A decentralized multi-machine synchronization method, device, equipment and storage medium

Abstract

The application discloses a decentralized multi-machine synchronization method and device, equipment and a storage medium, and relates to the technical field of information, which comprises the following steps: broadcasting the first characteristic information of the local machine, so that other cryptographic machines receive the first characteristic information, and judging whether the broadcasting initiator is a synchronizable device, if yes, replying the second characteristic information of the local machine; receiving and verifying the second characteristic information sent by other cryptographic machines, if other cryptographic machines pass the verification, determining the cryptographic machines that pass the verification as synchronizable devices, and recording the corresponding second characteristic information to obtain a current synchronizable device list; and sending the received to-be-synchronized data to the synchronizable cryptographic machines in the current synchronizable device list. The application stores the information of the cryptographic machines that pass the verification to obtain the synchronizable device list, and realizes the forwarding of the to-be-synchronized data by any cryptographic machine in the cluster through the synchronizable device list, thereby avoiding the problem that information cannot be synchronized due to the failure of the central control node.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, in particular to a decentralized multi-machine synchronization method, device, equipment and storage medium. BACKGROUND

[0002] With the continuous popularization of information systems, the security of key data of various applications is highlighted. Information systems need to use cryptographic algorithms to protect the confidentiality, integrity, validity and non-repudiation of a large amount of key sensitive data. A cryptographic machine is a special device that uses cryptography to implement encryption (decryption) processing and authentication of information, including but not limited to commonly referred to as financial data cryptographic machines, server cryptographic machines, signature verification servers, timestamp servers, cloud server cryptographic machines, etc. They have wide application prospects in the field of network security and data processing.

[0003] In order to adapt to the data processing needs of large-scale application systems, it is necessary to cluster the cryptographic machines. At present, multi-machine synchronization of multiple cryptographic machines relies on a centralized control node, and information must be sent by the control node to other nodes to complete information synchronization. Thus, when the central control node has a problem, information cannot be synchronized. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a decentralized multi-machine synchronization method, device, equipment and storage medium, which can store the information of the cryptographic machine verified, obtain a synchronizable device list, and realize forwarding of the to-be-synchronized data by any cryptographic machine in the cluster through the synchronizable device list, thereby avoiding the problem of information synchronization failure due to the failure of the central control node. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a decentralized multi-machine synchronization method applied to any cryptographic machine in a cryptographic machine cluster, comprising:

[0006] Broadcasting the first feature information locally, so that other cryptographic machines in the cryptographic machine cluster receive the first feature information, and determining whether the broadcast initiating cryptographic machine is a synchronizable device according to the first feature information, and if so, sending the second feature information locally to the broadcast initiating cryptographic machine; the broadcast initiating cryptographic machine is the cryptographic machine in the cryptographic machine cluster that broadcasts the first feature information;

[0007] Receiving and verifying the second feature information sent by the other cryptographic machines, if there is a target cryptographic machine verified among the other cryptographic machines, determining the target cryptographic machine as a synchronizable device, and recording the corresponding second feature information to obtain a current synchronizable device list;

[0008] encrypt the received to-be-synchronized data to obtain encrypted data corresponding to the to-be-synchronized data, and send the encrypted data to a target synchronizable cryptomachine in the current synchronizable device list, so that the target synchronizable cryptomachine decrypts the encrypted data and stores the decrypted to-be-synchronized data.

[0009] Optionally, before the broadcasting of the local first feature information, the method further comprises:

[0010] A group identifier is set for each cryptomachine, and a device certificate of a preset elliptic curve cryptography algorithm is determined using the same certificate authority, and the device certificate and a preset root certificate chain are stored.

[0011] Optionally, the broadcasting of the local first feature information is performed so that other cryptomachines in the cryptomachine cluster receive the first feature information, and it is determined according to the first feature information whether the broadcast-initiating cryptomachine is a synchronizable device, comprising:

[0012] A first device group identifier is calculated through a preset hash algorithm to obtain a first digest value corresponding to the first device identifier;

[0013] The first digest value is split, and the split data is subjected to an exclusive-OR operation, and the obtained operation result is used as a first key;

[0014] The first device group identifier is encrypted through a preset group symmetric algorithm and the first key to obtain first device group identifier ciphertext, and the first device group identifier ciphertext is signed using a local first private key to obtain a first signature value;

[0015] A local first public key certificate, the first device group identifier ciphertext, and the first signature value are used as first feature information, and the first feature information is broadcasted, so that after other cryptomachines in the cryptomachine cluster receive the first feature information, the first public key certificate is verified using a local root certificate chain, and after the first public key certificate passes the verification, the first signature value is verified, and after the first signature value passes the verification, the first device group identifier ciphertext is decrypted using a local second key and a preset group symmetric cryptography algorithm, and the decrypted first device group identifier is compared with a local second device group identifier, and if the first device group identifier is the same as the local second device group identifier, the broadcast-initiating cryptomachine is determined as a synchronizable device;

[0016] The second key is a key obtained by performing XOR operation on divided data obtained by dividing a second digest value corresponding to a second device group identifier of the other cryptographic machine using a preset hash algorithm and the second digest value.

