Time synchronization method, cloud server, electronic device and storage medium

Abstract

The present application provides a time synchronization method, a cloud server, an electronic device, and a storage medium, relating to the field of communication technology. The method includes: obtaining a first synchronization time parameter and a randomly generated quantum key when synchronizing a current container; generating a first hash value based on the quantum key, a time offset, and a synchronization system time; and storing the first hash value and the first synchronization time parameter in a preset database; reading the actual hash value and the actual synchronization time parameter currently stored from the database; if the first synchronization time parameter is verified to be untampered with based on the quantum key, the actual hash value, and the actual synchronization time parameter, then obtaining the current system time parameter when verifying the current container; and generating a synchronization time after remote clock synchronization is initiated between the current container and a reliable time source based on the current system time parameter and the first synchronization system time parameter, thereby achieving time synchronization between each container deployed on the cloud server and the reliable time source.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a time synchronization method, a cloud server, an electronic device, and a storage medium. Background Art

[0002] To ensure time consistency in distributed systems, it's often recommended to deploy multiple homogeneous timestamp servers on a single cloud server, all using Docker containerization technology. In this multi-container environment, time data records the sequence of system activities, transaction times, and other key events. Therefore, accurate and timely container time synchronization is crucial to the normal operation of the system and the consistency of business data.

[0003] However, due to the characteristics of containerized environments, container time synchronization challenges arise. In a multi-container environment, time synchronization issues between containers can lead to inconsistent and chaotic time data. Furthermore, time offsets between containers can create data consistency issues and disrupt the order of events, impacting system traceability and consistency. Furthermore, because containers share the host's system time, time synchronization issues between containers can lead to time interference between containers, impacting system stability and security.

[0004] Therefore, there is an urgent need to provide a time synchronization isolation solution for multiple containers. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies in the above-mentioned prior art and provide a time synchronization method, a cloud server, an electronic device, and a storage medium, so as to provide a multi-container time synchronization isolation solution.

[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of the present application are as follows:

[0007] In a first aspect, an embodiment of the present application provides a time synchronization method, the method comprising:

[0008] Obtaining a first synchronization time parameter and a randomly generated quantum key during synchronization of the current container, where the first synchronization time parameter includes: a time offset, a synchronization system time, and a synchronization system running time. The time offset indicates the offset between the local time of the current container and the reliable time provided by the reliable time source. The synchronization system time indicates the local time when the current container initiates remote clock synchronization with the reliable time source. The synchronization system running time indicates the running time from startup to completion of clock synchronization when the current container initiates remote clock synchronization with the reliable time source.

[0009] generating a first hash value according to the time offset, the synchronization system time, and the quantum key, and storing the first hash value and the first synchronization time parameter in a preset database;

[0010] Obtaining the actual hash value and actual synchronization time parameters currently actually stored in the database;

[0011] determining, according to the actual hash value, the actual synchronization time parameter, and the quantum key, whether the first synchronization time parameter has been tampered with;

[0012] If not, obtain the current time parameters of the current container during verification, where the current time parameters include: the current system time and the current system running time. The current system time is used to indicate the local time when the current container is verified, and the current system running time is used to indicate the running time of the current container from startup to completion of verification.

[0013] Generate a synchronization time after the current container and the reliable time source start remote clock synchronization according to the current system time, the current system running time, the synchronization system time, the synchronization system running time and the time offset.

[0014] Optionally, determining whether the first synchronization time parameter is tampered with according to the actual hash value, the actual synchronization time parameter, and the quantum key includes:

[0015] generating a verification hash value according to the actual synchronization time parameter and the quantum key;

[0016] According to a comparison result between the actual hash value and the verification hash value, it is determined whether the first synchronization time parameter has been tampered with.

[0017] Optionally, determining whether the first synchronization time parameter is tampered with according to a comparison result of the actual hash value and the verification hash value includes:

[0018] If the comparison result of the actual hash value and the verification hash value is consistent, it is determined that the first synchronization time parameter has not been tampered with;

[0019] If the comparison result between the actual hash value and the verification hash value is inconsistent, it is determined that the first synchronization time parameter has been tampered with.

[0020] Optionally, generating, based on the current system time, the current system running time, the synchronized system time, the synchronized system running time, and the time offset, the synchronized time after the current container starts remote clock synchronization with the reliable time source includes:

[0021] Determining a first difference between the current system time and the current system running time;

[0022] determining a second difference between the synchronization system time and the synchronization system operation time;

[0023] determining an error value between the first difference and the second difference;

[0024] Generate, based on the error value, a synchronization time after the current container and the reliable time source initiate remote clock synchronization.

