Password service cluster scheduling management system, method and equipment and storage medium

Abstract

The invention discloses a password service cluster scheduling management system and method.The system comprises a service scheduling gateway, a temporary password service cluster and a temporary password service, and the service scheduling gateway is deployed in a cluster mode and used for creating, deleting and state checking operation of the temporary password service; meanwhile, the request of the application client is forwarded to the corresponding password service cluster; the temporary password service cluster is composed of at least two temporary password services; the temporary cryptographic service is used for providing cryptographic operation capability for the client, the operation capability comprises hash operation, symmetric key encryption and decryption operation and asymmetric key cryptographic operation, and the service scheduling gateway can execute load balancing and failover when the cryptographic service cluster is unavailable. And temporarily serving as a cryptographic service to execute cryptographic operation for the client. According to the method, the overall resource utilization rate and the use efficiency of the password service are optimized, and reasonable allocation and use of resources are promoted.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed system coordination services, and in particular to a cryptographic service cluster scheduling management system, method, device and storage medium. Background Art

[0002] Currently, in the field of distributed systems and coordination services, a fixed number of cryptographic services are mostly pre-deployed on the server, and then the decision on whether to expand or shrink the capacity is made based on the memory and CPU conditions of the server during operation.

[0003] First, the disadvantage of this type of device is that after the cryptographic service is started, it will always occupy server resources regardless of whether the service has a client call. Secondly, once a request flows into a cryptographic service, if the service crashes before processing the request, the request will fail to respond. Finally, the scaling of cryptographic services generally only relies on the CPU and memory indicators to decide whether scaling is needed, and these two indicators are generally difficult to fully reflect whether the current service needs to be scaled up or down.

[0004] To this end, the present application specifically proposes a cryptographic service cluster scheduling management system and method to solve the above technical problems. Summary of the invention

[0005] The main purpose of the present invention is to provide a cryptographic service cluster scheduling management system and method to solve the technical problems raised in the background technology.

[0006] The present invention adopts the following technical solutions to solve the above technical problems:

[0007] A cryptographic service cluster scheduling and management system includes a service scheduling gateway, a temporary cryptographic service cluster and a temporary cryptographic service, wherein:

[0008] The service scheduling gateway is deployed in cluster mode, and is mainly used for the creation, deletion, and status check operations of temporary password services. At the same time, it is responsible for forwarding the application client's request to the corresponding temporary password service cluster. In addition, the service scheduling gateway should also have a service orchestration function to manage and organize the cluster formation of temporary password services to ensure that each temporary password service can work together efficiently;

[0009] A temporary password service cluster, consisting of at least two temporary password services;

[0010] Temporary password service is used to provide cryptographic computing capabilities for clients, including hash operations, symmetric key encryption and decryption operations, and asymmetric key cryptographic operations.

[0011] Preferably, when the cryptographic service cluster is unavailable, the service scheduling gateway can perform load balancing and failover, temporarily acting as a cryptographic service to perform cryptographic operations for the client, and perform load balancing and failover.

[0012] A cryptographic service cluster scheduling management method performs scheduling management operations based on the cryptographic service cluster scheduling management system described above, and the specific operation steps include:

[0013] Step S01: The client creates a connection with the service scheduling gateway. The service scheduling gateway uses the client's IP as the KEY to create a temporary password service cluster and at least two temporary password services. After the creation is completed, the request path of the temporary password service cluster is stored as the VALUE in the temporary cluster list of the service scheduling gateway;

[0014] Step S02: after the temporary password service is created, the key data of the client is synchronized to the temporary password service;

[0015] Step S03: After the temporary cryptographic service cluster is created, preparation for interaction with the client is completed;

[0016] Step S04: The service scheduling gateway continuously monitors the status of each temporary password service in the temporary cluster list. If the client connection is not disconnected, if it is found that a temporary password service cannot communicate normally, it will be offline and a new temporary password service will be created to replace it;

[0017] Step S05: The service scheduling gateway monitors the request response time of each temporary password service cluster in real time and calculates the P90, P95, and P99 percentiles respectively, and evaluates the load of the current temporary password service cluster by combining the P90, P95, and P99 percentile analysis, the EWMA algorithm, and the dynamic weight allocation of the total number of requests within the time range;

[0018] Step S06: When the client disconnects from the service scheduling gateway, the service scheduling gateway will use the client's IP as the KEY to delete all temporary password services in the corresponding temporary password service cluster one by one. After the deletion is completed, the service scheduling gateway will also delete the records in the temporary cluster list with the client IP as the KEY (including the corresponding request path VALUE).