[0017] Optionally, the receiving and verifying the second feature information sent by the other cryptographic machine comprises:

[0018] verifying a second public key certificate and a second signature value contained in the second feature information; the second public key certificate is a public key certificate of the other cryptographic machine; the second signature value is a signature value obtained by encrypting second data cipher text using a second private key locally of the other cryptographic machine; the second data cipher text is data cipher text obtained by encrypting device information locally of the other cryptographic machine using a first public key certificate.

[0019] Optionally, before the encrypting the received to-be-synchronized data to obtain encrypted data corresponding to the to-be-synchronized data and sending the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list so that the target synchronizable cryptographic machine decrypts the encrypted data and stores the to-be-synchronized data obtained after decryption, the method further comprises:

[0020] if the data synchronization request is received, determining to-be-synchronized data corresponding to the data synchronization request;

[0021] determining a request arrival time at which the data synchronization request is received, and adding the to-be-synchronized data to a to-be-synchronized data list based on the request arrival time.

[0022] Optionally, the encrypting the received to-be-synchronized data to obtain encrypted data corresponding to the to-be-synchronized data comprises:

[0023] generating a random key and encrypting the random key using the second public key certificate to obtain random key cipher text;

[0024] encrypting the to-be-synchronized data in the to-be-synchronized data list using a preset group symmetric cryptographic algorithm and the random key to obtain first data cipher text, and taking the first data cipher text and the random key cipher text as the encrypted data.

[0025] Optionally, the sending the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list so that the target synchronizable cryptographic machine decrypts the encrypted data and stores the to-be-synchronized data obtained after decryption comprises:

[0026] send the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine decrypts the random key ciphertext in the encrypted data by using a local second private key, if the decryption is successful, decrypts the first data ciphertext in the encrypted data by the decrypted random key and a preset group symmetric cryptographic algorithm, and stores the obtained to-be-synchronized data locally.

[0027] In a second aspect, the present application provides a decentralized multi-machine synchronization device, applied to any cryptographic machine in a cryptographic machine cluster, comprising:

[0028] an information sending module, configured to broadcast a local first feature information, so that other cryptographic machines in the cryptographic machine cluster receive the first feature information, and determine whether the broadcast initiating cryptographic machine is a synchronizable device according to the first feature information, if yes, send a local second feature information to the broadcast initiating cryptographic machine;

[0029] an information storage module, configured to receive and verify the second feature information sent by the other cryptographic machines, if there is a target cryptographic machine that passes the verification among the other cryptographic machines, determine the target cryptographic machine as a synchronizable device, and record the corresponding second feature information to obtain a current synchronizable device list;

[0030] a data forwarding module, configured to encrypt the received to-be-synchronized data to obtain encrypted data corresponding to the to-be-synchronized data, and send the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine decrypts the encrypted data and stores the obtained to-be-synchronized data.

[0031] In a third aspect, the present application provides an electronic device, comprising:

[0032] a memory, configured to save a computer program;

[0033] a processor, configured to execute the computer program to realize the foregoing centralized multi-machine synchronization method.

[0034] In a fourth aspect, the present application provides a computer readable storage medium, configured to save a computer program, the computer program is executed by a processor to realize the foregoing centralized multi-machine synchronization method.

[0035] As can be seen, in this application, any cryptographic machine located in the cryptographic machine cluster first broadcasts its local first characteristic information so that other cryptographic machines in the cluster can receive the first characteristic information and determine whether the broadcast initiating cryptographic machine is a synchronizable device based on the first characteristic information. If so, it sends its local second characteristic information to the broadcast initiating cryptographic machine. The broadcast initiating cryptographic machine is the cryptographic machine in the cryptographic machine cluster that broadcasts the first characteristic information. Then, it receives and verifies the second characteristic information sent by the other cryptographic machines. If there is a target cryptographic machine among the other cryptographic machines that has passed the verification, the target cryptographic machine is determined to be a synchronizable device, and the corresponding second characteristic information is recorded to obtain the current list of synchronizable devices. Finally, the received data to be synchronized is encrypted to obtain encrypted data corresponding to the data to be synchronized, and the encrypted data is sent to the target synchronizable cryptographic machine in the current list of synchronizable devices so that the target synchronizable cryptographic machine can decrypt the encrypted data and store the decrypted data to be synchronized. In this way, since any cryptographic machine in the cryptographic machine cluster broadcasts its local first characteristic information and verifies the second characteristic information returned by other cryptographic machines, it can identify the devices that can be synchronized. By storing the second characteristic information, a list of currently synchronizeable devices is obtained. The list of synchronizeable devices enables any cryptographic machine in the cluster to forward the data to be synchronized, thereby avoiding the reliance on a centralized control node to complete information synchronization. This also avoids the problem of information not being synchronized when the central control node has a problem. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0037] Figure 1 This application discloses a flowchart of a decentralized multi-machine synchronization method.

