Time synchronization method, cloud server, electronic equipment and storage medium

Abstract

The invention provides a time synchronization method, a cloud server, electronic equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: acquiring a first synchronization time parameter and a randomly generated quantum key when a current container is synchronized, generating a first hash value according to the quantum key, time offset and synchronization system time, and storing the first hash value and the first synchronization time parameter into a preset database; reading an actual hash value and an actual synchronization time parameter which are actually stored at present from the database, and if the first synchronization time parameter is verified not to be tampered based on the quantum key, the actual hash value and the actual synchronization time parameter, obtaining a current system time parameter when the current container is verified, and according to the current system time parameter and the first synchronization system time parameter, generating synchronization time after the current container and the reliable time source start remote clock synchronization, thereby realizing time synchronization between each container deployed on the cloud server and the reliable time source.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a time synchronization method, a cloud server, an electronic device and a storage medium. Background Art

[0002] Usually, in order to ensure the time consistency of the system in a distributed environment, it is proposed to deploy multiple servers with isomorphic timestamps on a cloud server device, all using Docker containerization technology. In this multi-container environment, time data records the activity sequence of the system, transaction time, and other key events. Therefore, accurate and timely synchronization of container time is crucial to the normal operation of the system and the consistency of business data.

[0003] However, due to the characteristics of the containerized environment, there are challenges in container time synchronization. In a multi-container environment, time synchronization issues between containers may lead to inconsistency and confusion of time data; and time offsets between containers may cause data consistency issues and may cause confusion in the order of events, thus affecting the traceability and consistency of the system; in addition, since containers share the system time of the host machine, time synchronization issues between containers may cause time interference between containers, thus affecting the stability and security of the system.

[0004] Therefore, there is an urgent need to provide a time synchronization isolation solution for multiple containers. Summary of the invention

[0005] The object of the present invention is to provide a time synchronization method, a cloud server, an electronic device and a storage medium to address the deficiencies in the above-mentioned prior art, so as to provide a time synchronization isolation solution for multiple containers.

[0006] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows: In a first aspect, an embodiment of the present application provides a time synchronization method, the method comprising: Acquire a first synchronization time parameter and a randomly generated quantum key when synchronizing the current container, wherein the first synchronization time parameter includes: a time offset, a synchronization system time, and a synchronization system running time, wherein the time offset is used to indicate an offset between a local time of the current container and a reliable time provided by a reliable time source, the synchronization system time is used to indicate a local time when the current container starts remote clock synchronization with the reliable time source, and the synchronization system running time is used to indicate a running time from startup to completion of clock synchronization when the current container starts remote clock synchronization with the reliable time source; Generate a first hash value according to the time offset, the synchronization system time and the quantum key, and store the first hash value and the first synchronization time parameter in a preset database; Obtaining the actual hash value and the actual synchronization time parameter currently actually stored in the database; Determining whether the first synchronization time parameter has been tampered with according to the actual hash value, the actual synchronization time parameter and the quantum key; If not, then obtain the current time parameters of the current container verification, wherein the current time parameters include: the current system time and the current system running time, the current system time is used to indicate the local time when the current container is verified, and the current system running time is used to indicate the running time of the current container from booting to completing the verification; The synchronization time after the current container and the reliable time source start remote clock synchronization is generated according to the current system time, the current system running time, the synchronization system time, the synchronization system running time and the time offset.

[0007] Optionally, determining whether the first synchronization time parameter is tampered with according to the actual hash value, the actual synchronization time parameter and the quantum key includes: Generate a verification hash value according to the actual synchronization time parameter and the quantum key; According to the comparison result between the actual hash value and the verification hash value, it is determined whether the first synchronization time parameter is tampered with.

[0008] Optionally, determining whether the first synchronization time parameter is tampered with according to a comparison result of the actual hash value and the verification hash value includes: If the comparison result of the actual hash value and the verification hash value is consistent, it is determined that the first synchronization time parameter has not been tampered with; If the comparison result between the actual hash value and the verification hash value is inconsistent, it is determined that the first synchronization time parameter has been tampered with.

[0009] Optionally, generating the synchronization time after the current container and the reliable time source start remote clock synchronization according to the current system time, the current system running time, the synchronization system time, the synchronization system running time and the time offset includes: Determine a first difference between the current system time and the current system running time; determining a second difference between the synchronization system time and the synchronization system running time; Determine an error value between the first difference and the second difference; The synchronization time after the current container starts remote clock synchronization with the reliable time source is generated according to the error value.