[0025] Optionally, generating, based on the error value, a synchronization time after the current container initiates remote clock synchronization with the reliable time source includes:

[0026] Determining whether the error value falls within a preset error interval;

[0027] If so, determine that the current time parameter has not been modified, and generate a synchronization time after the current container and the reliable time source start remote clock synchronization based on the current system time and the time offset;

[0028] If not, it is determined that the current time parameter has been modified, and a network time protocol is used to generate a synchronization time after the current container and the reliable time source start remote clock synchronization.

[0029] Optionally, generating, based on the current system time and the time offset, a synchronization time after the current container initiates remote clock synchronization with the reliable time source includes:

[0030] A sum of the current system time and the time offset is determined, and the sum is used as a synchronization time after the current container initiates remote clock synchronization with the reliable time source.

[0031] Optionally, obtaining the initial synchronization time parameter of the current container includes:

[0032] Remote clock synchronization is started with the reliable time source using the Network Time Protocol, and the time offset, synchronized system time, and synchronized system running time of the current container are obtained.

[0033] Optionally, it also includes:

[0034] If the first synchronization time parameter has been tampered with, a new first synchronization time parameter for resynchronizing the current container is reacquired and stored.

[0035] In a second aspect, an embodiment of the present application further provides a cloud server, on which multiple containers are deployed, and each container is isolated from each other. Time synchronization of each container is achieved by executing the method steps described in the items provided in the first aspect on each container.

[0036] In a third aspect, an embodiment of the present application further provides an electronic device comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps of the method provided in the first aspect.

[0037] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a processor, the method provided in the first aspect is executed.

[0038] The beneficial effects of this application are:

[0039] The embodiment of the present application provides a time synchronization method, a cloud server, an electronic device and a storage medium. In this solution, in order to further improve the accuracy of time data and the security of the system, a quantum random number generation technology is introduced. First, a randomly generated quantum key is obtained. At the same time, based on the container isolation technology, the entire system in each container deployed on the cloud server is synchronized under a standard time base, that is, the first synchronization time parameter when the current container starts remote clock synchronization with a reliable time source is obtained. The first synchronization time parameter includes: time offset, synchronization system time, and synchronization system running time. The quantum key is used to calculate the hash value of the time offset and the synchronization system time to generate a first hash value. The first hash value is used as the first hash value. The hash value and the first synchronization time parameter are stored in a preset database; during verification, the actual hash value and the actual synchronization time parameter currently stored are read from the database, and based on the quantum key, the actual hash value and the actual synchronization time parameter, the first synchronization time parameter is verified to see if it has been tampered with, thereby ensuring the integrity and non-tamperability of the time data during the storage process; if it has not been tampered with, the current system time and the current system running time at the time of verification of the current container are obtained, and based on the current system time, the current system running time, the synchronization system time and the synchronization system running time, the synchronization time after the current container and the reliable time source start remote clock synchronization is generated, so that the time calculation of the business scenario is performed based on the synchronization time after synchronization. Therefore, in this solution, when each container and the reliable time source start the remote clock synchronization operation, they are isolated from each other and do not affect each other, that is, the time synchronization operation of each container will not affect other containers, realizing the time synchronization between each container deployed on the cloud server and the reliable time source, thereby improving the stability and security of the system, and effectively solving the problem of non-isolation of time synchronization between multiple docker containers under the same host machine.

[0040] Optionally, the time synchronization method provided by this solution first verifies whether the first synchronization time parameter has been tampered with based on the first synchronization time parameter obtained during synchronization, the actual hash value currently stored and the actual synchronization time parameter read from the database, and the quantum key. If not, the method then verifies whether the current system time has been tampered with externally based on the current system time, the current system running time, the synchronization system time, and the synchronization system running time, further ensuring the accuracy of the current system time. In other words, this solution proposes a double verification of the time data of the current container. This ensures the accuracy of the final synchronized time and enhances the isolation of the time data of each container, improving protection against potential data tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 A schematic diagram of a time synchronization application scenario provided in an embodiment of the present application;

[0043] Figure 2 A flowchart of a time synchronization method provided in an embodiment of the present application;

[0044] Figure 3 A flowchart of another time synchronization method provided in an embodiment of the present application;

[0045] Figure 4 A flowchart of another time synchronization method provided in an embodiment of the present application;

[0046] Figure 5 A flowchart of another time synchronization method provided in an embodiment of the present application;

[0047] Figure 6 A flowchart of another time synchronization method provided in an embodiment of the present application;

[0048] Figure 7 A schematic diagram of a process for initiating remote clock synchronization between a current container and a reliable time source in a time synchronization method provided in an embodiment of the present application;

[0049] Figure 8 A schematic diagram of the process of clock verification of the current container in a time synchronization method provided in an embodiment of the present application;

[0050] Figure 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0051] Icons: 1-Cloud server; 2-Container. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of illustration and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowcharts can be implemented out of sequence, and steps without logical context can be reversed or implemented simultaneously. In addition, those skilled in the art, under the guidance of the contents of this application, can add one or more other operations to the flowchart, or remove one or more operations from the flowchart.

