Method for communication between servers, management server and business server

Abstract

The invention provides a method for communication between servers, which comprises the following steps of: firstly, configuring communication information of a service server on a management server, including an IP (Internet Protocol) address, a port and a communication protocol; then, the business server sends a connection request containing identity verification information to the management server, the management server verifies the identity verification information of the business server according to a preset rule, and if the verification is passed, connection confirmation information is sent to the business server and an encryption channel is established; then, the management server and the business server carry out data transmission through the encryption channel to ensure the security and integrity of data transmission; and finally, after data transmission is completed, the business server sends a connection termination request to the management server, and the management server disconnects after confirmation. By means of the method, flexible, safe and reliable communication between the servers can be achieved, and the expansibility and management efficiency of the system are effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of servers, and in particular to a method for communication between servers, a management server and a business server. Background Art

[0002] With the rapid development of the Internet and information technology, communication between servers has become the basis for distributed computing and large-scale data processing. However, the existing methods of communication between servers have many shortcomings, which seriously restrict the flexibility, scalability, security and reliability of the system.

[0003] Poor flexibility: Traditional inter-server communication methods usually rely on fixed communication protocols and ports, which makes it difficult for the system to quickly adapt when the server cluster is expanded or the network environment changes. For example, when adding a new business server or adjusting the configuration of an existing server, all related servers must be reconfigured and restarted, resulting in service interruption and reduced efficiency. In addition, different servers may use different hardware and software configurations, further increasing the complexity of system management.

[0004] Insufficient scalability: As business needs grow, server clusters need to be continuously expanded. However, existing methods are often difficult to effectively expand when dealing with a large number of servers due to the high complexity of communication management. The traditional centralized management model can easily become a bottleneck, affecting the overall system performance. At the same time, the lack of flexible load balancing and dynamic resource allocation mechanisms makes it difficult for the system to guarantee service quality and response speed under high concurrency and high load conditions.

[0005] Security issues: The security of data transmission is an important consideration for inter-server communication. Existing methods usually lack effective data encryption and authentication mechanisms, and are vulnerable to data theft, tampering, and man-in-the-middle attacks. For example, in some cases, attackers can obtain sensitive information by monitoring network traffic or gain illegal access by forging identity information. Traditional encryption methods based on static keys are difficult to cope with complex and changing attack methods, and there are major security risks.

[0006] Insufficient data integrity and reliability: In the process of high-frequency data transmission, data integrity and reliability are the key to ensuring the stable operation of the system. Existing methods lack effective integrity checking and error recovery mechanisms during data transmission, which can easily lead to data loss or corruption, affecting system reliability and user experience. For example, network jitter and transmission errors may cause data packet loss or duplication. Existing error detection and correction mechanisms are difficult to completely eliminate these problems, resulting in the accuracy and integrity of data transmission being affected.

[0007] Management complexity: Existing methods of inter-server communication also face many challenges in management and maintenance. As the number of servers and business scale increase, manual configuration and management become more and more cumbersome and error-prone. For example, server configuration updates, troubleshooting, and performance optimization require a lot of manpower and time. Existing management tools and platforms still have a lot of room for improvement in automation and intelligence, and cannot meet the needs of efficient management of large-scale server clusters.

[0008] Interoperability issues: In a multi-vendor, multi-platform environment, communication protocols and standards between different servers may differ, leading to interoperability issues. Existing methods lack unified standards and interface specifications, making cross-platform and cross-system integration and interoperability difficult. For example, different operating systems and middleware may use different communication protocols and data formats, increasing the complexity of system integration and maintenance.

[0009] In summary, existing inter-server communication methods have many deficiencies such as poor flexibility, insufficient scalability, security issues, insufficient data integrity and reliability, management complexity, and interoperability issues. In order to solve these problems, the present invention proposes a flexible, scalable, secure and stable inter-server communication method, as well as corresponding management servers and business servers. By dynamically adjusting communication information, adopting a two-way authentication and encrypted transmission mechanism, and introducing data integrity verification, the present invention significantly improves the flexibility, scalability and security of inter-server communication, meeting the needs of modern distributed computing and large-scale data processing. The present invention aims to provide a more efficient, secure and reliable solution for inter-server communication, which is suitable for various complex network environments and business scenarios. Summary of the invention

[0010] The purpose of the present invention is to provide a method for communication between servers to solve the problems raised in the above background technology.