[0010] Optionally, generating, according to the error value, a synchronization time after the current container and the reliable time source start remote clock synchronization includes: Determining whether the error value falls within a preset error interval; If so, determine that the current time parameter has not been modified, and generate a synchronization time after the current container and the reliable time source start remote clock synchronization based on the current system time and the time offset; If not, it is determined that the current time parameter has been modified, and a network time protocol is used to generate a synchronization time after the current container and the reliable time source start remote clock synchronization.

[0011] Optionally, generating, according to the current system time and the time offset, a synchronization time after the current container and the reliable time source start remote clock synchronization includes: A sum of the current system time and the time offset is determined, and the sum is used as the synchronization time after the current container and the reliable time source start remote clock synchronization.

[0012] Optionally, obtaining the initial synchronization time parameter of the current container includes: The remote clock synchronization is started by using the network time protocol and the reliable time source, and the time offset, the synchronized system time and the synchronized system running time of the current container are obtained.

[0013] Optionally, it also includes: If the first synchronization time parameter has been tampered with, a new first synchronization time parameter for resynchronizing the current container is reacquired and stored.

[0014] In a second aspect, an embodiment of the present application further provides a cloud server, on which multiple containers are deployed, and each container is isolated from each other. Time synchronization of each container is achieved by executing the method steps described in the items provided in the first aspect on each container.

[0015] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps of the method provided in the first aspect.

[0016] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method provided in the first aspect is executed.

[0017] The beneficial effects of this application are: The embodiment of the present application provides a time synchronization method, a cloud server, an electronic device and a storage medium. In this solution, in order to further improve the accuracy of time data and the security of the system, a quantum random number generation technology is introduced. First, a randomly generated quantum key is obtained. At the same time, based on the container isolation technology, the entire system in each container deployed on the cloud server is synchronized under a standard time reference, that is, the first synchronization time parameter when the current container starts remote clock synchronization with a reliable time source is obtained. The first synchronization time parameter includes: time offset, synchronization system time, and synchronization system running time. The quantum key is used to calculate the hash value of the time offset and the synchronization system time to generate a first hash value. The first hash value is used as the first hash value. The hash value and the first synchronization time parameter are stored in a preset database; during verification, the actual hash value and the actual synchronization time parameter currently stored are read from the database, and based on the quantum key, the actual hash value and the actual synchronization time parameter, the first synchronization time parameter is verified to see if it has been tampered with, thereby ensuring the integrity and tamper-proof nature of the time data during the storage process; if it has not been tampered with, the current system time and the current system running time during the current container verification are obtained, and based on the current system time, the current system running time, the synchronization system time and the synchronization system running time, the synchronization time after the current container and the reliable time source start the remote clock synchronization is generated, so that the time calculation of the business scenario is performed based on the synchronization time after synchronization. Therefore, in this solution, when each container and the reliable time source start the remote clock synchronization operation, they are isolated from each other and do not affect each other, that is, the time synchronization operation of each container will not affect other containers, and the time synchronization between each container deployed on the cloud server and the reliable time source is realized, thereby improving the stability and security of the system, and effectively solving the problem of non-isolation of time synchronization between multiple docker containers under the same host machine.

[0018] Optionally, the time synchronization method provided by this solution first verifies whether the first synchronization time parameter has been tampered with based on the first synchronization time parameter obtained during synchronization, the actual hash value and the actual synchronization time parameter currently actually stored read from the database, and the quantum key; if it has not been tampered with, it verifies whether the current system time has been tampered with externally based on the current system time, the current system running time, the synchronization system time, and the synchronization system running time, so as to further ensure the current system time and accuracy. That is, this solution proposes to double-verify the time data of the current container, so that the accuracy of the synchronization time after the final synchronization can be ensured, and the isolation of the time data of each container can also be enhanced, thereby improving the protection against potential data tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A schematic diagram of a time synchronization application scenario provided in an embodiment of the present application; Figure 2 A schematic diagram of a time synchronization method provided in an embodiment of the present application; Figure 3 A flowchart of another time synchronization method provided in an embodiment of the present application; Figure 4 A flowchart of another time synchronization method provided in an embodiment of the present application; Figure 5 A flowchart of another time synchronization method provided in an embodiment of the present application; Figure 6 A schematic diagram of a flow chart of yet another time synchronization method provided in an embodiment of the present application; Figure 7 A schematic diagram of a process flow when a current container starts remote clock synchronization with a reliable time source in a time synchronization method provided in an embodiment of the present application; Figure 8 A schematic diagram of a process flow when a current container performs clock verification in a time synchronization method provided in an embodiment of the present application; Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0021] Icons: 1- cloud server; 2- container. DETAILED DESCRIPTION

[0022] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0023] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0024] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0025] First, the professional terms involved in this application are introduced.