[0053] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0054] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0055] First, the professional terms involved in this application are introduced.

[0056] 1. Quantum random numbers: Quantum random numbers utilize the uncertainty principle in quantum mechanics to generate truly random numbers. This randomness is based on the unpredictability and uncertainty of quantum systems. In quantum mechanics, certain phenomena (such as the superposition of quantum states and the uncertainty of measurement results) ensure the randomness of quantum systems and cannot be fully simulated or predicted by classical methods.

[0057] 2. Docker Containers: Docker containers are standardized units on the Docker platform for packaging and shipping applications and all their dependencies, ensuring they run consistently across different environments. Docker containerization is the process of packaging applications and their dependencies into Docker containers. Docker containers can run across diverse computing environments regardless of operating system and infrastructure differences, providing a more lightweight and portable deployment method.

[0058] 3. Network Time Protocol (NTP): A protocol for synchronizing clocks in computer networks, ensuring that devices on the network have accurate time information. NTP uses a hierarchical client-server model, allowing devices to obtain accurate time information over the internet or local network.

[0059] Before describing the technical solution provided by this application in detail, a brief description of the application scenarios of time synchronization involved in this application is first given.

[0060] refer to Figure 1 As shown, it is a schematic diagram of an application scenario of time synchronization provided by an embodiment of the present application; Figure 1 As shown, the application scenario of time synchronization includes: a cloud server 1, multiple containers 2 are deployed on the cloud server 1, and the containers are isolated from each other.

[0061] Among them, different business systems are running on each container 2, that is, the business systems are packaged into corresponding containers using Docker containers, so that the business systems packaged in the containers can run in different computing environments without being affected by differences in operating systems and infrastructure, providing a more lightweight and portable deployment method.

[0062] At the same time, in this multi-container environment, each container shares the system time of the host machine (cloud server). Based on container isolation technology, each container is isolated from each other and does not affect each other when starting remote clock synchronization operations with a reliable time source. That is, the time synchronization operation of each container will not affect other containers, thereby improving the stability and security of the system and realizing the isolation of time data.

[0063] I understand. Figure 1 The above structure is only for illustration, and the application scenarios of time synchronization can also include Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0064] The following will illustrate the implementation principles and corresponding beneficial effects of the quantum inadvertent transmission method steps provided in this application through multiple specific embodiments.

[0065] In one embodiment, reference Figure 2 As shown, a time synchronization method is provided. Optionally, the execution subject of the method can be Figure 1 Each container in the time synchronization application scenario shown in FIG.

[0066] It should be understood that in other embodiments, the order of some steps in the time synchronization method can be interchanged according to actual needs, or some steps can be omitted or deleted. Figure 2 As shown, the method includes:

[0067] S201. Obtain a first synchronization time parameter and a randomly generated quantum key during current container synchronization.

[0068] The first synchronization time parameter includes: time offset, system_time, and system_runtime. The offset indicates the offset between the local time of the current container and the reliable time provided by the reliable time source. The system_time indicates the local time when the current container initiates remote clock synchronization with the reliable time source. The system_runtime indicates the runtime from startup to completion of clock synchronization when the current container initiates remote clock synchronization with the reliable time source.

[0069] For example, the reliable time source may be an atomic clock, an observatory, a satellite, or other time source.

[0070] In this embodiment, for example, if a time calibration server (such as a Beidou clock server or a generalized precise time synchronization protocol network timing service) is running in the current container, remote clock synchronization can be initiated with a reliable time source (such as an Internet clock source) through the time calibration server, and the time offset of the current container and the synchronized system time system_time are obtained to ensure the consistency and accuracy of the time data of the current container. At the same time, the runtime system_runtime from startup to completion of clock synchronization when the current container initiates remote clock synchronization with the reliable time source is calculated.

[0071] S202: Generate a first hash value according to the time offset, the synchronization system time, and the quantum key, and store the first hash value and the first synchronization time parameter in a preset database.