[0038] Figure 2 Here is a flowchart of an intelligent grouping process disclosed in this application;

[0039] Figure 3 This application discloses a data synchronization flowchart;

[0040] Figure 4 This application discloses a specific decentralized multi-machine synchronization method flowchart;

[0041] Figure 5A decentralized multi-machine synchronization device disclosed in the application is shown in a schematic diagram.

[0042] Figure 6 An electronic device structure disclosed in the application is shown in a schematic diagram. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the application will be clearly and completely described in combination with the drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the application.

[0044] Referring to Figure 1 The embodiments of the application disclose a decentralized multi-machine synchronization method, applied to any cryptographic machine in a cryptographic machine cluster, comprising the following steps:

[0045] In step S11, the first feature information of the local machine is broadcasted, so that other cryptographic machines in the cryptographic machine cluster receive the first feature information, and it is judged according to the first feature information whether the broadcast initiating cryptographic machine is a synchronizable device, if yes, the second feature information of the local machine is sent to the broadcast initiating cryptographic machine; the broadcast initiating cryptographic machine is the cryptographic machine in the cryptographic machine cluster that broadcasts the first feature information.

[0046] In the embodiment, the broadcast initiator password machine that broadcasts the local first feature information can be any password machine in the password machine cluster. In one specific implementation, any password machine in the password machine cluster broadcasts the local first feature information so that other password machines in the password machine cluster receive the first feature information. In another specific implementation, any three password machines in the password machine cluster simultaneously broadcast the local first feature information so that other password machines in the password machine cluster receive different first feature information respectively located in the any three password machines. It should be noted that the broadcasting of the local first feature information can be global broadcasting of the local first feature information in the entire password machine cluster, or broadcasting of the local first feature information in a preset range of the password machine cluster. It should be noted that the reception of the first feature information by other password machines in the password machine cluster can be periodic reception at a preset time interval, or immediate reception of the first feature information of the broadcast initiator when it is detected that a password machine broadcasts. Before broadcasting the local first feature information, the method further includes: setting a group identifier for each password machine, and determining a device certificate of a preset elliptic curve cryptography algorithm using the same certificate authority, to save the device certificate and a preset root certificate chain. The device group identifier is a unique basis for dividing devices in the same group, and is used to confirm whether the devices should work cooperatively. In one specific implementation, the device certificate of the preset elliptic curve cryptography algorithm, i.e., the SM2 algorithm, is determined for each password machine using the same certificate authority, i.e., CA (Certificate Authority, certificate authority), to save the device certificate of the SM2 algorithm and a preset root certificate chain. The certificate authority is an authority responsible for issuing and managing digital certificates, also known as a "certificate authentication agency" or "certificate authorization center". The device certificate is a unique key pair randomly generated based on the device, which is signed by a trusted CA (certificate authority). It contains the public key of the device and other related information, which can be used to verify the identity and security of the device, and ensure the authenticity of the communication parties and the integrity of the data during communication between devices. The root certificate chain is an ordered structure composed of a root certificate and possibly existing intermediate certificates. Each intermediate certificate is signed by the upper-level certificate, and ultimately traces back to the root certificate. The root certificate chain is used to verify the validity and legality of the target certificate, and can ensure that the certificate is issued by a trusted agency.