[0026] 1. Quantum random numbers: Quantum random numbers use the uncertainty principle in quantum mechanics to generate true random numbers. This randomness is based on the unpredictability and uncertainty of quantum systems. In quantum mechanics, some phenomena (such as the superposition of quantum states and the uncertainty of measurement results) ensure the randomness of quantum systems and cannot be fully simulated or predicted by classical means.

[0027] 2. Docker container: Docker container is a standardized unit on the Docker platform, used to package and transport applications and all their dependencies, ensuring that applications can run in a consistent manner in different environments. Docker containerization is the process of packaging applications and their dependencies into Docker containers. Docker containers can run in different computing environments without being affected by differences in operating systems and infrastructure, providing a more lightweight and portable deployment method.

[0028] 3. Network Time Protocol (NTP): It is a protocol used to synchronize clocks in computer networks, which ensures that devices in the network have accurate time information. NTP uses a hierarchical client-server model to allow devices to obtain accurate time information through the Internet or local network.

[0029] Before describing the technical solution provided by the present application in detail, a brief description is first given of the application scenarios of time synchronization involved in the present application.

[0030] refer to Figure 1 As shown, it is a schematic diagram of an application scenario of time synchronization provided by an embodiment of the present application; Figure 1 As shown, the application scenarios of time synchronization include: a cloud server 1, on which multiple containers 2 are deployed, and each container is isolated from each other.

[0031] Among them, different business systems are running on each container 2, that is, the business system is packaged into the corresponding container using Docker containerization, so that the business system packaged in the container can run in different computing environments without being affected by differences in operating systems and infrastructure, providing a more lightweight and portable deployment method.

[0032] At the same time, in this multi-container environment, each container shares the system time of the host machine (cloud server), and based on container isolation technology, each container is isolated from each other and does not affect each other when starting remote clock synchronization operations with a reliable time source. That is, the time synchronization operation of each container will not affect other containers, thereby improving the stability and security of the system and realizing the isolation of time data.

[0033] Understandably, Figure 1 The above structure is for illustration only. The application scenarios of time synchronization may also include Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0034] The implementation principle and corresponding beneficial effects of the quantum inadvertent transmission method steps provided in the present application will be explained through a number of specific embodiments as follows.

[0035] In one embodiment, reference Figure 2 As shown, a time synchronization method is provided. Optionally, the execution subject of the method can be Figure 1 Each container in the time synchronization application scenario shown in FIG.

[0036] It should be understood that in other embodiments, the order of some steps in the time synchronization method can be interchanged according to actual needs, or some steps can be omitted or deleted. Figure 2 As shown, the method includes: S201. Obtain a first synchronization time parameter and a randomly generated quantum key during synchronization of the current container.

[0037] The first synchronization time parameter includes: time offset offset, synchronization system time system_time, and synchronization system runtime system_runtime. The time offset offset is used to indicate the offset between the local time of the current container and the reliable time provided by the reliable time source, the synchronization system time system_time is used to indicate the local time when the current container starts remote clock synchronization with the reliable time source, and the synchronization system runtime system_runtime is used to indicate the running time from booting to completing clock synchronization when the current container starts remote clock synchronization with the reliable time source.

[0038] Exemplarily, for example, the reliable time source may be an atomic clock, an observatory, a satellite, or other time source.

[0039] In this embodiment, for example, a time calibration server (such as a Beidou clock server or a generalized precise time synchronization protocol network timing service) is running in the current container, and remote clock synchronization can be started with a reliable time source (such as an Internet clock source) through the time calibration server, and the time offset offset of the current container and the synchronized system time system_time are obtained to ensure the consistency and accuracy of the time data of the current container; at the same time, the runtime system_runtime from booting to completing the clock synchronization when the current container starts remote clock synchronization with the reliable time source is calculated.

[0040] S202: Generate a first hash value according to the time offset, the synchronization system time and the quantum key, and store the first hash value and the first synchronization time parameter in a preset database.