[0072] In one possible implementation, for example, to further improve the accuracy of time data and system security, this solution introduces quantum random number generation technology. During user initialization, the quantum key generated from the quantum random number is stored in a third-party medium (such as a USB key). After time synchronization, the current container then reads the pre-generated quantum key, secret_key, from the third-party medium. Using the quantum key, secret_key, and a selected hash algorithm (such as SHA-256), a hash message authentication code is calculated on the time offset (offset) and the synchronized system time (system_time). This generates a first hash value, hmac_value, where hmac_value = HMAC(secret_key,offset+system_time). The time offset (offset), synchronized system time (system_time), synchronized system runtime (system_runtime), and the first hash value, hmac_value, are then stored in a pre-set database within the current container. This ensures the integrity and immutability of time data during storage.

[0073] S203: Obtain the actual hash value and actual synchronization time parameter currently stored in the database.

[0074] The actual synchronization time parameters include: actual time offset offset1, actual synchronization system time system_time1, and actual synchronization system runtime system_runtime1.

[0075] It is understandable that when verifying the above-mentioned stored time data, it is necessary to re-read the actual hash value and the actual synchronization time parameter currently stored from the database.

[0076] Among them, (1) if the previously stored first hash value hmac_value has not been tampered with, the actual hash value hmac_value1 is the first hash value hmac_value, that is, hmac_value1=hmac_value; if the previously stored first hash value hmac_value has been tampered with, the actual hash value hmac_value1 is not equal to the first hash value hmac_value, that is, the actual hash value hmac_value1 is the value after the first hash value hmac_value is tampered with.

[0077] (2) If the previously stored time offset, the synchronous system time system_time, and the synchronous system running time system_runtime have not been tampered with, the actual synchronous time parameter is the first synchronous time parameter; if any of the previously stored time offset, the synchronous system time system_time, and the synchronous system running time system_runtime has been tampered with, the actual synchronous time parameter is the value after the first synchronous time parameter is tampered with.

[0078] S204: Determine whether the first synchronization time parameter has been tampered with based on the actual hash value, the actual synchronization time parameter, and the quantum key.

[0079] Optionally, in a feasible method, for example, the actual hash value, the actual synchronization time parameter and the quantum key can be used to determine whether the actual synchronization time parameter is consistent with the first synchronization time parameter. If they are consistent, it is determined that the first synchronization time parameter has not been tampered with; if they are inconsistent, it is determined that the first synchronization time parameter has been tampered with, thereby improving the protection capability of the first synchronization time parameter.

[0080] S205: If not, obtain the current time parameter of the current container verification.

[0081] The current time parameters include the current system time now_system_time and the current system runtime now_system_runtime. The current system time now_system_time indicates the local time when the current container is verified, and the current system runtime now_system_runtime indicates the runtime from the time the current container is started to the time the verification is completed.

[0082] S206 : Generate a synchronization time after the current container starts remote clock synchronization with a reliable time source according to the current system time, the current system running time, the synchronization system time, the synchronization system running time, and the time offset.

[0083] Optionally, in this solution, if it is determined that the first synchronization time parameter has not been tampered with, the current system time now_system_time and the current system runtime now_system_runtime at the time of the current container verification are directly obtained; and based on the current system time now_system_time and the current system runtime now_system_runtime, the synchronized system time system_time, the synchronized system runtime system_runtime and the time offset offset, the synchronization time after the current container starts remote clock synchronization with the reliable time source is generated, so that the time calculation of the business scenario is performed based on the synchronized synchronization time. For example, when a certificate needs to be generated or issued in a Docker container, or when the system records log time, the current system time now_system_time can be not directly used, but the current system time now_system_time can be combined with the time offset offset stored in the database to generate the synchronized synchronization time. In this way, the actual time after synchronization can be calculated more accurately, ensuring the accuracy and traceability of the generated certificate time and the time of the system log.

[0084] Optionally, the time synchronization method proposed in this solution is adopted. Based on the container isolation technology, the entire system in each container deployed on the cloud server is synchronized under a standard time base, and each container is isolated from each other and does not affect each other when starting the remote clock synchronization operation with the reliable time source. That is, the time synchronization operation of each container will not affect other containers, and the time synchronization between each container deployed on the cloud server and the reliable time source is realized, thereby improving the stability and security of the system, and effectively solving the problem of non-isolation of time synchronization between multiple Docker containers under the same host machine.

[0085] Optionally, the time synchronization method provided by this solution is not only applicable to simple virtual machine environments, but is also more suitable for complex containerized environments, such as Docker-based microservice architectures.