[0011] To achieve the above object, the present invention provides the following technical solution: a method for communication between servers, comprising the following:

[0012] S1. Configure the communication information of the business server on the management server, including IP address, port and communication protocol;

[0013] S2. The business server sends a connection request containing identity authentication information to the management server;

[0014] The management server verifies the authentication information of the business server according to the preset rules. If the verification is successful, it sends a connection confirmation message to the business server and establishes an encrypted channel;

[0015] S3, the management server and the business server transmit data through an encrypted channel;

[0016] S4. After the data transmission is completed, the business server sends a connection termination request to the management server, and the management server disconnects after confirmation.

[0017] As a preferred technical solution of the present invention, in S1, the configuration of the management server includes dynamically adjusting the communication information of the business server to adapt to changes in the network environment, and the dynamic adjustment includes but is not limited to the reallocation of IP addresses, changes in ports, and upgrades of communication protocols.

[0018] As a preferred technical solution of the present invention, in S2, the identity authentication information includes a unique identifier of the service server, a digital signature and a timestamp to prevent replay attacks.

[0019] As a preferred technical solution of the present invention, in S3, the preset rule includes using a public key encryption algorithm to verify the identity authentication information of the business server, and the formula used in the verification process is:

[0020]

[0021] Among them, V is the decrypted verification information, D is the decryption algorithm, K s is the private key, E is the encryption algorithm, K p is the public key, and I is the authentication information.

[0022] As a preferred technical solution of the present invention, in S4, the encryption channel is established by the following formula:

[0023]

[0024] Among them, C is the encrypted data, E is the encryption algorithm, K s is the session key, and M is the original data; the encryption channel adopts a symmetric encryption algorithm, such as AES, DES or other secure encryption algorithms.

[0025] As a preferred technical solution of the present invention, in S4, the data transmission process includes data integrity verification, and the verification formula is:

[0026] H=hash(M)

[0027] Wherein, H is the data hash value, hash is the hash algorithm, and M is the original data; the hash algorithm includes SHA-256, SHA-3 or other hash algorithms with high security.

[0028] As a preferred technical solution of the present invention, in S4, the data transmission between the management server and the business server adopts a two-way authentication mechanism, that is, the management server and the business server both need to verify the identity information of the other party to ensure the legitimacy of the communicating parties.

[0029] As a preferred technical solution of the present invention, in S5, the connection termination request of the service server includes a session identifier and a data transmission summary. After receiving the session identifier and the data transmission summary, the management server performs a matching confirmation and disconnects the connection with the service server.

[0030] A management server, comprising:

[0031] A configuration module, used to configure the communication information of the business server;

[0032] A connection management module, used to process connection requests and connection termination requests from business servers;

[0033] A data transmission module, used for transmitting data with a business server through an encrypted channel;

[0034] The security module is used to store and manage encryption keys and is responsible for encryption and decryption operations during data transmission.

[0035] The configuration module further includes a submodule for dynamically adjusting the communication information of the service server, wherein the dynamic adjustment includes automatically detecting changes in the network environment and updating the communication parameters of the service server in real time to ensure the stability and reliability of the communication.

[0036] The connection management module includes an identity authentication submodule, which is used to verify the identity information of the service server when sending a connection request. The identity authentication submodule uses a multi-factor authentication method, including but not limited to password authentication, certificate authentication and biometric authentication.

[0037] The data transmission module adopts end-to-end encryption technology to ensure that any node in the data transmission process cannot obtain plaintext data. The encryption algorithm includes but is not limited to RSA, ECC or other public key encryption algorithms.

[0038] A business server, comprising:

[0039] A connection request module, used for sending a connection request including identity authentication information to a management server;

[0040] A data transmission module, used for transmitting data with a management server through an encrypted channel;

[0041] A connection termination module, used for sending a connection termination request including a session identifier to a management server;

[0042] Security module, which is used to generate and manage encryption keys and ensure encryption and decryption of data during transmission.