[0041] In one achievable method, for example, in order to further improve the accuracy of time data and the security of the system, this solution introduces quantum random number generation technology, and stores the quantum key generated by the quantum random number in a third-party medium (such as USBKey) when initializing the user; after the current container is synchronized in time, the pre-generated quantum key secret_key is read from the third-party medium, and the quantum key secret_key and the selected hash algorithm (such as SHA-256) are used to perform hash message authentication code calculation on the time offset offset and the synchronized system time system_time, and generate the first hash value hmac_value, that is, hmac_value=HMAC(secret_key,offset+system_time), and store the time offset offset, the synchronized system time system_time, the synchronized system runtime system_runtime and the first hash value hmac_value in the preset database in the current container. In this way, the integrity and non-tamperability of the time data during the storage process can be ensured.

[0042] S203: Obtain the actual hash value and actual synchronization time parameter currently stored in the database.

[0043] The actual synchronization time parameters include: actual time offset offset1, actual synchronization system time system_time1, and actual synchronization system runtime system_runtime1.

[0044] It is understandable that when verifying the above-mentioned stored time data, it is necessary to re-read the actual hash value and the actual synchronization time parameter currently stored from the database.

[0045] Among them, (1) if the previously stored first hash value hmac_value has not been tampered with, the actual hash value hmac_value1 is the first hash value hmac_value, that is, hmac_value1=hmac_value; if the previously stored first hash value hmac_value has been tampered with, the actual hash value hmac_value1 is not equal to the first hash value hmac_value, that is, the actual hash value hmac_value1 is the value after the first hash value hmac_value is tampered with.

[0046] (2) If the previously stored time offset offset, the synchronization system time system_time, and the synchronization system running time system_runtime have not been tampered with, the actual synchronization time parameter is the first synchronization time parameter; if any of the previously stored time offset offset, the synchronization system time system_time, and the synchronization system running time system_runtime has been tampered with, the actual synchronization time parameter is the value after the first synchronization time parameter is tampered with.

[0047] S204: Determine whether the first synchronization time parameter has been tampered with according to the actual hash value, the actual synchronization time parameter and the quantum key.

[0048] Optionally, in a feasible method, for example, the actual hash value, the actual synchronization time parameter and the quantum key can be used to determine whether the actual synchronization time parameter is consistent with the first synchronization time parameter. If they are consistent, it is determined that the first synchronization time parameter has not been tampered with; if they are inconsistent, it is determined that the first synchronization time parameter has been tampered with, thereby improving the protection capability of the first synchronization time parameter.

[0049] S205: If not, obtain the current time parameter of the current container verification.

[0050] The current time parameter includes: the current system time now_system_time and the current system runtime now_system_runtime. The current system time now_system_time is used to indicate the local time when the current container is verified, and the current system runtime now_system_runtime is used to indicate the running time of the current container from startup to completion of verification.

[0051] S206. Generate a synchronization time after the current container and the reliable time source start remote clock synchronization according to the current system time, the current system running time, the synchronization system time, the synchronization system running time and the time offset.

[0052] Optionally, in this solution, if it is determined that the first synchronization time parameter has not been tampered with, the current system time now_system_time and the current system runtime now_system_runtime during the current container verification are directly obtained; and according to the current system time now_system_time and the current system runtime now_system_runtime, the synchronization system time system_time, the synchronization system runtime system_runtime and the time offset offset, the synchronization time after the current container and the reliable time source start remote clock synchronization is generated, so that the time calculation of the business scenario is performed according to the synchronized synchronization time. For example, when a certificate needs to be generated or issued in a Docker container, or the system records the log time, the current system time now_system_time can be used instead of directly. Instead, the current system time now_system_time and the time offset offset stored in the database are combined to generate the synchronized synchronization time. In this way, the actual time after synchronization can be calculated more accurately, ensuring the accuracy and traceability of the generated certificate time and the system log time.

[0053] Optionally, the time synchronization method proposed in this solution is adopted. Based on the container isolation technology, the entire system in each container deployed on the cloud server is synchronized under a standard time base, and each container is isolated from and does not affect each other when starting the remote clock synchronization operation with a reliable time source. That is, the time synchronization operation of each container will not affect other containers, and the time synchronization between each container deployed on the cloud server and the reliable time source is realized, thereby improving the stability and security of the system, and effectively solving the problem of non-isolation of time synchronization between multiple Docker containers under the same host machine.

[0054] Optionally, the time synchronization method provided by this solution is not only applicable to simple virtual machine environments, but is also more suitable for complex containerized environments, such as a Docker-based microservice architecture.

