other cryptographic machines, and if there is a verified target cryptographic machine among the other cryptographic machines, determining the target cryptographic machine as a synchronizable device, and recording the corresponding second characteristic information to obtain a current synchronizable device list;

[0030] A data forwarding module is used to encrypt the received data to be synchronized to obtain encrypted data corresponding to the data to be synchronized, and send the encrypted data to the target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine can decrypt the encrypted data and store the data to be synchronized obtained after decryption.

[0031] In a third aspect, the present application provides an electronic device, including:

[0032] Memory, used to store computer programs;

[0033] A processor is used to execute the computer program to implement the aforementioned centralized multi-machine synchronization method.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned centralized multi-machine synchronization method.

[0035] It can be seen that in the present application, any cipher machine located in the cipher machine cluster first broadcasts the local first characteristic information, so that other cipher machines in the cipher machine cluster receive the first characteristic information, and determine whether the broadcast initiating cipher machine is a syncable device based on the first characteristic information. If so, the local second characteristic information is sent to the broadcast initiating cipher machine; the broadcast initiating cipher machine is the cipher machine that broadcasts the first characteristic information in the cipher machine cluster, and then receives and verifies the second characteristic information sent by the other cipher machines. If there is a target cipher machine that passes the verification among the other cipher machines, the target cipher machine is determined as a syncable device, and the corresponding second characteristic information is recorded to obtain a current list of syncable devices. Finally, the received data to be synchronized is encrypted to obtain encrypted data corresponding to the data to be synchronized, and the encrypted data is sent to the target syncable cipher machine in the current list of syncable devices, so that the target syncable cipher machine decrypts the encrypted data and stores the decrypted data to be synchronized. In this way, since any cipher machine in the cipher machine cluster broadcasts the local first characteristic information and verifies the second characteristic information returned by other cipher machines, the synchronizable devices are determined, and the current list of synchronizable devices is obtained by storing the second characteristic information. Through the synchronizable device list, any cipher machine in the cluster can forward the data to be synchronized, thereby avoiding reliance on a centralized control node to complete information synchronization, and further avoiding the problem of information being unable to be synchronized when problems occur in the central control node. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 This is a flow chart of a decentralized multi-machine synchronization method disclosed in this application;

[0038] Figure 2 A flow chart for establishing an intelligent grouping disclosed in this application;

[0039] Figure 3 A data synchronization flow chart disclosed in this application;

[0040] Figure 4 A flowchart of a specific decentralized multi-machine synchronization method disclosed in this application;

[0041] Figure 5A schematic diagram of a decentralized multi-machine synchronization device disclosed in this application;

[0042] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] See also Figure 1 As shown, the embodiment of the present invention discloses a decentralized multi-machine synchronization method, which is applied to any cipher machine in a cipher machine cluster, including:

[0045] Step S11, broadcast the local first characteristic information so that other cipher machines in the cipher machine cluster receive the first characteristic information, and determine whether the broadcast initiating cipher machine is a synchronizable device based on the first characteristic information. If so, send the local second characteristic information to the broadcast initiating cipher machine; the broadcast initiating cipher machine is the cipher machine in the cipher machine cluster that broadcasts the first characteristic information.