[0047] The local first feature information is broadcasted so that other password machines in the password machine cluster receive the first feature information, and whether the broadcast initiator password machine is a synchronizable device is determined according to the first feature information, such asFigure 2 As shown, specifically can include: by a preset hash algorithm, namely SM3 algorithm (SM3 Algorithm, a hash algorithm, output length is 256 bits) to calculate the local first device group identifier, namely device group identifier ID1, to get the first digest value corresponding to the device group identifier ID1, namely digest value H1; the digest value H1 is cut into two parts by cutting the digest value H1 with a preset length, for example, cutting the digest value H1 with a length of 16 bytes, and performing XOR operation on the obtained cut data, and taking the obtained operation result as the first key, namely the key KEY1; the first device group identifier ID1 is encrypted by the ECB (Electronic Codebook, a basic block cipher mode) mode of the preset block symmetric cipher algorithm, namely SM4 algorithm (SM4 Algorithm, a block symmetric cipher algorithm, the block length and the key length are both 128 bits) with the first key KEY1, to get the first device group identifier ciphertext, namely ciphertext C1, and the first device group identifier ciphertext C1 is signed by the local first private key to get the first signature value, namely signature value S1; the local first public key certificate, namely public key certificate CERT1, the first device group identifier ciphertext C1, the first signature value S1 are taken as the first feature information, and the first feature information is broadcasted, so that other password machines in the password machine cluster receive the first feature information, verify the first public key certificate CERT1 by using the local root certificate chain, and verify the first signature value S1 after the first public key certificate CERT1 is verified, and in the first signature value S1 is verified, the first device group identifier ciphertext C1 is decrypted by using the local second key, namely the key KEY2 and the ECB mode of the SM4 algorithm, and the decrypted first device group identifier C1 is compared with the local second device group identifier, namely the device group identifier ID2, if the first device group identifier ID1 is the same as the local second device group identifier ID2, the broadcast initiator password machine is determined as a synchronizable device; wherein the second key KEY2 is a key obtained by other password machines using a preset hash algorithm, namely SM3 algorithm, to calculate the second digest value H2 corresponding to the local second device group identifier ID2, and cutting the second digest value H2 to perform XOR operation on the obtained cut data. The embodiment broadcasts the encrypted data by using the encryption algorithm, and other password machines decrypt the data by using the same encryption algorithm, which improves the security in the data transmission process.

[0048] Step S12, receiving and verifying the second feature information sent by the other password machines, if there is a target password machine that passes the verification in the other password machines, the target password machine is determined as a synchronizable device, and the corresponding second feature information is recorded to obtain a current synchronizable device list.

[0049] In this embodiment, the target password machine that passes the verification can be one or more password machines. In one specific implementation, if there is one target password machine that passes the verification among the other password machines, the password machine is determined as a synchronizable device, and the corresponding second characteristic information is recorded to obtain a current synchronizable device list. In another specific implementation, if there are five target password machines that pass the verification among the other password machines, the password machine is determined as a synchronizable device, and the corresponding second characteristic information is recorded to obtain a current synchronizable device list. It should be noted that the recording of the corresponding second characteristic information can be recording all the second characteristic information, or only recording the information included in the second characteristic information that can determine the identity of the target password machine. Before the recording, the broadcast initiating password machine needs to decrypt the second characteristic information by using the local first private key. In this embodiment, the second characteristic information sent by the other password machines is accepted and verified, which specifically can include: verifying the second public key certificate, i.e., the public key certificate CERT2, and the second signature value, i.e., the signature value S2, included in the second characteristic information; the second public key certificate CERT2 is the public key certificate of the other password machine; the second signature value S2 is a signature value obtained by encrypting the second data ciphertext, i.e., the ciphertext information C2, by using the local second private key; and the second data ciphertext C2 is the data ciphertext obtained by encrypting the local device information by using the first public key certificate CERT1. In this embodiment, the second characteristic information is further verified by the broadcast initiating password machine, so that the target password machine in the other password machines is accurately determined, and the reliability of the synchronizable device verification process is improved.

[0050] In step S13, the received to-be-synchronized data is encrypted to obtain encrypted data corresponding to the to-be-synchronized data, and the encrypted data is sent to a target synchronizable password machine in the current synchronizable device list, so that the target synchronizable password machine decrypts the encrypted data and stores the decrypted to-be-synchronized data.

[0051] In this embodiment, the received to-be-synchronized data is encrypted to obtain encrypted data corresponding to the to-be-synchronized data, which specifically can include: as Figure 3As shown, a random key KEY1 is generated, and the random key is encrypted by using a second public key certificate CERT2 to obtain random key ciphertext, i.e., random key ciphertext C1; the to-be-synchronized data in the to-be-synchronized data list is encrypted by using the SM4 algorithm in the GCM (Galois / Counter Mode, a kind of symmetric encryption algorithm mode) mode and the random key to obtain first data ciphertext, i.e., data ciphertext C2, and the first data ciphertext C2 and the random key ciphertext C1 are taken as encrypted data. The encrypted data is sent to the target synchronizable cryptomachine in the current synchronizable device list, so that the target synchronizable cryptomachine decrypts the encrypted data and stores the to-be-synchronized data obtained after decryption. Specifically, the encrypted data can be sent to the target synchronizable cryptomachine in the current synchronizable device list, so that the target synchronizable cryptomachine decrypts the random key ciphertext C1 in the encrypted data by using the local second private key. If the decryption is successful, the first data ciphertext C2 in the encrypted data is decrypted by using the random key KEY1 obtained after decryption and the GCM mode of the SM4 algorithm, and the obtained to-be-synchronized data is stored locally. In this embodiment, the to-be-synchronized data is encrypted, and the encrypted data is sent to the target synchronizable cryptomachine, thereby improving the security in the data transmission process.