[0055] This quantum random number-based Docker container time synchronization isolation and NTP control method is particularly suitable for virtualized environments that require high synchronization and controllability, such as Docker-based container clusters, ensuring the time consistency of the system in a distributed environment while taking into account network latency and system time drift.

[0056] In summary, the embodiment of the present application provides a time synchronization method. In this solution, in order to further improve the accuracy of time data and the security of the system, a quantum random number generation technology is introduced. First, a randomly generated quantum key is obtained. At the same time, based on the container isolation technology, the entire system in each container deployed on the cloud server is synchronized under a standard time reference, that is, the first synchronization time parameter when the current container starts remote clock synchronization with a reliable time source is obtained. The first synchronization time parameter includes: time offset, synchronization system time, and synchronization system running time. The quantum key is used to calculate the hash value of the time offset and the synchronization system time to generate a first hash value, and the first hash value is compared with the first The synchronization time parameters are stored in a preset database; during verification, the actual hash value and the actual synchronization time parameters currently stored are read from the database, and based on the quantum key, the actual hash value and the actual synchronization time parameters, it is verified whether the first synchronization time parameter has been tampered with, thereby ensuring the integrity and non-tamperability of the time data during the storage process; if it has not been tampered with, the current system time and the current system running time during the current container verification are obtained, and based on the current system time, the current system running time, the synchronization system time and the synchronization system running time, the synchronization time after the current container and the reliable time source start the remote clock synchronization is generated, so that the time calculation of the business scenario is performed according to the synchronization time after synchronization. Therefore, in this solution, when each container and the reliable time source start the remote clock synchronization operation, they are isolated from each other and do not affect each other, that is, the time synchronization operation of each container will not affect other containers, and the time synchronization between each container deployed on the cloud server and the reliable time source is realized, thereby improving the stability and security of the system, and effectively solving the problem of non-isolation of time synchronization between multiple docker containers under the same host machine.

[0057] Optionally, refer to Figure 3 As shown, the above step S204 includes: S301. Generate a verification hash value based on actual synchronization time parameters and quantum key.

[0058] S302: Determine whether the first synchronization time parameter is tampered with according to a comparison result between the actual hash value and the verification hash value.

[0059] The actual synchronization time parameters include: actual time offset offset1, actual synchronization system time system_time1, and actual synchronization system runtime system_runtime1.

[0060] Optionally, in order to ensure the correctness and non-tamperability of the first synchronization time parameter, this solution introduces a quantum key generated by a quantum random number to verify the integrity and correctness of the first synchronization time parameter. Specifically, the current container reads a pre-generated quantum key secret_key from a third-party medium, which is the same as the quantum key used to generate the first hash value before, and uses the same quantum key secret_key and hash algorithm to perform a hash message authentication code calculation on the actual time offset offset1 and the actual synchronization time parameter system_time1 to generate a verification hash value calculated_hmac, that is, calculated_hmac=HMAC(secret_key,offset1+system_time1); then, based on the comparison result of the actual hash value hmac_value1 and the verification hash value calculated_hmac, it is determined whether the first synchronization time parameter has been tampered with.

[0061] Optionally, refer to Figure 4 As shown, the above step S302 includes: S401: If the comparison result between the actual hash value and the verification hash value is consistent, it is determined that the first synchronization time parameter has not been tampered with.

[0062] In one feasible method, for example, the actual hash value hmac_value1 is compared with the verification hash value calculated_hmac. If the comparison results of the two are consistent, it is determined that the time offset offset and the synchronization system time system_time have not been tampered with, that is, the second synchronization time parameter is the first synchronization time parameter, and the actual hash value hmac_value1 is also the first hash value hmac_value stored previously.

[0063] S402: If the comparison result between the actual hash value and the verification hash value is inconsistent, it is determined that the first synchronization time parameter has been tampered with.

[0064] In another achievable manner, for example, the actual hash value hmac_value1 is compared with the verification hash value calculated_hmac. If the comparison result of the two is inconsistent, it can be determined that the time offset offset and / or the synchronization system time system_time have been tampered with. And the actual hash value hmac_value1 may not be the first hash value hmac_value stored previously.

[0065] It should be noted that if the first hash value hmac_value is tampered with, the comparison result of the actual hash value hmac_value1 and the verification hash value calculated_hmac must be inconsistent, that is, it is determined that the time offset offset and / or the synchronization system time system_time has been tampered with.

[0066] Optionally, in this solution, quantum random numbers are introduced to generate quantum keys, and the quantum keys are used to perform hash operations on the time offset and the synchronized system time, and the hash operation results are compared to prevent the time data from being forged and tampered with, thereby ensuring the accuracy and non-tamperability of the business time.