[0019] Preferably, the service scheduling gateway in step S03 synchronizes the key data in the temporary password service in the form of a snapshot to ensure that the temporary password service has the latest key data.

[0020] Preferably, in step S02, if a key change occurs during the operation of the temporary password service, the service scheduling gateway promptly updates the key change data in the form of incremental data to ensure that the temporary password service can respond in time and use the latest key.

[0021] Preferably, the processing operation of the business request is performed after the interaction with the client is completed in step S03, and the specific steps include:

[0022] Step S31: The client initiates a service request after successfully establishing a connection;

[0023] Step S32: After the request arrives at the service scheduling gateway, the request is temporarily recorded and forwarded to the temporary password service in the corresponding temporary password service cluster for processing;

[0024] Step S33: When the request is processed and responded normally, the service scheduling gateway deletes the request record;

[0025] Step S34: If it is found that the temporary password service processing the request crashes or the request times out, the service scheduling gateway forwards the request to other temporary password services in the temporary password service cluster for processing;

[0026] Step S35: When it is found that all temporary password services in the entire temporary password service cluster cannot work properly, resulting in the cluster being unavailable, the service scheduling gateway will trigger the downgrade strategy and temporarily act as a password service to process the business request of the current client. The service scheduling gateway will continue to process requests until the temporary password service cluster resumes normal function, and then switch the business request back to the original cluster for processing.

[0027] Preferably, the specific operation process of evaluating the load of the current temporary password service cluster in step S05 includes:

[0028] Step S51: The calculation formula of the preset EWMA algorithm is:

[0029] EWMA(t)=λ*X(t)+(1-λ)*EWMA(t-1)

[0030] Among them, λ is the smoothing coefficient, which affects the weight value of the previous data, (0, 1), X(t) is the observation value at time t, that is, the request response time in each time unit in the temporary password service cluster, and EWMA(t-1) is the EWMA value at the previous moment;

[0031] Step S52: Considering that the amount of observed data may be insufficient when the temporary password service cluster just starts to process the service, resulting in a large deviation, in order to correct the deviation, the EWMA value of P90, the EWMA value of P95 and the EWMA value of P99 are calculated according to the request response time, which are recorded as EWMA_P90, EWMA_P95 and EWMA_P99 respectively. At this time, the evaluation function expression is: performace=EWMA_P90+EWMA_P95+EWMA_P99;

[0032] Step S53: In addition, considering that the total number of requests within the time range may have a large deviation when calculating the evaluation value, a weighted average method is used to assign different weights to each percentile and change the weight according to the total number of requests r within the time range. The evaluation function expression is:

[0033]

[0034] Step S54: using the above evaluation function expression formula, when performace is greater than the upper threshold, it indicates that the current temporary password service cluster needs to perform a capacity expansion operation;

[0035] Step S55: When performace is less than the lower limit threshold, it means that the current temporary cryptographic service cluster needs to perform a scaling-down operation.

[0036] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0037] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0038] It can be seen from the above technical solution that the present invention provides a cryptographic service cluster scheduling management system and method. Compared with the prior art, the present invention has the following advantages:

[0039] 1. The present invention can fully utilize resources on clients with business needs, optimize the overall resource utilization and efficiency of cryptographic services, and promote the rational allocation and use of resources.