[0046] In this embodiment, the broadcast initiating cipher machine that broadcasts the local first characteristic information may be any cipher machine located in the cipher machine cluster. In a specific implementation, any cipher machine in the cipher machine cluster broadcasts the local first characteristic information so that other cipher machines in the cipher machine cluster receive the first characteristic information; in another specific implementation, any three cipher machines in the cipher machine cluster broadcast the local first characteristic information at the same time so that other cipher machines in the cipher machine cluster receive different first characteristic information located in any three cipher machines respectively. It should be noted that the broadcast of the local first characteristic information may be a global broadcast of the local first characteristic information in the entire cipher machine cluster, or it may be a broadcast of the local first characteristic information within a preset range of the cipher machine cluster. It should be noted that the other cipher machines in the cipher machine cluster may receive the first characteristic information regularly at a preset time interval, or they may immediately receive the first characteristic information of the broadcast initiating cipher machine when a cipher machine is detected to be broadcasting. Before broadcasting the local first characteristic information, it specifically includes: setting a group identifier for each cryptographic machine, and using the same certificate authority to determine the device certificate of the preset elliptic curve cryptographic algorithm to save the device certificate and the preset root certificate chain, wherein the device group identifier is a unique basis for dividing the devices into the same group, which is used to confirm whether these devices should work together. In a specific implementation, the same certificate authority, i.e., CA (Certificate Authority, i.e., certificate authority) is used for each cryptographic machine to determine the device certificate of the preset elliptic curve cryptographic algorithm, i.e., SM2 algorithm (SM2 Algorithm, i.e., an elliptic curve cryptographic algorithm with a key length of 256 bits, which can provide encryption, decryption, signing, signature verification and key negotiation and other cryptographic computing capabilities) to save the device certificate of the SM2 algorithm and the preset root certificate chain. Among them, the certificate authority is an authority responsible for issuing and managing digital certificates, also known as a "certificate certification authority" or "certificate authority center". The device certificate is a unique key pair randomly generated by the device, and is issued by a trusted CA (certificate authority). It contains the public key of the device and other related information, which can be used to verify the identity and security of the device, and ensure the authenticity of the identities of both parties and the integrity of the data when communicating between devices. The root certificate chain is an ordered structure consisting of a root certificate and possible intermediate certificates. Each intermediate certificate is issued by the upper-level certificate and can ultimately be traced back to the root certificate. The root certificate chain is used to verify the validity and legitimacy of the target certificate, and can ensure that the certificate is issued by a trusted authority.

[0047] The local first characteristic information is broadcasted so that other cipher machines in the cipher machine cluster receive the first characteristic information and determine whether the cipher machine initiating the broadcast is a syncable device based on the first characteristic information. Figure 2 As shown, it may specifically include: calculating a local first device group identifier, namely, device group identifier ID1, by a preset hash algorithm, namely, SM3 Algorithm (SM3 Algorithm, i.e., a hash algorithm with an output length of 256 bits), to obtain a first digest value corresponding to the device group identifier ID1, namely, digest value H1; dividing the digest value H1 by a preset length, for example, dividing the digest value H1 by a length of 16 bytes, dividing the digest value H1 into two parts, performing an XOR operation on the obtained divided data, and using the obtained operation result as a first key, namely, key KEY1; using a preset group symmetric encryption algorithm, namely, SM4 algorithm (SM4 Algorithm, that is, a block symmetric encryption algorithm, the block length and the key length are both 128 bits) ECB (Electronic Codebook, that is, a basic block cipher working mode) mode and the first key KEY1 to encrypt the first device group identifier ID1 to obtain the first device group identifier ciphertext, that is, the ciphertext C1, and use the local first private key to sign the first device group identifier ciphertext C1 to obtain a first signature value, that is, the signature value S1; use the local first public key certificate, that is, the public key certificate CERT1, the first device group identifier ciphertext C1, and the first signature value S1 as the first feature information, and broadcast the first feature information, so that other cipher machines in the cipher machine cluster can use the local root certificate chain to verify the first public key certificate CER after receiving the first feature information. T1, and after the first public key certificate CERT1 is verified, the first signature value S1 is verified, so that after the first signature value S1 is verified, the first device group identification ciphertext C1 is decrypted using the local second key, that is, the key KEY2 and the ECB mode of the SM4 algorithm, and the decrypted first device group identification C1 is compared with the local second device group identification, that is, the device group identification ID2. If the first device group identification ID1 is the same as the local second device group identification ID2, the broadcast initiating cipher machine is determined as a synchronizable device; wherein the second key KEY2 is a key obtained by other cipher machines using a preset hash algorithm, that is, the SM3 algorithm to calculate the second summary value H2 corresponding to the local second device group identification ID2, and the second summary value H2 is segmented to perform an XOR operation on the segmented data. This embodiment encrypts the data through an encryption algorithm and then broadcasts it, and other cipher machines use the same encryption algorithm to decrypt the data, thereby improving the security of the data transmission process.