[0052] As can be seen, in the embodiment of the application, any cryptomachine in the cryptomachine cluster broadcasts the local first feature information and verifies the second feature information returned by other cryptomachines, thereby determining the synchronizable device. The current synchronizable device list is obtained by storing the second feature information, and any cryptomachine in the cluster forwards the to-be-synchronized data through the synchronizable device list, thereby avoiding the dependence on the centralized control node to complete information synchronization. Moreover, the out-of-service device in the synchronizable device list is deleted by the active detection process in the cryptomachine, thereby ensuring the reliability of the synchronizable device list information.

[0053] Based on the foregoing embodiments, when there are multiple pieces of to-be-synchronized data, the to-be-synchronized data may not be accurately received by the synchronizable device, thereby causing the to-be-synchronized data to be lost. Therefore, this embodiment describes in detail how to avoid the occurrence of the to-be-synchronized data loss condition, as described in Figure 4 As shown, the embodiment of the application discloses a decentralized multi-machine synchronization method applied to any cryptomachine in a cryptomachine cluster, which comprises the following steps:

[0054] Step S21, broadcast the first feature information locally, so that other cryptographic machines in the cryptographic machine cluster receive the first feature information, and determine whether the broadcast initiating cryptographic machine is a synchronizable device according to the first feature information, and if so, send the second feature information locally to the broadcast initiating cryptographic machine; the broadcast initiating cryptographic machine is the cryptographic machine that broadcasts the first feature information in the cryptographic machine cluster.

[0055] In this embodiment, a process detectMates that periodically sends a probe packet to actively probe the companion devices according to a preset strategy is running in the broadcast initiating cryptographic machine, the process collects the companion devices in the cryptographic machine cluster through the received feedback information, i.e., the second feature information, and records them in the local synchronizable device list. When the existing companion device in the companion device list does not feedback information in continuous several times of probing, and the number of times reaches a preset threshold, the process will automatically determine that the synchronizable device has been lost, and delete the information of the companion device from the local synchronizable device list. In a specific implementation, if the existing companion device in the companion device list does not feedback information in continuous three times of probing, the process will automatically determine that the synchronizable device has been lost, and delete the information of the companion device from the local synchronizable device list. In this embodiment, by periodically probing the synchronizable devices in the synchronizable device list, the synchronizable device information in the synchronizable device list is updated in real time according to the probing result, so as to ensure the timeliness of the synchronizable device list.

[0056] Step S22, receive and verify the second feature information sent by the other cryptographic machines, if there is a target cryptographic machine that passes the verification in the other cryptographic machines, determine the target cryptographic machine as a synchronizable device, and record the corresponding second feature information to obtain a current synchronizable device list.

[0057] Step S23, if a data synchronization request is received, determine the to-be-synchronized data corresponding to the data synchronization request; determine the request arrival time of receiving the data synchronization request, and add the to-be-synchronized data to the to-be-synchronized data list based on the request arrival time.

[0058] In the embodiment, a request arrival time of the data synchronization request is determined, and the to-be-synchronized data is sequentially added to the to-be-synchronized data list based on the request arrival time. It should be noted that a proactive synchronization process syncData is run in the cryptographic machine, the process periodically checks the to-be-synchronized data list according to a preset data synchronization strategy, and attempts to sequentially push each piece of data in the to-be-synchronized data list to the unsynchronized devices. The process removes the out-of-contact companion device from the parameters of the unsynchronized data according to the current to-be-synchronized device list. The process updates the synchronization state of each to-be-synchronized data after processing one piece of to-be-synchronized data each time. If the data has completed synchronization with all the to-be-synchronized devices, the data is removed from the to-be-synchronized data list, otherwise, the data is retained and the list of unsynchronized companion devices is updated. The process sequentially processes each piece of to-be-synchronized data in the to-be-synchronized data list in a periodic order according to the order of the to-be-synchronized data in the to-be-synchronized data list. In the embodiment, the proactive synchronization process sequentially sends the to-be-synchronized data to the to-be-synchronized devices that have not completed data synchronization according to the order of the to-be-synchronized data information in the to-be-synchronized data list, thereby avoiding the situation that the to-be-synchronized data is repeatedly sent to the same to-be-synchronized device.