[0040] 2. The present invention constructs a multi-level fault tolerance mechanism. Even when the entire temporary cryptographic service cluster fails to work properly, the service call gateway can temporarily act as a cryptographic service to provide computing power, thereby greatly improving the client request accessibility rate and system stability.

[0041] 3. The present invention can more accurately evaluate the load of the temporary cryptographic service cluster and whether there is a need for expansion or contraction, drive efficient and timely expansion or contraction decisions, effectively avoid excess or shortage of resources, and ensure the best balance between service performance and cost-effectiveness.

[0042] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become easy to understand through the following description. Of course, it is not necessary to achieve all of the advantages described above simultaneously for any product implementing the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0044] Figure 1 is a system structure block diagram of the present invention;

[0045] Figure 2 It is a schematic diagram of the method flow of the present invention. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. In the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0047] In the embodiment, see Figure 1 to Figure 2 .

[0048] like Figure 1 As shown, a cryptographic service cluster scheduling and management system proposed in an embodiment of the present invention includes a service scheduling gateway, a temporary cryptographic service cluster and a temporary cryptographic service, wherein:

[0049] The service scheduling gateway is deployed in a cluster mode. It is mainly responsible for the creation, deletion and status check of temporary password services. Secondly, it is responsible for forwarding the application client's request to the corresponding password service cluster. Finally, it can perform load balancing and failover when the password service cluster is unavailable, temporarily acting as a password service to perform cryptographic operations for the client, and perform load balancing and failover.

[0050] A temporary password service cluster, consisting of at least two temporary password services;

[0051] Temporary password service is used to provide cryptographic computing capabilities for clients, including hash operations, symmetric key encryption and decryption operations, and asymmetric key cryptographic operations.

[0052] At this time, by binding the life cycle of the temporary password service to the client session, resources can be fully utilized on clients with business needs, optimizing the overall resource utilization and efficiency of the password service and promoting the rational allocation and use of resources.

[0053] On the other hand, Figure 2 As shown, the present invention also discloses a cryptographic service cluster scheduling management method, which performs scheduling management operations based on the above-mentioned cryptographic service cluster scheduling management system, and the specific operation steps include:

[0054] Step S01: The client creates a connection with the service scheduling gateway. The service scheduling gateway uses the client's IP as the KEY to create a temporary password service cluster and at least two temporary password services. After the creation is completed, the request path of the temporary password service cluster is stored as the VALUE in the temporary cluster list of the service scheduling gateway;

[0055] Step S02: after the temporary password service is created, the key data is synchronized to each temporary password service;

[0056] At this time, after the temporary password service is started, the service scheduling gateway synchronizes the key data in the temporary password service in the form of a snapshot to ensure that the temporary password service has the latest key data;

[0057] In addition, during the operation of the temporary password service, if a key change occurs, the service scheduling gateway will promptly update the key change data in the form of incremental data to ensure that the temporary password service can respond in time and use the latest key, thereby maintaining the security and reliability of cryptographic operations;

[0058] Step S03: After the temporary password service cluster is created, the preparation for interaction with the client is completed, and then the service request processing operation is performed. The specific steps include:

[0059] Step S31: The client initiates a service request after successfully establishing a connection;

[0060] Step S32: After the request information arrives at the service scheduling gateway, the request is temporarily recorded and forwarded to a temporary password service in the corresponding temporary password service cluster for processing;

[0061] Step S33: When the request is processed and responded normally, the service scheduling gateway deletes the request record;

[0062] Step S34: If it is found that the temporary password service processing the request crashes or the request times out, the service scheduling gateway continues to forward the request to other temporary password services in the temporary password service cluster for processing until the request processing is completed;

[0063] Step S35: When it is found that all temporary password services in the entire temporary password service cluster cannot work properly, resulting in the cluster being unavailable, the service scheduling gateway will trigger the downgrade strategy and temporarily act as a password service to process the business request of the current client. The service scheduling gateway will continue to process requests until the temporary password service cluster resumes normal function, and then switch the business request back to the original cluster for processing;