[0043] The connection request module uses a public key encryption algorithm to encrypt the identity authentication information. The specific formula is:

[0044]

[0045] Among them, V is the encrypted identity authentication information, E is the encryption algorithm, K p is a public key, and I is identity authentication information; the public key encryption algorithm includes but is not limited to RSA, ECC or other secure public key encryption algorithms;

[0046] The data transmission module encrypts data using a session key when transmitting data, and the session key is generated through a secure handshake protocol between the management server and the service server;

[0047] When sending a connection termination request, the connection termination module includes a data transmission summary for the management server to perform matching confirmation to ensure the integrity and correctness of the data transmission;

[0048] The security module uses a hardware security module (HSM) to generate and manage keys to improve the security and efficiency of key management.

[0049] Beneficial Effects

[0050] of the present invention.

[0051] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0053] Figure 1 This is the system architecture diagram;

[0054] Figure 2 The present invention is a flow chart of a method for communication between servers. DETAILED DESCRIPTION

[0055] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0056] Example 1: Specific implementation method of the inter-server communication method

[0057] Step 1: Initialization phase

[0058] Configure the communication information of the business server on the management server, including the IP address, port, and communication protocol. The management server records the information of the business server through a configuration file or a database. In the specific implementation process, the administrator can enter the communication information of the business server through the management console (such as a web interface or a command line interface) and store it in the database of the management server.

[0059] For example, an administrator enters the following information in the management console:

[0060] Business server IP address: 192.168.1.10

[0061] Communication port: 8080

[0062] Communication protocol: TCP / IP

[0063] After the information is saved, the management server can query the communication information of the business server through the preset configuration file or database.

[0064] Step 2: Connection request phase: After the business server is started, it first reads the management server information in the configuration file, such as the IP address and port of the management server. Then, the connection request module of the business server generates a connection request, which contains the unique identifier of the business server, the digital signature, and the timestamp. The digital signature is used to verify the identity of the business server, and the timestamp is used to prevent replay attacks.

[0065] In specific implementation, the connection request is generated as follows:

[0066] Unique identifier: server 01

[0067] Digital signature: generated using the business server's private key

[0068] Timestamp: current time (such as 2024-05-27T10:00:00Z)

[0069] The connection request is sent to the management server via the network, for example, by sending a data packet via the TCP / IP protocol.

[0070] Step 3: Authentication Phase

[0071] After receiving the connection request, the management server verifies the authentication information of the business server through the connection management module. The verification process uses a public key encryption algorithm, and the specific formula is:

[0072]

[0073] Among them, V is the decrypted verification information, D is the decryption algorithm, Ks is the private key, E is the encryption algorithm, K p is the public key, I is the identity

[0074] Verification information. After verification, the management server sends a connection confirmation message to the business server and establishes an encrypted channel.

[0075] The management server uses the pre-stored business server public key to verify the digital signature to ensure that the request is indeed from a legitimate business server. If the verification is successful, the management server sends a connection confirmation message to the business server and generates a session key for subsequent data transmission encryption.

[0076] Step 4: Data transfer phase

[0077] The management server and the business server use an encrypted channel to transmit data. The process of establishing an encrypted channel is as follows:

[0078]

[0079] Among them, C is the encrypted data, E is the encryption algorithm, K s is the session key, and M is the original data.

[0080] The integrity of the data is verified by a hash algorithm, the specific formula is:

[0081] H=hash(M)

[0082] Where H is the data hash value, hash is the hash algorithm, and M is the original data.

[0083] Afterwards, the data is hashed to ensure its integrity and consistency during transmission.

[0084] Step 5: Connection Termination Phase

[0085] After the data transmission is completed, the connection termination module of the business server sends a connection termination request containing the session identifier and data transmission summary to the management server. After receiving the request, the management server performs a matching confirmation to ensure that the session and data transmission have been completed correctly, and then disconnects the connection with the business server.

[0086] In a specific implementation, the connection termination request includes the following information:

[0087] Session identifier: session 12345

[0088] Data transmission summary: Data summary generated using a hash algorithm

[0089] After verifying the information in the termination request, the management server records the connection log and disconnects the service server.

[0090] Example 2: Specific implementation of the management server

[0091] Configuration module: The configuration module is used to configure the communication information of the business server, including adding, modifying and deleting the IP address, port, communication protocol and other information of the business server. The configuration module can be operated through a graphical interface or an API interface, and supports dynamic adjustment of the communication information of the business server.