[0048] Step S12, receiving and verifying the second characteristic information sent by the other cryptographic machines. If there is a verified target cryptographic machine among the other cryptographic machines, the target cryptographic machine is determined as a synchronizable device, and the corresponding second characteristic information is recorded to obtain a current list of synchronizable devices.

[0049] In this embodiment, the verified target cryptographic machine may be one or more cryptographic machines. In a specific implementation, if there is a verified target cryptographic machine among other cryptographic machines, this cryptographic machine is determined as a synchronizable device, and the corresponding second characteristic information is recorded to obtain a current list of synchronizable devices. In another specific implementation, if there are five verified target cryptographic machines among other cryptographic machines, this cryptographic machine is determined as a synchronizable device, and the corresponding second characteristic information is recorded to obtain a current list of synchronizable devices. It should be noted that recording the corresponding second characteristic information may be recording all of the second characteristic information, or only recording the information contained in the second characteristic information that can determine the identity of the target cryptographic machine. Before recording, the broadcast initiating cryptographic machine needs to decrypt the second characteristic information with the local first private key. In this embodiment, receiving and verifying the second characteristic information sent by other cryptographic machines may specifically include: verifying the second public key certificate, i.e., the public key certificate CERT2, and the second signature value, i.e., the signature value S2, contained in the second characteristic information; the second public key certificate CERT2 is the public key certificate of other cryptographic machines; the second signature value S2 is the signature value obtained by other cryptographic machines using the local second private key to encrypt the second data ciphertext, i.e., the ciphertext information C2; the second data ciphertext C2 is the data ciphertext obtained by other cryptographic machines encrypting the local device information using the first public key certificate CERT1. In this embodiment, the second characteristic information is further verified by the broadcast initiating cryptographic machine, thereby accurately determining the target cryptographic machine among other cryptographic machines, thereby improving the reliability of the verification process of the synchronizable devices.

[0050] Step S13: encrypt the received data to be synchronized to obtain encrypted data corresponding to the data to be synchronized, and send the encrypted data to the target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine can decrypt the encrypted data and store the data to be synchronized obtained after decryption.

[0051] In this embodiment, the received data to be synchronized is encrypted to obtain encrypted data corresponding to the data to be synchronized, which may specifically include: Figure 3As shown, a random key KEY1 is generated, and the random key is encrypted using the second public key certificate CERT2 to obtain a random key ciphertext, i.e., a random key ciphertext C1; the data to be synchronized in the list of data to be synchronized is encrypted using the GCM (Galois / CounterMode, i.e., a symmetric encryption algorithm working mode) mode of the SM4 algorithm and the random key to obtain a first data ciphertext, i.e., a data ciphertext C2, and the first data ciphertext C2 and the random key ciphertext C1 are used as encrypted data. The encrypted data is sent to the target syncable cryptographic machine in the current syncable device list so that the target syncable cryptographic machine decrypts the encrypted data and stores the decrypted data to be synchronized, which may specifically include: sending the encrypted data to the target syncable cryptographic machine in the current syncable device list so that the target syncable cryptographic machine decrypts the random key ciphertext C1 in the encrypted data using the local second private key; if the decryption is successful, the first data ciphertext C2 in the encrypted data is decrypted using the random key KEY1 obtained by decryption and the GCM mode of the SM4 cryptographic algorithm, and the obtained data to be synchronized is stored locally. In this embodiment, the data to be synchronized is encrypted and the encrypted data is sent to the target synchronizable cryptographic machine, thereby improving the security of the data transmission process.