[0086] This quantum random number-based Docker container time synchronization isolation and NTP control method is particularly suitable for virtualized environments that require high synchronization and controllability, such as Docker-based container clusters. It ensures the time consistency of the system in a distributed environment while taking into account network latency and system time drift.

[0087] In summary, the embodiment of the present application provides a time synchronization method. In this solution, in order to further improve the accuracy of time data and the security of the system, quantum random number generation technology is introduced. First, a randomly generated quantum key is obtained. At the same time, based on the container isolation technology, the entire system in each container deployed on the cloud server is synchronized under a standard time base, that is, the first synchronization time parameters when the current container starts remote clock synchronization with a reliable time source are obtained. The first synchronization time parameters include: time offset, synchronization system time, and synchronization system running time. The quantum key is used to calculate the hash value of the time offset and the synchronization system time to generate a first hash value. The first hash value is compared with the first The synchronization time parameters are stored in a preset database; during verification, the actual hash value and the actual synchronization time parameters currently stored are read from the database, and based on the quantum key, the actual hash value and the actual synchronization time parameters, it is verified whether the first synchronization time parameter has been tampered with, thereby ensuring the integrity and non-tamperability of the time data during the storage process; if it has not been tampered with, the current system time and the current system running time at the time of verification of the current container are obtained, and based on the current system time, the current system running time, the synchronization system time and the synchronization system running time, the synchronization time after the current container and the reliable time source start remote clock synchronization is generated, so that the time calculation of the business scenario is performed based on the synchronized time. Therefore, in this solution, when each container and the reliable time source start the remote clock synchronization operation, they are isolated from each other and do not affect each other, that is, the time synchronization operation of each container will not affect other containers, realizing the time synchronization between each container deployed on the cloud server and the reliable time source, thereby improving the stability and security of the system, and effectively solving the problem of non-isolation of time synchronization between multiple docker containers under the same host machine.

[0088] Optionally, refer to Figure 3 As shown, the above step S204 includes:

[0089] S301. Generate a verification hash value based on the actual synchronization time parameters and the quantum key.

[0090] S302: Determine whether the first synchronization time parameter has been tampered with based on a comparison result between the actual hash value and the verification hash value.

[0091] The actual synchronization time parameters include: actual time offset offset1, actual synchronization system time system_time1, and actual synchronization system runtime system_runtime1.

[0092] Optionally, to ensure the correctness and non-tamperability of the first synchronization time parameter, this solution introduces a quantum key generated by a quantum random number to verify the integrity and correctness of the first synchronization time parameter. Specifically, the current container reads a pre-generated quantum key secret_key from a third-party medium. This quantum key is the same as the quantum key used to generate the first hash value. The same quantum key secret_key and hash algorithm are used to perform a hash message authentication code calculation on the actual time offset offset1 and the actual synchronization time parameter system_time1 to generate a verification hash value calculated_hmac, i.e., calculated_hmac = HMAC(secret_key, offset1 + system_time1). Then, based on the comparison result of the actual hash value hmac_value1 and the verification hash value calculated_hmac, it is determined whether the first synchronization time parameter has been tampered with.

[0093] Optionally, refer to Figure 4 As shown, the above step S302 includes:

[0094] S401: If the comparison result of the actual hash value and the verification hash value is consistent, it is determined that the first synchronization time parameter has not been tampered with.

[0095] In one feasible manner, for example, the actual hash value hmac_value1 is compared with the verification hash value calculated_hmac. If the comparison results of the two are consistent, it is determined that the time offset offset and the synchronization system time system_time have not been tampered with, that is, the second synchronization time parameter is the first synchronization time parameter, and the actual hash value hmac_value1 is also the previously stored first hash value hmac_value.

[0096] S402: If the comparison result between the actual hash value and the verification hash value is inconsistent, it is determined that the first synchronization time parameter has been tampered with.

[0097] In another possible implementation, for example, the actual hash value hmac_value1 is compared with the verification hash value calculated_hmac. If the comparison result is inconsistent, it can be determined that the time offset offset and / or the synchronization system time system_time have been tampered with. The actual hash value hmac_value1 may also not be the previously stored first hash value hmac_value.

[0098] It should be noted that if the first hash value hmac_value is tampered with, the comparison result of the actual hash value hmac_value1 and the verification hash value calculated_hmac must be inconsistent, that is, it is determined that the time offset offset and / or the synchronous system time system_time has been tampered with.