[0092] For example, administrators can enter new business server information through the web interface, and the system will automatically update the database and notify related components to make adjustments to ensure the continuity and stability of communication.

[0093] Connection management module: The connection management module is used to process the connection requests and connection termination requests of the business server. The connection management module verifies the identity information of the business server through preset rules and public key encryption algorithms to ensure that only legitimate business servers can establish connections. The connection management module is also responsible for monitoring the connection status and recording the connection log for auditing and troubleshooting.

[0094] In specific implementation, the connection management module includes the following submodules:

[0095] Authentication submodule: used to verify the identity information of the business server

[0096] Connection control submodule: used to manage the establishment and termination of connections

[0097] Logging submodule: used to record connection and data transmission logs

[0098] Data transmission module: The data transmission module is used to transmit data with the business server through an encrypted channel. The data transmission module uses a symmetric encryption algorithm (such as AES, DES, etc.) to encrypt the transmitted data, and uses a hash algorithm (such as SHA-256, SHA-3, etc.) to verify data integrity. The data transmission module ensures the security and reliability of data during transmission.

[0099] In specific implementation, the data transmission module includes the following functions:

[0100] Encryption function: Encrypt data using symmetric encryption algorithm

[0101] Decryption function: decrypt data using symmetric encryption algorithm

[0102] Hash check function: Use hash algorithm to check data integrity

[0103] Security module: The security module is used to store and manage encryption keys and is responsible for encryption and decryption operations during data transmission. The security module uses a hardware security module (HSM) or other high-security measures to ensure the secure management and use of keys.

[0104] In specific implementation, the security module includes the following functions:

[0105] Key generation: Generates keys for data encryption and decryption

[0106] Key Storage: Securely store encryption keys

[0107] Key management: manage the life cycle of keys, including generation, distribution, update, and destruction

[0108] Example 3: Specific implementation of the service server

[0109] Connection request module: The connection request module is used to send a connection request containing identity authentication information to the management server. The connection request module uses a public key encryption algorithm to encrypt the identity authentication information to ensure secure transmission of the identity authentication information.

[0110] In specific implementation, the connection request module includes the following functions:

[0111] Request generation: Generates a connection request that includes authentication information

[0112] Request encryption: Use public key encryption algorithm to encrypt the connection request

[0113] Request sending: Send the encrypted connection request to the management server through the network

[0114] Data transmission module: The data transmission module is used to transmit data with the management server through an encrypted channel. The data transmission module uses a symmetric encryption algorithm to encrypt the transmitted data and perform data integrity verification to ensure the security and reliability of data transmission.

[0115] In specific implementation, the data transmission module includes the following functions:

[0116] Data encryption: Encrypt data using symmetric encryption algorithms

[0117] Data decryption: Decrypt data using a symmetric encryption algorithm

[0118] Integrity check: Use hash algorithm to check the integrity of data

[0119] Connection termination module: The connection termination module is used to send a connection termination request containing a session identifier and a data transmission summary to the management server. The connection termination module ensures that the connection with the management server is properly disconnected after the data transmission is completed.

[0120] In specific implementation, the connection termination module includes the following functions:

[0121] Terminate request generation: Generates a terminate request containing a session identifier and a data transfer summary

[0122] Send termination request: Send a termination request to the management server via the network

[0123] Security module: The security module is used to generate and manage encryption keys and ensure the encryption and decryption of data during transmission. The security module uses a hardware security module (HSM) or other high-security measures to ensure the secure management and use of keys.

[0124] In specific implementation, the security module includes the following functions:

[0125] Key generation: Generates keys for data encryption and decryption

[0126] Key Storage: Securely store encryption keys

[0127] Key management: manage the life cycle of keys, including generation, distribution, update, and destruction

[0128] Through the above specific implementation methods, the present invention provides a secure, flexible and scalable server-to-server communication method and the management server and business server implemented therein, which can effectively improve the flexibility, scalability and security of server-to-server communication and is suitable for the needs of modern distributed computing and large-scale data processing.