[0059] In step S24, the received to-be-synchronized data is encrypted to obtain encrypted data corresponding to the to-be-synchronized data, and the encrypted data is sent to a target to-be-synchronized cryptographic machine in the current to-be-synchronized device list, so that the target to-be-synchronized cryptographic machine decrypts the encrypted data and stores the decrypted to-be-synchronized data.

[0060] The specific process of steps S22 and S24 is described in the foregoing embodiments, and will not be repeated here.

[0061] In the embodiment, the proactive detection process is used to detect the devices in the to-be-synchronized device list to maintain the reliability of the to-be-synchronized device list, and the proactive synchronization process is used to sequentially send the to-be-synchronized data to the to-be-synchronized devices that have not completed data synchronization according to the order of the to-be-synchronized data information in the to-be-synchronized data list, thereby avoiding the situation that the to-be-synchronized data is repeatedly sent to the same to-be-synchronized device. In addition, the to-be-synchronized data is sequentially added to the to-be-synchronized data list according to the synchronization request arrival time, and the to-be-synchronized data is sequentially sent, thereby avoiding the situation that the to-be-synchronized data is lost.

[0062] Referring to Figure 5 The embodiment of the present application also discloses a decentralized multi-machine synchronization device, which is applied to any cryptographic machine in a cryptographic machine cluster and includes:

[0063] The information sending module 11 is configured to broadcast the first feature information locally, so that other password machines in the password machine cluster receive the first feature information, and determine whether the password machine initiating the broadcast is a synchronizable device according to the first feature information, and if so, send the second feature information locally to the password machine initiating the broadcast;

[0064] The information storage module 12 is configured to receive and verify the second feature information sent by the other password machines, if there is a target password machine that passes the verification among the other password machines, determine the target password machine as a synchronizable device, and record the corresponding second feature information to obtain a current synchronizable device list;

[0065] The data forwarding module 13 is configured to encrypt the received to-be-synchronized data to obtain encrypted data corresponding to the to-be-synchronized data, and send the encrypted data to a target synchronizable password machine in the current synchronizable device list, so that the target synchronizable password machine decrypts the encrypted data and stores the decrypted to-be-synchronized data.

[0066] Therefore, the embodiment of the application realizes forwarding of to-be-synchronized data by any password machine in the cluster through the synchronizable device list, thereby avoiding the problem that information cannot be synchronized when the central control node has a problem.

[0067] In some specific embodiments, the information sending module 11 further comprises:

[0068] The certificate determining unit is configured to set a group identifier for each password machine, and determine a device certificate of a preset elliptic curve cryptographic algorithm using the same certificate authority, to save the device certificate and a preset root certificate chain.

[0069] In some specific embodiments, the information sending module 11 specifically comprises:

[0070] The group identifier calculation unit is configured to calculate a first device group identifier locally by a preset hash algorithm, to obtain a first digest value corresponding to the first device identifier;

[0071] The data operation unit is configured to split the first digest value, and perform an exclusive or operation on the split data, to obtain an operation result as a first key;

[0072] The group identifier encryption unit is configured to encrypt the first device group identifier by a preset group symmetric algorithm and the first key, to obtain first device group identifier ciphertext, and sign the first device group identifier ciphertext using a first private key locally, to obtain a first signature value.

[0073] an information broadcasting unit, configured to broadcast, as first feature information, a first public key certificate, the first device group identification ciphertext, and the first signature value, so that other password machines in the password machine cluster verify the first public key certificate by using a local root certificate chain after receiving the first feature information, and verify the first signature value after the first public key certificate passes the verification, and decrypt the first device group identification ciphertext by using a local second key and a preset group symmetric cipher algorithm after the first signature value passes the verification, and compare the decrypted first device group identification with a local second device group identification, and determine the broadcast initiating password machine as a synchronizable device if the first device group identification is the same as the local second device group identification;

[0074] The second key is a second digest value corresponding to the local second device group identification, which is calculated by the other password machines by using a preset hash algorithm, and is obtained by performing exclusive or operation on the cut data.

[0075] In some specific embodiments, the information storage module 12 specifically can include:

[0076] an information verification unit, configured to verify a second public key certificate and a second signature value contained in the second feature information; the second public key certificate is a public key certificate of the other password machines; the second signature value is a signature value obtained by encrypting second data ciphertext by using a local second private key; and the second data ciphertext is data ciphertext obtained by encrypting device information of the other password machines by using the first public key certificate.