[0099] Optionally, in this solution, quantum random numbers are introduced to generate quantum keys, and the quantum keys are used to perform hash operations on the time offset and the synchronized system time, and the hash operation results are compared to prevent the time data from being forged and tampered with, thereby ensuring the accuracy and non-tamperability of the business time.

[0100] Optionally, refer to Figure 5 As shown, the above step S206 includes:

[0101] S501: Determine a first difference between the current system time and the current system running time.

[0102] For example, if the startup time of the current container is 9:00, the current system time now_system_time is 11:00, and the current system runtime now_system_runtime is the runtime from the startup time to the completion of verification, that is, 11:00-9:00=2 hours.

[0103] Therefore, a first difference between the current system time now_system_time and the current system runtime now_system_runtime can be determined, that is, now_system_time-now_system_runtime=9.

[0104] S502: Determine a second difference between the synchronization system time and the synchronization system running time.

[0105] For example, the synchronization system time when the current container is synchronized is 10:00, and the current system running time is the running time from the boot time to the completion of synchronization, that is, 10:00-9:00=1 hour.

[0106] Therefore, the second difference between the synchronous system time system_time and the synchronous system runtime system_runtime can be determined, that is, system_time-system_runtime=9.

[0107] S503: Determine an error value between the first difference and the second difference.

[0108] S504: Generate a synchronization time after the current container starts remote clock synchronization with a reliable time source according to the error value.

[0109] Optionally, the first difference value calculated above is subtracted from the second difference value to obtain an error value between the two, which is 0. Based on the calculated error value, it is determined whether the current time parameter has been modified, that is, whether the current time parameter is credible, so as to further determine the synchronization method for initiating remote clock synchronization between the current container and the reliable time source, and then generate the synchronization time after the current container and the reliable time source initiate remote clock synchronization.

[0110] Optionally, the time synchronization method provided by this solution first verifies whether the first synchronization time parameter has been tampered with based on the first synchronization time parameter obtained during synchronization, the actual hash value currently stored and the actual synchronization time parameter read from the database, and the quantum key. If not, the method then verifies whether the current system time has been tampered with externally based on the current system time, the current system running time, the synchronization system time, and the synchronization system running time, further ensuring the accuracy of the current system time. In other words, this solution proposes a double verification of the time data of the current container. This ensures the accuracy of the final synchronized time and enhances the isolation of the time data of each container, improving protection against potential data tampering.

[0111] Optionally, refer to Figure 6 As shown, the above step S504 includes:

[0112] S601: Determine whether the error value falls within a preset error range.

[0113] Exemplarily, for example, the preset error interval is (-1, 1).

[0114] S602: If yes, determine that the current time parameter has not been modified, and generate a synchronization time after the current container starts remote clock synchronization with a reliable time source based on the current system time and the time offset.

[0115] In one possible implementation, for example, to determine whether the calculated error value falls within the error interval (-1, 1), the system compares (current system time - current system running time) - (synchronized system time - synchronized system running time) ∈ (-1, 1). If the calculated error value is 0, it means that the error value falls within the preset error interval (-1, 1), and the current system time now_system_time has not been tampered with, thereby verifying the integrity and authenticity of the current time parameter. The system then generates the synchronization time after remote clock synchronization between the current container and the reliable time source is initiated, based on the current system time now_system_time and the time offset obtained during synchronization. This ensures the accuracy of the final synchronized data, thereby achieving soft synchronization of time.

[0116] S603: If not, determine that the current time parameter has been modified, and use the Network Time Protocol to generate a synchronization time after the current container starts remote clock synchronization with a reliable time source.

[0117] In another possible implementation, for example, if the error value calculated above is 2, then the error value does not fall within the error interval (-1, 1). This indicates that the current system time, now_system_time, has been tampered with. Therefore, the current system time, now_system_time, is unreliable and requires resynchronization using the NTP protocol. This determines the synchronized time of the current container after remote clock synchronization with a reliable time source. This ensures the accuracy and traceability of the actual time after synchronization in the current container.

[0118] Optionally, the above step S602 includes:

[0119] Determine the sum of the current system time and the time offset, and use the sum as the synchronization time after the current container starts remote clock synchronization with a reliable time source.

[0120] Alternatively, in this solution, instead of directly using the current system time (now_system_time) as the synchronization time, the current system time (now_system_time) is summed with the time offset (offset), and the result (now_system_time + offset) is used as the synchronization time. This allows for more accurate calculation of the actual time after remote clock synchronization between the container and a reliable time source when certificates are generated or issued within a Docker container, or when the system logs time. This ensures the accuracy and traceability of the times in generated certificates and system logs.