[0064] Step S04: When the client connection is not disconnected, the service scheduling gateway continuously monitors the status of each temporary password service in the temporary cluster list, such as continuously monitoring the health status of the temporary password service cluster and continuously monitoring whether there is a need to expand or shrink the cluster during operation. If it is found that a temporary password service cannot communicate normally, it will be offline and a new temporary password service will be created to replace it;

[0065] Step S05: The service scheduling gateway monitors the request response time of each temporary password service cluster in real time and calculates the P90, P95, and P99 percentiles respectively, and evaluates the load of the current temporary password service cluster by combining the P90, P95, and P99 percentile analysis, the EWMA algorithm, and the dynamic weight allocation of the total number of requests within the time range;

[0066] The specific operation process for evaluating the load of the current temporary password service cluster includes:

[0067] Step S51: The calculation formula of the preset EWMA algorithm is:

[0068] EWMA(t)=λ*X(t)+(1-λ)*EWMA(t-1)

[0069] Among them, λ is the smoothing coefficient, which affects the weight value of the previous data and usually ranges from (0, 1). X(t) is the observed value at time t, that is, the request response time in each time unit in the temporary password service cluster. EWMA(t-1) is the EWMA value at the previous moment.

[0070] Step S52: Considering that the amount of observed data may be insufficient when the temporary password service cluster just starts to process the service, resulting in a large deviation, in order to correct the deviation, the EWMA value of P90, the EWMA value of P95 and the EWMA value of P99 are calculated according to the request response time, which are recorded as EWMA_P90, EWMA_P95 and EWMA_P99 respectively. At this time, the evaluation function expression is: performace=EWMA_P90+EWMA_P95+EWMA_P99;

[0071] Step S53: In addition, considering that the total number of requests within the time range may have a large deviation when calculating the evaluation value, a weighted average method is used to assign different weights to each percentile and change the weight according to the total number of requests r within the time range. The evaluation function expression is:

[0072]

[0073] Step S54: using the above evaluation function expression formula, when performace is greater than the upper threshold, it indicates that the current temporary password service cluster needs to perform capacity expansion operations, such as adding temporary password services or increasing the number of CPU cores that can be used by the current temporary password service cluster;

[0074] Step S55: when performace is less than the lower limit threshold, it indicates that the current temporary password service cluster needs to perform a scaling-down operation, such as reducing the temporary password service or reducing the number of CPU cores that can be used by the current temporary password service cluster;

[0075] This evaluation method combines P90, P95, and P99 percentile analysis with the EWMA algorithm, and dynamically adjusts weights based on the real-time request volume to perform load assessment. This can more accurately assess the load of the temporary password service cluster and whether there is a need for expansion or contraction, drive efficient and timely expansion and contraction decisions, effectively avoid resource surplus or shortage, and ensure the best balance between service performance and cost-effectiveness.

[0076] Step S06: When the client disconnects from the service scheduling gateway, the service scheduling gateway will use the client's IP as the KEY to delete all temporary password services in the corresponding temporary password service cluster one by one. After the deletion is completed, the service scheduling gateway will also delete the record in the temporary cluster list that uses the client's IP as the KEY. The deletion record includes the corresponding request path VALUE;

[0077] At this time, you should cache for a while before executing the deletion command, because the hotspot client may connect multiple times in a short period of time.

[0078] In summary, this method temporarily stores client requests through the service scheduling gateway and ensures automatic intervention when the temporary password service cluster is abnormal until the corresponding temporary password service completes the processing. A multi-level fault tolerance mechanism is constructed. Even when the entire temporary password service cluster cannot work normally, the service call gateway can temporarily act as a password service to provide computing power, thereby greatly improving the client request reachability and system stability.