[0077] In some specific embodiments, the data forwarding module 13 specifically further includes:

[0078] a data determination unit, configured to determine to-be-synchronized data corresponding to the data synchronization request if the data synchronization request is received;

[0079] a data adding unit, configured to determine a request arrival time of receiving the data synchronization request, and add the to-be-synchronized data to a to-be-synchronized data list based on the request arrival time;

[0080] a key encryption unit, configured to generate a random key, and encrypt the random key by using the second public key certificate to obtain random key ciphertext;

[0081] a data encryption unit, configured to encrypt the to-be-synchronized data in the to-be-synchronized data list by a preset block symmetric cipher algorithm and the random key, to obtain first data ciphertext, and to send the first data ciphertext and the random key ciphertext as encrypted data;

[0082] a data sending unit, configured to send the encrypted data to a target synchronizable cipher machine in the current synchronizable device list, so that the target synchronizable cipher machine decrypts the random key ciphertext in the encrypted data by using a local second private key, and if the decryption is successful, decrypts the first data ciphertext in the encrypted data by using the random key obtained by the decryption and the preset block symmetric cipher algorithm, and stores the to-be-synchronized data obtained by the decryption to the local device.

[0083] Further, the embodiment of the present application further discloses an electronic device, Figure 6 is an electronic device 20 structure diagram shown according to an exemplary embodiment, the contents in the figure cannot be considered as any limitation on the use range of the present application. The electronic device 20, specifically can include: at least one processor 21, at least one memory 22, power supply 23, communication interface 24, input output interface 25 and communication bus 26. Wherein, the memory 22 is used for storing computer program, the computer program is loaded and executed by the processor 21, to realize the related steps in the 6 method disclosed in any preceding embodiment. In addition, the electronic device 20 in the embodiment specifically can be electronic computer.

[0084] In the embodiment, the power supply 23 is used for providing working voltage for each hardware device on the electronic device 20; the communication interface 24 can create data transmission channel between the electronic device 20 and external device, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which is not limited specifically herein; the input output interface 25 is used for obtaining external input data or outputting data to the outside world, and the specific interface type can be selected according to the specific application needs, which is not limited specifically herein.

[0085] In addition, the memory 22 as the carrier of resource storage can be read-only memory, random access memory, magnetic disk or optical disk, etc., and the resources stored thereon can include operating system 221, computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0086] The operating system 221 is configured to manage and control the various hardware devices on the electronic device 20, and the computer program 222 can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of implementing the decentralized multi-machine synchronization method disclosed in any of the preceding embodiments, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0087] Further, the present application also discloses a computer readable storage medium for storing a computer program, wherein the computer program is executed by a processor to implement the decentralized multi-machine synchronization method disclosed in the preceding embodiments. For the specific steps of the method, please refer to the corresponding content disclosed in the preceding embodiments, which will not be repeated here.

[0088] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. For the same or similar parts between the embodiments, please refer to the corresponding content in the other embodiments.

[0089] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in general terms. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0090] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, software modules executed by a processor, or a combination of both. The software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0091] Finally, it needs to be pointed out that in this document, relational terms such as first and second and the like can only be intended to distinguish one entity or operation from another entity or operation without necessarily requiring or implying any actual such relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus including the stated element.

[0092] The above detailed description of the technical solutions provided by the present application has been provided, and the principles and implementation modes of the present application have been described by applying specific examples. The above description of the examples is only for the purpose of helping to understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed, and the above description of the content of the specification should not be understood as a limitation of the present application.

Claims

1. A method for decentralized multi-machine synchronization, the method comprising: The application is applied to any cryptographic machine in a cryptographic machine cluster, comprising: broadcasting local first feature information so that other cryptographic machines in the cryptographic machine cluster receive the first feature information and determine whether the broadcast initiating cryptographic machine is a synchronizable device according to the first feature information, and if so, sending local second feature information to the broadcast initiating cryptographic machine; the broadcast initiating cryptographic machine is the cryptographic machine that broadcasts the first feature information in the cryptographic machine cluster; receiving and verifying the second feature information sent by the other cryptographic machines, if there is a target cryptographic machine that passes the verification among the other cryptographic machines, determining the target cryptographic machine as a synchronizable device, and recording the corresponding second feature information to obtain a current synchronizable device list; encrypting the received to-be-synchronized data to obtain encrypted data corresponding to the to-be-synchronized data, and sending the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list so that the target synchronizable cryptographic machine decrypts the encrypted data and stores the decrypted to-be-synchronized data.

2. The method of claim 1, wherein, Before the broadcasting of the local first feature information, the method further comprises: setting a group identifier for each cryptographic machine, and determining a device certificate of a preset elliptic curve cryptographic algorithm using the same certificate authority, to save the device certificate and a preset root certificate chain.