[0067] Optionally, refer to Figure 5 As shown, the above step S206 includes: S501: Determine a first difference between the current system time and the current system running time.

[0068] Exemplarily, for example, the boot time of the current container is 9:00, the current system time now_system_time is 11:00, and the current system runtime now_system_runtime is the runtime from the boot time to the completion of verification, that is, 11:00-9:00=2 hours.

[0069] Therefore, the first difference between the current system time now_system_time and the current system runtime now_system_runtime can be determined, that is, now_system_time-now_system_runtime=9.

[0070] S502: Determine a second difference between the synchronization system time and the synchronization system running time.

[0071] Exemplarily, for example, the synchronization system time when the current container is synchronized is 10:00, and the current system running time is the running time from the boot time to the completion of synchronization, that is, 10:00-9:00=1 hour.

[0072] Therefore, the second difference between the synchronous system time system_time and the synchronous system runtime system_runtime can be determined, that is, system_time-system_runtime=9.

[0073] S503: Determine an error value between the first difference and the second difference.

[0074] S504: Generate a synchronization time after the current container starts remote clock synchronization with a reliable time source according to the error value.

[0075] Optionally, the first difference value calculated above is subtracted from the second difference value to obtain an error value between the two, which is 0, and based on the calculated error value, it is determined whether the current time parameter has been modified, that is, whether the current time parameter is credible, so as to further determine the synchronization method for starting remote clock synchronization between the current container and the reliable time source, and then generate the synchronization time after the current container and the reliable time source start remote clock synchronization.

[0076] Optionally, the time synchronization method provided by this solution first verifies whether the first synchronization time parameter has been tampered with based on the first synchronization time parameter obtained during synchronization, the actual hash value and the actual synchronization time parameter currently actually stored read from the database, and the quantum key; if it has not been tampered with, it verifies whether the current system time has been tampered with externally based on the current system time, the current system running time, the synchronization system time, and the synchronization system running time, so as to further ensure the current system time and accuracy. That is, this solution proposes to double-verify the time data of the current container, so that the accuracy of the synchronization time after the final synchronization can be ensured, and the isolation of the time data of each container can also be enhanced, thereby improving the protection against potential data tampering.

[0077] Optionally, refer to Figure 6 As shown, the above step S504 includes: S601: Determine whether the error value falls within a preset error range.

[0078] Exemplarily, for example, the preset error interval is (-1, 1).

[0079] S602: If yes, determine that the current time parameter has not been modified, and generate the synchronization time after the current container and the reliable time source start remote clock synchronization according to the current system time and the time offset.

[0080] In one achievable method, for example, it is determined whether the error value obtained by the above calculation falls within the error interval (-1, 1), that is, comparing (current system time-current system running time)-(synchronized system time-synchronized system running time)∈(-1, 1). If the error value obtained by the above calculation is 0, that is, the error value falls within the preset error interval (-1, 1), and it is determined that the current system time now_system_time has not been tampered with externally, thereby verifying the integrity and authenticity of the current time parameter; and based on the current system time now_system_time and the time offset offset obtained during synchronization, the synchronization time after the current container starts remote clock synchronization with the reliable time source is generated. In this way, the accuracy of the synchronized data after the final synchronization can be ensured, thereby realizing soft synchronization of time.

[0081] S603: If not, determine that the current time parameter has been modified, and use the network time protocol to generate the synchronization time after the current container starts remote clock synchronization with the reliable time source.

[0082] In another achievable method, for example, if the error value obtained by the above calculation is 2, then the error value does not fall into the error interval (-1, 1), and it is determined that the current system time now_system_time has been tampered with externally, that is, the current system time now_system_time is unreliable, and it is necessary to re-perform the NTP protocol for time synchronization to obtain the synchronization time after the current container starts remote clock synchronization with a reliable time source. In this way, the accuracy and traceability of the actual time after the synchronization of the current container can be ensured.

[0083] Optionally, the above step S602 includes: The sum of the current system time and the time offset is determined, and the sum is used as the synchronization time after the current container starts remote clock synchronization with a reliable time source.

[0084] Optionally, in this solution, instead of directly using the current system time now_system_time as the synchronization time after synchronization, the current system time now_system_time is summed with the time offset offset, and the sum result (i.e. now_system_time+offset) is used as the synchronization time after synchronization. In this way, when a certificate needs to be generated or issued in a Docker container, or when the system records log time, the actual time after the current container starts remote clock synchronization with a reliable time source can be more accurately calculated, ensuring the accuracy and traceability of the generated certificate time and the system log time.