[0079] In a specific embodiment, in an actual environment A, in the past hour, the cluster processed a total of 60,000 cryptographic operation requests, and the request response time distribution was:

[0080] Calculate the response time for different request ranges:

[0081] For 0 <r≤10000:

[0082] EWMA_P90=3.75

[0083] EWMA_P95=3.39

[0084] EWMA_P99=4.90

[0085] Weighted calculation of response time: 0.40*3.75+0.35*3.39+0.25*4.90=3.91 for 10,000 <r≤100000:

[0086] EWMA_P90=190

[0087] EWMA_P95=195

[0088] EWMA_P99=199

[0089] Weighted calculation of response time: 0.35*160+0.40*165+0.25*169=164.25

[0090] Within different request volume ranges, the cluster's response time showed a significant increase, and the expansion mechanism was triggered after the average response time rose to more than 150 milliseconds and lasted for 3 minutes.

[0091] After the expansion, we continued to observe and found

[0092] EWMA_P90=96.5

[0093] EWMA_P95=110

[0094] EWMA_P99=173

[0095] Weighted calculation of response time: 0.35*96.5+0.40*110+0.25*173=121.025

[0096] It can be seen that after the expansion is triggered, the system performance can be effectively provided to cope with the current huge business volume.

[0097] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0098] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0099] In another embodiment provided in the present application, a computer program product comprising instructions is also provided, which, when executed on a computer, enables the computer to execute any of the cryptographic service cluster scheduling management methods in the above embodiments based on the constructed cryptographic service cluster scheduling management system.

[0100] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

[0101] The embodiment of the present application also provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus.

[0102] Memory, used to store computer programs;

[0103] The processor is used to implement the above-mentioned cryptographic service cluster scheduling management method based on the constructed cryptographic service cluster scheduling management system when executing the program stored in the memory.

[0104] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0105] The communication interface is used for communication between the above electronic device and other devices.

[0106] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0107] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0108] It should also be noted that electronic devices also include terminal devices, which can also be called terminals, user equipment (UE), mobile stations (MS), mobile terminals (MT), etc. Terminal devices can be mobile phones, smart TVs, wearable devices, tablet computers (Pad), computers with wireless transceiver functions, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal devices.

[0109] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0110] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

[0111] In addition, it should be noted that if the embodiments of the present invention involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components in a certain specific posture. If the specific posture changes, the directional indication will also change accordingly.

[0112] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the meaning of "and / or" appearing in the full text includes three parallel schemes. Taking "A and / or B" as an example, it includes scheme A, or scheme B, or schemes that A and B meet at the same time. In addition, in the embodiments of the present invention, "multiple" refers to more than two. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

Claims

1. A cryptographic service cluster scheduling and management system, characterized in that: It includes service scheduling gateway, temporary password service cluster and temporary password service, among which: The service scheduling gateway is deployed in cluster mode, and is mainly used for the creation, deletion, and status check operations of temporary password services. At the same time, it is responsible for forwarding the application client's request to the corresponding temporary password service cluster. In addition, the service scheduling gateway should also have a service orchestration function to manage and organize the cluster formation of temporary password services to ensure that each temporary password service can work together efficiently; A temporary password service cluster, consisting of at least two temporary password services; Temporary password service is used to provide cryptographic computing capabilities for clients, including hash operations, symmetric key encryption and decryption operations, and asymmetric key cryptographic operations.

2. The cryptographic service cluster scheduling management method according to claim 1, characterized in that: When the cryptographic service cluster is unavailable, the service scheduling gateway can perform load balancing and failover, temporarily acting as a cryptographic service to perform cryptographic operations for the client, and perform load balancing and failover.