3. The method of claim 2, wherein, The broadcasting of the local first feature information so that other cryptographic machines in the cryptographic machine cluster receive the first feature information and determine whether the broadcast initiating cryptographic machine is a synchronizable device according to the first feature information comprises: calculating a first device group identifier locally by a preset hash algorithm to obtain a first digest value corresponding to the first device identifier; splitting the first digest value and performing an exclusive or operation on the split data to obtain an operation result as a first key; encrypting the first device group identifier by a preset group symmetric algorithm and the first key to obtain first device group identifier ciphertext, and signing the first device group identifier ciphertext using a local first private key to obtain a first signature value; taking a local first public key certificate, the first device group identifier ciphertext, and the first signature value as first feature information, and broadcasting the first feature information so that after other cryptographic machines in the cryptographic machine cluster receive the first feature information, they verify the first public key certificate using a local root certificate chain, and after the first public key certificate passes the verification, they verify the first signature value, and after the first signature value passes the verification, they decrypt the first device group identifier ciphertext using a local second key and a preset group symmetric cryptographic algorithm, and compare the decrypted first device group identifier with a local second device group identifier, and if the first device group identifier is the same as the local second device group identifier, the broadcast initiating cryptographic machine is determined as a synchronizable device. The second key is a key obtained by performing XOR operation on divided data obtained by dividing a second digest value corresponding to a second device group identifier of the other cryptographic machine using a preset hash algorithm.

4. The method of claim 1 to 3, wherein, The receiving and verifying the second feature information sent by the other cryptographic machine comprises: verifying a second public key certificate and a second signature value contained in the second feature information; the second public key certificate is a public key certificate of the other cryptographic machine; the second signature value is a signature value obtained by encrypting second data ciphertext using a second private key locally; the second data ciphertext is data ciphertext obtained by encrypting device information locally through a first public key certificate.

5. The method of claim 4, wherein, The encrypting the received to-be-synchronized data to obtain encrypted data corresponding to the to-be-synchronized data, and sending the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine decrypts the encrypted data and stores the to-be-synchronized data obtained after decryption, further comprises: If a data synchronization request is received, determining to-be-synchronized data corresponding to the data synchronization request; Determining a request arrival time of receiving the data synchronization request, and adding the to-be-synchronized data to a to-be-synchronized data list based on the request arrival time.

6. The method of claim 5, wherein, The encrypting the received to-be-synchronized data to obtain encrypted data corresponding to the to-be-synchronized data, comprises: generating a random key and encrypting the random key using the second public key certificate to obtain random key ciphertext; encrypting the to-be-synchronized data in the to-be-synchronized data list using the random key through a preset group symmetric cryptographic algorithm to obtain first data ciphertext, and taking the first data ciphertext and the random key ciphertext as encrypted data.

7. The method of claim 6, wherein, The sending the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine decrypts the encrypted data and stores the to-be-synchronized data obtained after decryption, comprises: sending the encrypted data to the target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine decrypts the random key ciphertext in the encrypted data using a second private key locally, if the decryption is successful, decrypting the first data ciphertext in the encrypted data through the random key obtained after decryption and the preset group symmetric cryptographic algorithm, and storing the to-be-synchronized data obtained to the local.

8. A decentralized multi-machine synchronization apparatus, characterized by, Any cryptographic machine applied to a cryptographic machine cluster, comprising: An information sending module is configured to broadcast first feature information locally, so that other cryptographic machines in the cryptographic machine cluster receive the first feature information, and determine whether the broadcast initiating cryptographic machine is a synchronizable device according to the first feature information, and if so, send second feature information locally to the broadcast initiating cryptographic machine; An information storage module is configured to receive and verify second characteristic information sent by the other cryptographic machines. If a target cryptographic machine that passes the verification exists in the other cryptographic machines, the target cryptographic machine is determined as a synchronizable device, and the corresponding second characteristic information is recorded to obtain a current synchronizable device list. A data forwarding module is configured to encrypt received to-be-synchronized data to obtain encrypted data corresponding to the to-be-synchronized data, and send the encrypted data to a target synchronizable cryptographic machine in the current synchronizable device list, so that the target synchronizable cryptographic machine decrypts the encrypted data and stores the decrypted to-be-synchronized data.

9. A decentralized multi-machine synchronization device, characterized by, Comprise: a memory for saving a computer program; a processor for executing the computer program to implement the decentralized multi-machine synchronization method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is saved, wherein the computer program is executed by a processor to implement the decentralized multi-machine synchronization method according to any one of claims 1 to 7.

Images