[0085] Optionally, the above step S202 includes: Use the Network Time Protocol to start remote clock synchronization with a reliable time source, and obtain the time offset of the current container, the synchronized system time, and the synchronized system running time.

[0086] In one feasible way, for example, when the current container starts remote clock synchronization with a reliable time source, the NTP server running in the current container is directly used to synchronize time from the Internet clock source, that is, to obtain the time offset of the current container, synchronize the system time system_time and synchronize the system runtime system_runtime. In this way, the consistency and accuracy of the acquired time data can be guaranteed.

[0087] Optionally, in order to maintain the validity of the time offset between the current container and a reliable time source, it is necessary to regularly update the NTP time offset in the current container and ensure that the NTP time source is online.

[0088] Optionally, this solution will use NTP control technology to run the NTP service inside each container to ensure time synchronization, but at the same time limit its direct writing to the system time, and instead adjust and control the time at the software level.

[0089] Optionally, the method further comprises: If the first synchronization time parameter has been tampered with, a new first synchronization time parameter when the current container is synchronized again is re-acquired and stored.

[0090] In another achievable manner, for example, if the comparison result between the actual hash value and the verification hash value is inconsistent, it is determined that the first synchronization time parameter has been tampered with. At this time, it is necessary to reuse the NTP server running in the current container, that is, to obtain the new time offset offset2, the synchronization system time system_time2, and the synchronization system runtime system_runtime2 when the current container and the reliable time source restart remote clock synchronization. That is, in the case where it is determined that the first synchronization time parameter has been tampered with, this solution can also ensure that each container independently obtains the new time offset, the new synchronization system time, and the new synchronization system runtime, thereby realizing soft synchronization of time.

[0091] Optionally, refer to Figure 7 As shown, it is a flow chart of when the current container starts remote clock synchronization with a reliable time source provided by the present application, and the method includes: The first step is to obtain the time offset of the current container synchronization when the trusted NTP time source is online. Step 2: Get the distributed quantum key secret_key from the USBKey third-party storage medium; The third step is to use the quantum key secret_key to calculate the hash value of the time offset offset and the synchronous system time system_time to generate the first hash value.

[0092] Optionally, the first hash value hmac_value=HMAC(secret_key,offset+system_time).

[0093] Step 4: store the time offset offset, the synchronization system time system_time, the synchronization system runtime system_runtime and the first hash value hmac_value into a database preset in the current container.

[0094] Optionally, refer to Figure 8 As shown, it is a schematic diagram of the process of clock verification of the current container provided by the present application, and the method includes: The first step is to obtain the actual hash value and actual synchronization time parameters currently stored in the database; The actual synchronization time parameters include: the actual time offset offset1, the actual synchronization system time system_time1 and the actual synchronization system runtime system_runtime1, and the actual hash value is hmac_value1.

[0095] Step 2: Get the same quantum key secret_key from the USBKey third-party storage medium; The third step is to use the quantum key secret_key to hash the actual time offset offset and the actual synchronization system time system_time1 to generate the verification hash value calculated_hmac.

[0096] Among them, calculated_hmac=HMAC(secret_key,offset1+system_time1).

[0097] Step 4: Compare the actual hash value with the verification hash value. If the comparison results are consistent, the verification is successful.

[0098] Optionally, if the verification succeeds, it is determined that the first synchronization time parameter has not been tampered with; if the verification fails, it is determined that the first synchronization time parameter has been tampered with. At this time, the NTP server needs to re-acquire and store the new first synchronization time parameter when the current container is synchronized again.

[0099] Step 5. Get the current system time and current system running time of the current container; The current system time is now_system, and the current system runtime is now_system_runtime.

[0100] Step 6. Determine (current system time - current system running time) - (synchronous system time - synchronous system running time) ∈ (-1, 1)? Step 7. If yes, determine that the current system time has not been tampered with, and generate the synchronization time after the current container is synchronized according to the current system time and the time offset; if no, determine that the current system time has been tampered with, and use the NTP server to resynchronize the clock.

[0101] Fig. 9 A schematic diagram of an electronic device provided in an embodiment of the present application, the electronic device can be Figure 1 The cloud server shown, the electronic device may be a computing device with data processing and data receiving and sending functions.

[0102] The electronic device includes: a processor 901 and a memory 902 .