[0121] Optionally, the above step S202 includes:

[0122] Use the Network Time Protocol to start remote clock synchronization with a reliable time source, and obtain the time offset of the current container, the synchronized system time, and the synchronized system running time.

[0123] In one possible implementation, for example, when the current container initiates remote clock synchronization with a reliable time source, it directly uses the NTP server running in the current container to synchronize time from an Internet clock source. This means obtaining the current container's time offset, synchronized system time (system_time), and synchronized system runtime time (system_runtime). This ensures the consistency and accuracy of the obtained time data.

[0124] Optionally, in order to maintain the validity of the time offset between the current container and a reliable time source, it is necessary to regularly update the NTP time offset in the current container and ensure that the NTP time source is online.

[0125] Optionally, this solution will adopt NTP control technology to run the NTP service inside each container to ensure time synchronization, but at the same time limit its direct writing to the system time, and instead adjust and control the time at the software level.

[0126] Optionally, the method further includes:

[0127] If the first synchronization time parameter has been tampered with, a new first synchronization time parameter for resynchronizing the current container is reacquired and stored.

[0128] In another possible implementation, for example, if the comparison result between the actual hash value and the verification hash value is inconsistent, it is determined that the first synchronization time parameter has been tampered with. In this case, it is necessary to reuse the NTP server running in the current container to obtain the new time offset offset2, the synchronized system time system_time2, and the synchronized system runtime time system_runtime2 when the current container restarts remote clock synchronization with the reliable time source. In other words, even if it is determined that the first synchronization time parameter has been tampered with, this solution can also ensure that each container independently obtains the new time offset, the new synchronized system time, and the new synchronized system runtime, thereby achieving soft time synchronization.

[0129] Optionally, refer to Figure 7 As shown in FIG, a flow chart of starting remote clock synchronization between the current container and a reliable time source provided by this application is provided, and the method includes:

[0130] The first step is to obtain the time offset of the current container synchronization when the trusted NTP time source is online.

[0131] Step 2: Get the distributed quantum key secret_key from the USBKey third-party storage medium;

[0132] The third step is to use the quantum key secret_key to calculate the hash value of the time offset offset and the synchronization system time system_time to generate the first hash value.

[0133] Optionally, the first hash value hmac_value=HMAC(secret_key,offset+system_time).

[0134] Step 4: Store the time offset offset, the synchronized system time system_time, the synchronized system runtime system_runtime, and the first hash value hmac_value in a database preset in the current container.

[0135] Optionally, refer to Figure 8 As shown in FIG, a flow chart of clock verification of the current container provided by this application is provided, and the method includes:

[0136] The first step is to obtain the actual hash value and actual synchronization time parameters currently stored in the database;

[0137] The actual synchronization time parameters include: actual time offset offset1, actual synchronization system time system_time1, and actual synchronization system runtime system_runtime1; the actual hash value is hmac_value1.

[0138] Step 2: Get the same quantum key secret_key from the USBKey third-party storage medium;

[0139] The third step is to use the quantum key secret_key to hash the actual time offset offset and the actual synchronization system time system_time1 to generate the verification hash value calculated_hmac.

[0140] Where calculated_hmac=HMAC(secret_key,offset1+system_time1).

[0141] Step 4: Compare the actual hash value with the verification hash value. If the comparison results are consistent, the verification is successful.

[0142] Optionally, if the verification succeeds, it is determined that the first synchronization time parameter has not been tampered with; if the verification fails, it is determined that the first synchronization time parameter has been tampered with. At this time, the NTP server needs to be used to re-acquire and store the new first synchronization time parameter when the current container is synchronized again.

[0143] Step 5. Get the current system time and current system running time of the current container;

[0144] The current system time is now_system, and the current system runtime is now_system_runtime.

[0145] Step 6. Determine (current system time - current system running time) - (synchronized system time - synchronized system running time) ∈ (-1, 1)?

[0146] Step 7. If yes, determine that the current system time has not been tampered with, and generate the synchronization time after the current container is synchronized based on the current system time and the time offset; if not, determine that the current system time has been tampered with, and use the NTP server to resynchronize the clock.

[0147] Figure 9 This is a schematic diagram of an electronic device provided in an embodiment of the present application, which can be Figure 1 The cloud server shown, the electronic device can be a computing device with data processing and data receiving and sending functions.

[0148] The electronic device includes: a processor 901 and a memory 902 .

[0149] The memory 902 is used to store programs, and the processor 901 calls the programs stored in the memory 902 to execute the above method embodiment. The specific implementation methods and technical effects are similar and will not be repeated here.