[0052] It can be seen that in the embodiment of the present application, any cipher machine in the cipher machine cluster broadcasts the first local feature information and verifies the second feature information returned by other cipher machines, thereby determining the syncable device, and obtaining the current syncable device list by storing the second feature information. The syncable device list enables any cipher machine in the cluster to forward the data to be synchronized, thereby avoiding reliance on a centralized control node to complete information synchronization. In addition, the active detection process in the cipher machine deletes the lost devices in the syncable device list, thereby ensuring the reliability of the syncable device list information.

[0053] Based on the above embodiments, it can be known that when there are multiple pieces of data to be synchronized, there may be a situation where the data to be synchronized cannot be accurately received by the synchronizable device, thereby causing the loss of the data to be synchronized. Therefore, this embodiment describes in detail how to avoid the loss of the data to be synchronized. Figure 4 As shown, the embodiment of the present application discloses a decentralized multi-machine synchronization method, which is applied to any cipher machine in a cipher machine cluster, including:

[0054] Step S21, broadcast the local first characteristic information so that other cipher machines in the cipher machine cluster receive the first characteristic information, and determine whether the broadcast initiating cipher machine is a synchronizable device based on the first characteristic information. If so, send the local second characteristic information to the broadcast initiating cipher machine; the broadcast initiating cipher machine is the cipher machine in the cipher machine cluster that broadcasts the first characteristic information.

[0055] In this embodiment, a process detectMates is run in the broadcast initiating cipher machine, which periodically sends detection packets according to a preset strategy to actively detect companion devices. The process collects companion devices in the cipher machine cluster through the received feedback information, that is, the second characteristic information, and records it in its own syncable device list. When a companion device that already exists in the companion device list does not feedback information in several consecutive detections, and the number of times reaches a preset threshold, the process will automatically determine that the syncable device has lost connection and delete the information of the companion device from the local syncable device list. In a specific implementation, if a companion device that already exists in the companion device list does not feedback information in three consecutive detections, the process will automatically determine that the syncable device has lost connection and delete the information of the companion device from the local syncable device list. In this embodiment, by regularly detecting the syncable devices in the syncable device list, the syncable device information in the syncable device list is updated in real time according to the detection results, thereby ensuring the timeliness of the syncable device list.

[0056] Step S22, receiving and verifying the second characteristic information sent by the other cryptographic machines. If there is a verified target cryptographic machine among the other cryptographic machines, the target cryptographic machine is determined as a synchronizable device, and the corresponding second characteristic information is recorded to obtain a current list of synchronizable devices.

[0057] Step S23: If a data synchronization request is received, determine the data to be synchronized corresponding to the data synchronization request; determine the request arrival time when the data synchronization request is received, and add the data to be synchronized to the list of data to be synchronized based on the request arrival time.

[0058] In this embodiment, the request arrival time of the data synchronization request is determined, and the data to be synchronized is added to the list of data to be synchronized in sequence based on the request arrival time. It should be noted that an active synchronization process syncData is running in the cryptographic machine. The process periodically checks the list of data to be synchronized according to the preset data synchronization strategy, and attempts to push each data in the list of data to be synchronized to the synchronizable devices that have not completed synchronization in sequence. The process removes the companion device that has lost connection from the parameters of the unsynchronized data according to the current situation of the list of synchronizable devices. The process updates its synchronization status every time it processes a piece of data to be synchronized. If the data has completed synchronization for all synchronizable devices, it will be removed from the list of data to be synchronized. Otherwise, the data will be retained and its list of unsynchronized companion devices will be updated. The process processes each piece of data to be synchronized in the list of data to be synchronized in a periodic order according to the order of the data to be synchronized in the list of data to be synchronized. In this embodiment, the active synchronization process sends the data to be synchronized to the syncable devices that have not completed data synchronization in the order of the data information to be synchronized in the list of data to be synchronized, thereby avoiding the situation where the data to be synchronized is repeatedly sent to the same syncable device.

