Cloud cipher machine cluster management method and device

Abstract

The invention discloses a cloud cipher machine cluster management method and device, and the device comprises a cloud cipher machine management platform, a cloud cipher machine host and a file server, does not depend on the equipment of a specific manufacturer, has certain universality, reduces the logic complexity of the cloud cipher machine management platform, improves the development and construction efficiency of a cipher management platform, and reduces the cost. Management of cloud password devices of different manufacturers is supported; the method comprises the following steps: receiving a cluster management request, and analyzing the cluster management request; analyzing the cluster management request, and calling a cluster management command line tool to complete cluster management work according to the cluster management instruction; obtaining a cluster node state according to the cluster state monitoring request, and calling a cluster monitoring command line tool according to the cluster monitoring instruction to obtain a current virtual machine state; and making a corresponding processing strategy according to the state of the virtual machine. Automatic drifting of fault nodes is supported, automatic fault repairing is achieved, fault time is shortened, operation and maintenance cost is reduced, and usability and reliability of a cloud cipher machine cluster are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to a cloud cryptographic machine cluster management method and device. Background Art

[0002] Cloud cryptography machine is a cryptographic service device based on cloud computing technology. Cloud cryptography machine technology combines the advantages of cloud computing such as virtualization and distributed computing. By pooling cryptographic service resources, it provides users with a flexible, efficient and secure cryptographic service solution. It not only promotes the modernization of cryptographic services, but also provides strong information security protection for various industries such as finance, government, and enterprises. Building a cloud cryptography machine cluster is an effective technical means to improve the availability and reliability of cryptographic services.

[0003] Therefore, how to provide a cloud cryptographic machine cluster management method and device is a problem that technical personnel in this field urgently need to solve. Summary of the invention

[0004] In view of this, the present invention provides a cloud cryptographic machine cluster management method and device, which is independent of the implementation logic of the specific manufacturer's equipment, has a certain degree of versatility, and can effectively promote the infrastructure of cloud cryptographic machines.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] A cloud cryptographic machine cluster management method, comprising:

[0007] Receive cluster management requests and analyze the cluster management requests, including cluster management requests or cluster status monitoring requests;

[0008] Parse cluster management requests and call cluster management command line tools according to cluster management instructions to complete cluster management tasks;

[0009] Obtain the cluster node status according to the cluster status monitoring request, and call the cluster monitoring command line tool according to the cluster status monitoring instruction to obtain the current virtual machine status;

[0010] Make corresponding processing strategies according to the status of the virtual machine.

[0011] Preferably, parsing the cluster management request and calling the cluster management command line tool according to the cluster management instruction to complete the cluster management work specifically includes:

[0012] Determine the number of virtual machine IDs in the cluster management request:

[0013] If there is only one virtual machine ID, it is identified as a cluster creation instruction, and the virtual machine corresponding to the virtual machine ID is identified as the master node;

[0014] If there are at least 2 virtual machine IDs, perform the following cluster management tasks:

[0015] Except for the virtual machine IDs contained in the current cluster and the cluster management request, remove the virtual machines corresponding to the remaining virtual machine IDs in the current cluster;

[0016] In addition to the virtual machine IDs contained in both the current cluster and the cluster management request, add the virtual machines corresponding to the remaining virtual machine IDs in the cluster management request to the current cluster;

[0017] The virtual machine corresponding to the virtual machine ID included in both the current cluster and the cluster management request is a node that does not need to be changed.

[0018] Preferably, a corresponding processing strategy is made according to the state of the virtual machine. If the state of the virtual machine is abnormal, a virtual machine drift strategy is executed, including master node drift and slave node drift.

[0019] Preferably, the master node drift includes:

[0020] Get the latest image of the master node virtual machine;

[0021] Import the latest image of the master node virtual machine into a normal virtual machine. After the import, the normal virtual machine becomes a new master node virtual machine.

[0022] Restart the VM to try to restore the failed master node.

[0023] If the failed master node virtual machine resumes operation, reset the restored master node virtual machine to put the node into the initial state, and use the node as a normal node to create a cluster master node or join another cluster as a slave node.

[0024] Preferably, drifting from a node includes:

[0025] Obtain the latest image of the slave node virtual machine, where the slave node virtual machine is a faulty virtual machine;

[0026] Import the latest image of the slave node virtual machine into a normal virtual machine. After the import, the normal virtual machine becomes a new slave node virtual machine and restores the key data.

[0027] Remove the faulty VM from the cluster.