[0129] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for communication between servers, characterized in that: The following steps are involved: S1. Configure the communication information of the business server on the management server, including IP address, port and communication protocol; S2. The business server sends a connection request containing identity authentication information to the management server; The management server verifies the authentication information of the business server according to the preset rules. If the verification is successful, it sends a connection confirmation message to the business server and establishes an encrypted channel; S3, the management server and the business server transmit data through an encrypted channel; S4. After the data transmission is completed, the business server sends a connection termination request to the management server, and the management server disconnects after confirmation.

2. A method for communication between servers as claimed in claim 1, characterized in that: In S1, the configuration of the management server includes dynamically adjusting the communication information of the business server to adapt to changes in the network environment. The dynamic adjustment includes but is not limited to reallocation of IP addresses, change of ports, and upgrade of communication protocols.

3. A method for communication between servers as claimed in claim 1, characterized in that: In S2, the identity authentication information includes a unique identifier of the service server, a digital signature, and a timestamp to prevent replay attacks.

4. A method for communication between servers as claimed in claim 1, characterized in that: In S3, the preset rule includes using a public key encryption algorithm to verify the identity authentication information of the business server, and the formula used in the verification process is: Among them, V is the decrypted verification information, D is the decryption algorithm, K s is the private key, E is the encryption algorithm, K p is the public key, and I is the identity authentication information; Among them, C is the encrypted data, E is the encryption algorithm, K s is the session key, M is the original data; the encryption channel adopts a symmetric encryption algorithm, such as AES and DES security encryption algorithms.

5. A method for communication between servers as claimed in claim 1, characterized in that: In S4, the data transmission process includes data integrity check, and the check formula is: H=hash(M) Among them, H is the data hash value, hash is the hash algorithm, and M is the original data; the hash algorithm includes SHA-256 and SHA-3 hash algorithms with high security.

6. A method for communication between servers as claimed in claim 1, characterized in that: In S4, the data transmission between the management server and the business server adopts a two-way authentication mechanism, that is, the management server and the business server need to verify the identity information of the other party to ensure the legitimacy of the communicating parties.

7. A method for communication between servers as claimed in claim 1, characterized in that: In S5, the connection termination request of the service server includes a session identifier and a data transmission summary. After receiving the session identifier and the data transmission summary, the management server performs a matching confirmation and disconnects from the service server.

8. A management server, wherein the communication method between servers adopts the method for communication between servers as claimed in any one of claims 1 to 7, characterized in that: include: A configuration module, used to configure the communication information of the business server; A connection management module, used to process connection requests and connection termination requests from business servers; A data transmission module, used for transmitting data with a business server through an encrypted channel; The security module is used to store and manage encryption keys and is responsible for encryption and decryption operations during data transmission. The configuration module further includes a submodule for dynamically adjusting the communication information of the service server, wherein the dynamic adjustment includes automatically detecting changes in the network environment and updating the communication parameters of the service server in real time to ensure the stability and reliability of the communication. The connection management module includes an identity authentication submodule, which is used to verify the identity information of the service server when sending a connection request. The identity authentication submodule uses a multi-factor authentication method, including but not limited to password authentication, certificate authentication and biometric authentication. The data transmission module adopts end-to-end encryption technology to ensure that any node in the data transmission process cannot obtain plaintext data. The encryption algorithm includes but is not limited to RSA, ECC or other public key encryption algorithms.

9. A business server, comprising: A connection request module, used for sending a connection request including identity authentication information to a management server; A data transmission module, used for transmitting data with a management server through an encrypted channel; A connection termination module, used for sending a connection termination request including a session identifier to a management server; Security module, which is used to generate and manage encryption keys and ensure encryption and decryption of data during transmission.

10. The service server according to claim 9, characterized in that: The connection request module uses a public key encryption algorithm to encrypt the identity authentication information. The specific formula is: Among them, V is the encrypted identity authentication information, E is the encryption algorithm, K p is the public key, and I is the identity authentication information; The public key encryption algorithm includes but is not limited to RSA, ECC or other secure public key encryption algorithms; The data transmission module encrypts data using a session key when transmitting data, and the session key is generated through a secure handshake protocol between the management server and the service server; When sending a connection termination request, the connection termination module includes a data transmission summary for the management server to perform matching confirmation to ensure the integrity and correctness of the data transmission; The security module uses a hardware security module (HSM) to generate and manage keys to improve the security and efficiency of key management.

Images