3. A cryptographic service cluster scheduling management method, characterized in that: The scheduling management operation is performed based on the cryptographic service cluster scheduling management system according to claim 2, and the specific operation steps include: Step S01: The client creates a connection with the service scheduling gateway. The service scheduling gateway uses the client's IP as the KEY to create a temporary password service cluster and at least two temporary password services. After the creation is completed, the request path of the temporary password service cluster is stored as the VALUE in the temporary cluster list of the service scheduling gateway; Step S02: after the temporary password service is created, the key data of the client is synchronized to the temporary password service; Step S03: After the temporary cryptographic service cluster is created, preparation for interaction with the client is completed; Step S04: The service scheduling gateway continuously monitors the status of each temporary password service in the temporary cluster list. If the client connection is not disconnected, if it is found that a temporary password service cannot communicate normally, it will be offline and a new temporary password service will be created to replace it; Step S05: The service scheduling gateway monitors the request response time of each temporary password service cluster in real time and calculates the P90, P95, and P99 percentiles respectively, and evaluates the load of the current temporary password service cluster by combining the P90, P95, and P99 percentile analysis, the EWMA algorithm, and the dynamic weight allocation of the total number of requests within the time range; Step S06: When the client disconnects from the service scheduling gateway, the service scheduling gateway will use the client's IP as the KEY to delete all temporary password services in the corresponding temporary password service cluster one by one. After the deletion is completed, the service scheduling gateway will also delete the records in the temporary cluster list with the client IP as the KEY (including the corresponding request path VALUE).

4. The cryptographic service cluster scheduling management method according to claim 3, characterized in that: The service scheduling gateway in step S03 synchronizes the key data in the temporary password service in the form of a snapshot to ensure that the temporary password service has the latest key data.

5. The cryptographic service cluster scheduling management method according to claim 3, characterized in that: In step S02, during the operation of the temporary password service, if a key change occurs, the service scheduling gateway promptly updates the key change data in the form of incremental data to ensure that the temporary password service can respond immediately and use the latest key.

6. The cryptographic service cluster scheduling management method according to claim 3, characterized in that: After completing the interaction with the client in step S03, the processing operation of the business request is performed, and the specific steps include: Step S31: The client initiates a service request after successfully establishing a connection; Step S32: After the request arrives at the service scheduling gateway, the request is temporarily recorded and forwarded to the temporary password service in the corresponding temporary password service cluster for processing; Step S33: When the request is processed and responded normally, the service scheduling gateway deletes the request record; Step S34: If it is found that the temporary password service processing the request crashes or the request times out, the service scheduling gateway forwards the request to other temporary password services in the temporary password service cluster for processing; Step S35: When it is found that all temporary password services in the entire temporary password service cluster cannot work properly, resulting in the cluster being unavailable, the service scheduling gateway will trigger the downgrade strategy and temporarily act as a password service to process the business request of the current client. The service scheduling gateway will continue to process requests until the temporary password service cluster resumes normal function, and then switch the business request back to the original cluster for processing.

7. The cryptographic service cluster scheduling management method according to claim 3, characterized in that: The specific operation process of evaluating the load of the current temporary password service cluster in step S05 includes: Step S51: The calculation formula of the preset EWMA algorithm is: EWMA(t)=λ*X(t)+(1-λ)*EWMA(t-1) Among them, λ is the smoothing coefficient, which affects the weight value of the previous data and usually ranges from (0, 1). X(t) is the observed value at time t, that is, the request response time in each time unit in the temporary password service cluster. EWMA(t-1) is the EWMA value at the previous moment. Step S52: Considering that the amount of observed data may be insufficient when the temporary password service cluster just starts to process the service, resulting in a large deviation, in order to correct the deviation, the EWMA value of P90, the EWMA value of P95 and the EWMA value of P99 are calculated according to the request response time, which are recorded as EWMA_p90, EWMA_p95 and EWMA_P99 respectively. At this time, the evaluation function expression is: performace=EWMA_P90+EWMA_P95+EWMA_P99; Step S53: In addition, considering that the total number of requests within the time range may have a large deviation when calculating the evaluation value, a weighted average method is used to assign different weights to each percentile and change the weight according to the total number of requests r within the time range. The evaluation function expression is: Step S54: using the above evaluation function expression formula, when performace is greater than the upper threshold, it indicates that the current temporary password service cluster needs to perform a capacity expansion operation; Step S55: When performace is less than the lower limit threshold, it means that the current temporary cryptographic service cluster needs to perform a scaling-down operation.

8. A computer-readable storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a processor, the processor is caused to perform the steps of the method according to any one of claims 3 to 7.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method according to any one of claims 3 to 7.

Images