[0059] Step S24: encrypt the received data to be synchronized to obtain encrypted data corresponding to the data to be synchronized, and send the encrypted data to the target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine can decrypt the encrypted data and store the decrypted data to be synchronized.

[0060] For the specific process of the above-mentioned step S22 and step S24, reference may be made to the corresponding contents disclosed in the above-mentioned embodiment, which will not be described in detail here.

[0061] In this embodiment, the devices in the syncable device list are detected through an active detection process to maintain the reliability of the syncable device list, and the data to be synchronized is sent to the syncable devices that have not completed data synchronization in the order of the data to be synchronized in the data to be synchronized list through an active synchronization process, thereby avoiding the situation where the data to be synchronized is repeatedly sent to the same syncable device. At the same time, the data to be synchronized is stored in the data to be synchronized list in sequence according to the arrival time of the synchronization request, and the data to be synchronized is sent in sequence, thereby avoiding the loss of the data to be synchronized.

[0062] See also Figure 5 As shown, the embodiment of the present invention further discloses a decentralized multi-machine synchronization device, which is applied to any cipher machine in a cipher machine cluster, including:

[0063] The information sending module 11 is used to broadcast the local first characteristic information so that other cipher machines in the cipher machine cluster receive the first characteristic information, and determine whether the broadcast initiating cipher machine is a synchronizable device based on the first characteristic information. If so, the local second characteristic information is sent to the broadcast initiating cipher machine;

[0064] The information storage module 12 is used to receive and verify the second characteristic information sent by the other cryptographic machines. If there is a verified target cryptographic machine among the other cryptographic machines, the target cryptographic machine is determined as a synchronizable device, and the corresponding second characteristic information is recorded to obtain a current synchronizable device list;

[0065] The data forwarding module 13 is used to encrypt the received data to be synchronized to obtain encrypted data corresponding to the data to be synchronized, and send the encrypted data to the target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine can decrypt the encrypted data and store the data to be synchronized obtained after decryption.

[0066] It can be seen that the embodiment of the present application enables any cryptographic machine in the cluster to forward the data to be synchronized through the synchronizable device list, thereby avoiding reliance on a centralized control node to complete information synchronization, and further avoiding the problem of information being unable to be synchronized when problems occur in the central control node.

[0067] In some specific implementations, the information sending module 11 further includes:

[0068] The certificate determination unit is used to set a group identifier for each cryptographic machine and use the same certificate issuing authority to determine a device certificate of a preset elliptic curve cryptographic algorithm to store the device certificate and a preset root certificate chain.

[0069] In some specific implementations, the information sending module 11 specifically includes:

[0070] a group identifier calculation unit, configured to calculate a local first device group identifier by using a preset hash algorithm to obtain a first digest value corresponding to the first device identifier;

[0071] a data operation unit, configured to segment the first digest value, perform an XOR operation on the segmented data, and use the operation result as a first key;

[0072] a group identification encryption unit, configured to encrypt the first device group identification by using a preset group symmetric algorithm and the first key to obtain a first device group identification ciphertext, and sign the first device group identification ciphertext by using a local first private key to obtain a first signature value;

[0073] an information broadcasting unit, configured to use the local first public key certificate, the first device group identification ciphertext, and the first signature value as the first characteristic information, and broadcast the first characteristic information, so that after receiving the first characteristic information, other cipher machines in the cipher machine cluster use the local root certificate chain to verify the first public key certificate, and after the first public key certificate passes the verification, verify the first signature value, and after the first signature value passes the verification, use the local second key and a preset group symmetric encryption algorithm to decrypt the first device group identification ciphertext, and compare the decrypted first device group identification with the local second device group identification, and if the first device group identification is the same as the local second device group identification, determine the broadcast initiating cipher machine as a synchronizable device;

[0074] Among them, the second key is the key obtained by the other cryptographic machine using a preset hash algorithm to calculate the second digest value corresponding to the local second device group identifier, and dividing the second digest value to perform an XOR operation on the obtained divided data.