[0150] Optionally, the present invention further provides a program product, such as a computer-readable storage medium, comprising a program, which is used to perform the above method embodiment when executed by a processor.

[0151] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0152] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0153] In addition, the functional units in various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or hardware plus software functional units.

[0154] The aforementioned integrated unit implemented as a software functional unit can be stored in a computer-readable storage medium. The software functional unit, stored in a storage medium, includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) or a processor to execute portions of the method steps described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a removable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

Claims

1. A time synchronization method, characterized in that: The method comprises: Obtaining a first synchronization time parameter and a randomly generated quantum key during synchronization of the current container, where the first synchronization time parameter includes: a time offset, a synchronization system time, and a synchronization system running time. The time offset indicates the offset between the local time of the current container and the reliable time provided by the reliable time source. The synchronization system time indicates the local time when the current container initiates remote clock synchronization with the reliable time source. The synchronization system running time indicates the running time from startup to completion of clock synchronization when the current container initiates remote clock synchronization with the reliable time source. generating a first hash value according to the time offset, the synchronization system time, and the quantum key, and storing the first hash value and the first synchronization time parameter in a preset database; Obtaining the actual hash value and actual synchronization time parameters currently actually stored in the database; determining, according to the actual hash value, the actual synchronization time parameter, and the quantum key, whether the first synchronization time parameter has been tampered with; If not, obtain the current time parameters of the current container during verification, where the current time parameters include: the current system time and the current system running time. The current system time is used to indicate the local time when the current container is verified, and the current system running time is used to indicate the running time of the current container from startup to completion of verification. Generate a synchronization time after the current container and the reliable time source start remote clock synchronization according to the current system time, the current system running time, the synchronization system time, the synchronization system running time and the time offset.

2. The method according to claim 1, characterized in that The determining, according to the actual hash value, the actual synchronization time parameter, and the quantum key, whether the first synchronization time parameter has been tampered with includes: generating a verification hash value according to the actual synchronization time parameter and the quantum key; According to a comparison result between the actual hash value and the verification hash value, it is determined whether the first synchronization time parameter has been tampered with.

3. The method according to claim 2, characterized in that The determining, based on a comparison result between the actual hash value and the verification hash value, whether the first synchronization time parameter has been tampered with includes: If the comparison result of the actual hash value and the verification hash value is consistent, it is determined that the first synchronization time parameter has not been tampered with; If the comparison result between the actual hash value and the verification hash value is inconsistent, it is determined that the first synchronization time parameter has been tampered with.

4. The method according to claim 1, wherein The generating, according to the current system time, the current system running time, the synchronized system time, the synchronized system running time, and the time offset, a synchronized time after the current container and the reliable time source start remote clock synchronization, includes: Determining a first difference between the current system time and the current system running time; determining a second difference between the synchronization system time and the synchronization system operation time; determining an error value between the first difference and the second difference; Generate, based on the error value, a synchronization time after the current container and the reliable time source initiate remote clock synchronization.

5. The method according to claim 4, characterized in that Generating the synchronization time after the current container starts remote clock synchronization with the reliable time source according to the error value includes: Determining whether the error value falls within a preset error interval; If so, determining that the current time parameter has not been modified, and generating a synchronization time after the current container and the reliable time source start remote clock synchronization based on the current system time and the time offset; If not, it is determined that the current time parameter has been modified, and a network time protocol is used to generate a synchronization time after the current container and the reliable time source start remote clock synchronization.

6. The method according to claim 5, characterized in that The step of generating, based on the current system time and the time offset, a synchronization time after the current container and the reliable time source initiate remote clock synchronization, includes: A sum of the current system time and the time offset is determined, and the sum is used as a synchronization time after the current container initiates remote clock synchronization with the reliable time source.

7. The method according to claim 1, characterized in that The step of obtaining the initial synchronization time parameters of the current container includes: Remote clock synchronization is started with the reliable time source using the Network Time Protocol, and the time offset, synchronized system time, and synchronized system running time of the current container are obtained.

8. The method according to claim 1, characterized in that Also includes: If the first synchronization time parameter has been tampered with, a new first synchronization time parameter for resynchronizing the current container is reacquired and stored.

9. A cloud server, characterized in that: The cloud server is deployed with multiple containers, each of which is isolated from each other. Time synchronization of each container is achieved by executing the steps of the method described in any one of claims 1 to 8 on each container.

10. An electronic device, characterized in that: include: A processor, a storage medium, and a bus, wherein the storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the storage medium communicate via the bus, and the processor executes the machine-readable instructions to perform the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is executed.

Images