[0103] The memory 902 is used to store programs, and the processor 901 calls the programs stored in the memory 902 to execute the above method embodiment. The specific implementation method and technical effect are similar and will not be repeated here.

[0104] Optionally, the present invention also provides a program product, such as a computer-readable storage medium, comprising a program, which is used to execute the above method embodiment when executed by a processor.

[0105] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0106] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0107] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0108] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, abbreviated: ROM), random access memory (English: Random Access Memory, abbreviated: RAM), disk or optical disk and other media that can store program codes.

Claims

1. A time synchronization method, characterized in that: The method comprises: Acquire a first synchronization time parameter and a randomly generated quantum key when synchronizing the current container, wherein the first synchronization time parameter includes: a time offset, a synchronization system time, and a synchronization system running time, wherein the time offset is used to indicate an offset between a local time of the current container and a reliable time provided by a reliable time source, the synchronization system time is used to indicate a local time when the current container starts remote clock synchronization with the reliable time source, and the synchronization system running time is used to indicate a running time from startup to completion of clock synchronization when the current container starts remote clock synchronization with the reliable time source; Generate a first hash value according to the time offset, the synchronization system time and the quantum key, and store the first hash value and the first synchronization time parameter in a preset database; Obtaining the actual hash value and the actual synchronization time parameter currently actually stored in the database; Determining whether the first synchronization time parameter has been tampered with according to the actual hash value, the actual synchronization time parameter and the quantum key; If not, then obtain the current time parameters of the current container verification, wherein the current time parameters include: the current system time and the current system running time, the current system time is used to indicate the local time when the current container is verified, and the current system running time is used to indicate the running time of the current container from booting to completing the verification; The synchronization time after the current container and the reliable time source start remote clock synchronization is generated according to the current system time, the current system running time, the synchronization system time, the synchronization system running time and the time offset.

2. The method according to claim 1, characterized in that The determining, according to the actual hash value, the actual synchronization time parameter and the quantum key, whether the first synchronization time parameter has been tampered with comprises: Generate a verification hash value according to the actual synchronization time parameter and the quantum key; According to the comparison result between the actual hash value and the verification hash value, it is determined whether the first synchronization time parameter is tampered with.

3. The method according to claim 2, characterized in that The determining, according to a comparison result between the actual hash value and the verification hash value, whether the first synchronization time parameter has been tampered with includes: If the comparison result of the actual hash value and the verification hash value is consistent, it is determined that the first synchronization time parameter has not been tampered with; If the comparison result between the actual hash value and the verification hash value is inconsistent, it is determined that the first synchronization time parameter has been tampered with.

4. The method according to claim 1, characterized in that: The step of generating the synchronization time after the current container and the reliable time source start remote clock synchronization according to the current system time, the current system running time, the synchronization system time, the synchronization system running time and the time offset comprises: Determine a first difference between the current system time and the current system running time; determining a second difference between the synchronization system time and the synchronization system running time; Determine an error value between the first difference and the second difference; The synchronization time after the current container starts remote clock synchronization with the reliable time source is generated according to the error value.

5. The method according to claim 4, characterized in that The step of generating the synchronization time after the current container and the reliable time source start remote clock synchronization according to the error value includes: Determining whether the error value falls within a preset error interval; If so, determine that the current time parameter has not been modified, and generate a synchronization time after the current container and the reliable time source start remote clock synchronization based on the current system time and the time offset; If not, it is determined that the current time parameter has been modified, and a network time protocol is used to generate a synchronization time after the current container and the reliable time source start remote clock synchronization.

6. The method according to claim 5, characterized in that The step of generating the synchronization time after the current container and the reliable time source start remote clock synchronization according to the current system time and the time offset includes: A sum of the current system time and the time offset is determined, and the sum is used as the synchronization time after the current container and the reliable time source start remote clock synchronization.

7. The method according to claim 1, characterized in that The obtaining of the initial synchronization time parameters of the current container includes: The remote clock synchronization is started by using the network time protocol and the reliable time source, and the time offset, the synchronized system time and the synchronized system running time of the current container are obtained.

8. The method according to claim 1, characterized in that Also includes: If the first synchronization time parameter has been tampered with, a new first synchronization time parameter for resynchronizing the current container is reacquired and stored.

9. A cloud server, characterized in that: A plurality of containers are deployed on the cloud server, and each container is isolated from each other. Time synchronization of each container is achieved by executing the steps of the method described in any one of claims 1 to 8 on each container.

10. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of any method as claimed in claims 1-8.

11. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is executed.

Images