[0075] In some specific implementations, the information storage module 12 may specifically include:

[0076] An information verification unit is used to verify the second public key certificate and the second signature value contained in the second characteristic information; the second public key certificate is the public key certificate of the other cryptographic machine; the second signature value is the signature value obtained by the other cryptographic machine encrypting the second data ciphertext using the local second private key; the second data ciphertext is the data ciphertext obtained by the other cryptographic machine encrypting the local device information through the first public key certificate.

[0077] In some specific implementations, the data forwarding module 13 further includes:

[0078] a data determination unit, configured to determine the to-be-synchronized data corresponding to the data synchronization request if a data synchronization request is received;

[0079] a data adding unit, configured to determine a request arrival time of receiving the data synchronization request, and add the to-be-synchronized data to a to-be-synchronized data list based on the request arrival time;

[0080] a key encryption unit, configured to generate a random key, and encrypt the random key using the second public key certificate to obtain a random key ciphertext;

[0081] a data encryption unit, configured to encrypt the data to be synchronized in the list of data to be synchronized by using a preset group symmetric encryption algorithm and the random key to obtain a first data ciphertext, and use the first data ciphertext and the random key ciphertext as encrypted data;

[0082] A data sending unit is used to send the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine uses a local second private key to decrypt the random key ciphertext in the encrypted data. If the decryption is successful, the first data ciphertext in the encrypted data is decrypted using the random key obtained by decryption and a preset group symmetric encryption algorithm, and the obtained data to be synchronized is stored locally.

[0083] Furthermore, the present application also discloses an electronic device. Figure 6 2 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the 6 methods disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0084] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0085] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0086] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs that can be used to complete the decentralized multi-machine synchronization method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to complete other specific tasks.

[0087] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the decentralized multi-machine synchronization method disclosed above is implemented. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0088] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0089] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0090] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0091] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0092] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A decentralized multi-machine synchronization method, characterized in that: Applicable to any cipher machine in a cipher machine cluster, including: The local first characteristic information is broadcasted so that other cipher machines in the cipher machine cluster receive the first characteristic information, and judge whether the broadcast initiating cipher machine is a synchronizable device according to the first characteristic information, and if so, send the local second characteristic information to the broadcast initiating cipher machine; the broadcast initiating cipher machine is the cipher machine in the cipher machine cluster that broadcasts the first characteristic information; Receive and verify the second characteristic information sent by the other cryptographic machines, if there is a verified target cryptographic machine among the other cryptographic machines, determine the target cryptographic machine as a synchronizable device, and record the corresponding second characteristic information to obtain a current synchronizable device list; The received data to be synchronized is encrypted to obtain encrypted data corresponding to the data to be synchronized, and the encrypted data is sent to the target synchronizable cryptographic machine in the current synchronizable device list so that the target synchronizable cryptographic machine can decrypt the encrypted data and store the decrypted data to be synchronized.

2. The decentralized multi-machine synchronization method according to claim 1, characterized in that: Before broadcasting the local first characteristic information, the method further includes: A group identifier is set for each cryptographic machine, and a device certificate of a preset elliptic curve cryptographic algorithm is determined using the same certificate issuing authority to store the device certificate and a preset root certificate chain.

3. The decentralized multi-machine synchronization method according to claim 2, characterized in that: The method of broadcasting the local first characteristic information so that other cipher machines in the cipher machine cluster receive the first characteristic information, and judging whether the cipher machine initiating the broadcast is a synchronizable device according to the first characteristic information, includes: Calculating a local first device group identifier by using a preset hash algorithm to obtain a first digest value corresponding to the first device identifier; Splitting the first digest value, performing an XOR operation on the obtained split data, and using the obtained operation result as the first key; Encrypting the first device group identifier by using a preset group symmetric algorithm and the first key to obtain a first device group identifier ciphertext, and signing the first device group identifier ciphertext by using a local first private key to obtain a first signature value; The local first public key certificate, the first device group identification ciphertext, and the first signature value are used as the first characteristic information, and the first characteristic information is broadcasted, so that after receiving the first characteristic information, other cipher machines in the cipher machine cluster use the local root certificate chain to verify the first public key certificate, and after the first public key certificate passes the verification, verify the first signature value, and after the first signature value passes the verification, use the local second key and the preset group symmetric encryption algorithm to decrypt the first device group identification ciphertext, and compare the decrypted first device group identification with the local second device group identification. If the first device group identification is the same as the local second device group identification, the broadcast initiating cipher machine is determined as a synchronizable device; Among them, the second key is the key obtained by the other cryptographic machine using a preset hash algorithm to calculate the second digest value corresponding to the local second device group identifier, and dividing the second digest value to perform an XOR operation on the obtained divided data.

4. The decentralized multi-machine synchronization method according to any one of claims 1 to 3, characterized in that: The receiving and verifying the second characteristic information sent by the other cryptographic machine includes: The second public key certificate and the second signature value included in the second characteristic information are verified; the second public key certificate is the public key certificate of the other cryptographic machine; the second signature value is the signature value obtained by the other cryptographic machine encrypting the second data ciphertext using the local second private key; the second data ciphertext is the data ciphertext obtained by the other cryptographic machine encrypting the local device information through the first public key certificate.

5. The decentralized multi-machine synchronization method according to claim 4, characterized in that: The method further comprises: encrypting the received data to be synchronized to obtain encrypted data corresponding to the data to be synchronized, and sending the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list so that the target synchronizable cryptographic machine decrypts the encrypted data and stores the decrypted data to be synchronized. If a data synchronization request is received, determining the data to be synchronized corresponding to the data synchronization request; Determine a request arrival time when the data synchronization request is received, and add the to-be-synchronized data to a to-be-synchronized data list based on the request arrival time.

6. The decentralized multi-machine synchronization method according to claim 5, characterized in that: The step of encrypting the received data to be synchronized to obtain encrypted data corresponding to the data to be synchronized includes: Generate a random key, and encrypt the random key using the second public key certificate to obtain a random key ciphertext; The data to be synchronized in the list of data to be synchronized is encrypted by a preset group symmetric encryption algorithm and the random key to obtain a first data ciphertext, and the first data ciphertext and the random key ciphertext are used as encrypted data.

7. The decentralized multi-machine synchronization method according to claim 6, characterized in that: The step of sending the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list so that the target synchronizable cryptographic machine decrypts the encrypted data and stores the data to be synchronized obtained after decryption, comprises: The encrypted data is sent to the target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine uses the local second private key to decrypt the random key ciphertext in the encrypted data. If the decryption is successful, the first data ciphertext in the encrypted data is decrypted using the decrypted random key and the preset group symmetric encryption algorithm, and the obtained data to be synchronized is stored locally.

8. A decentralized multi-machine synchronization device, characterized in that: Applicable to any cipher machine in a cipher machine cluster, including: An information sending module, used for broadcasting the local first characteristic information so that other cipher machines in the cipher machine cluster receive the first characteristic information, and judging whether the broadcast initiating cipher machine is a synchronizable device according to the first characteristic information, and if so, sending the local second characteristic information to the broadcast initiating cipher machine; An information storage module, used for receiving and verifying the second characteristic information sent by the other cryptographic machines, and if there is a verified target cryptographic machine among the other cryptographic machines, determining the target cryptographic machine as a synchronizable device, and recording the corresponding second characteristic information to obtain a current synchronizable device list; A data forwarding module is used to encrypt the received data to be synchronized to obtain encrypted data corresponding to the data to be synchronized, and send the encrypted data to the target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine can decrypt the encrypted data and store the data to be synchronized obtained after decryption.

9. A decentralized multi-machine synchronization device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the decentralized multi-machine synchronization method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the decentralized multi-machine synchronization method as described in any one of claims 1 to 7 is implemented.

Images