[0028] Add the new slave node virtual machine to the cluster, and the new slave node becomes a member of the cluster;

[0029] Try to restore the failed slave node virtual machine.

[0030] Reset the restored slave node virtual machine to put the node into the initial state. The node can be used as a normal node to create a cluster or join a cluster as a slave node.

[0031] A cloud cryptographic machine cluster management device, comprising: a cloud cryptographic machine management platform and a cloud cryptographic machine host, the cloud cryptographic machine host comprising a cluster management service, a cluster management instruction parsing module, a cluster status monitoring module and a plurality of virtual machines, each of which comprises a cluster instruction proxy module;

[0032] The cluster management service is used to receive cluster management requests from the cloud cryptographic machine management platform and analyze the cluster management requests. If it is a cluster management request, it is forwarded to the cluster management instruction parsing module. If it is a cluster status monitoring request, it is forwarded to the cluster status monitoring module.

[0033] The cluster management instruction parsing module is used to parse cluster management requests and communicate with the cluster instruction proxy module in the virtual machine to complete the transmission of cluster management instructions;

[0034] The cluster command proxy module is used to call the cluster management command line tool according to the received cluster management command to complete the cluster management work;

[0035] The cluster status monitoring module is used to obtain the cluster node status according to the cluster status monitoring request, and communicate with the cluster instruction proxy module in the virtual machine to complete the transmission of the cluster status monitoring instruction;

[0036] The cluster command proxy module is used to call the cluster monitoring command line tool according to the received cluster status monitoring command to obtain the current virtual machine status, and return the status step by step along the original path;

[0037] The cloud cryptographic machine management platform makes corresponding processing strategies based on the status of the virtual machine.

[0038] Preferably, it also includes a file server;

[0039] The cluster status monitoring module is used to regularly monitor the data changes of the cluster master node and slave nodes. If data changes are detected, the node image is exported and uploaded to the file server;

[0040] The file server is used to store node images, including the master node virtual machine image and the slave node virtual machine image.

[0041] Preferably, the cluster management instructions include cluster creation instructions, cluster adding slave node instructions, cluster removing slave node instructions, cluster node reset instructions and cluster status monitoring instructions.

[0042] It can be seen from the above technical solutions that, compared with the prior art, the present invention discloses a cloud cryptographic machine cluster management method and device, which is independent of the equipment of a specific manufacturer, has a certain degree of versatility, reduces the logical complexity of the cloud cryptographic machine management platform, improves the efficiency of the cryptographic management platform development and construction, and supports the management of cloud cryptographic devices from different manufacturers;

[0043] It supports automatic drift of faulty nodes, realizes automatic fault repair, shortens fault time, reduces operation and maintenance costs, and improves the availability and reliability of the cloud cryptographic machine cluster. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A schematic diagram of the structure of a cloud cryptographic machine cluster management device provided by the present invention.

[0046] Figure 2 A flow chart of a cloud cryptographic machine cluster management method provided by the present invention.

[0047] Figure 3 The cluster management instruction parsing algorithm provided by the present invention.

[0048] Figure 4 The main node drift flow chart provided by the present invention.

[0049] Figure 5 The present invention provides a flow chart of slave node drift.

[0050] Among them, 1. Cloud cryptographic machine management platform, 2. Cloud cryptographic machine host, 3. File server, 4. Cluster management command line tool, 5. Cluster monitoring command line tool, 6. Node image. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] The embodiment of the present invention discloses a cloud cryptographic machine cluster management device, such as Figure 1 As shown, it includes a cloud cryptographic machine management platform 1 and a cloud cryptographic machine host 2. The cloud cryptographic machine host 2 includes a cluster management service, a cluster management instruction parsing module, a cluster status monitoring module and multiple virtual machines, each of which includes a cluster instruction proxy module;

[0053] The cluster management service is used to receive cluster management requests from the cloud cryptographic machine management platform and analyze the cluster management requests. If it is a cluster management request, it is forwarded to the cluster management instruction parsing module. If it is a cluster status monitoring request, it is forwarded to the cluster status monitoring module.

[0054] The cluster management instruction parsing module is used to parse cluster management requests and communicate with the cluster instruction proxy module in the virtual machine to complete the transmission of cluster management instructions;

[0055] The cluster instruction proxy module is used to call the cluster management command line tool 4 according to the received cluster management instruction to complete the cluster management work;

[0056] The cluster status monitoring module is used to obtain the cluster node status according to the cluster status monitoring request, and communicate with the cluster instruction proxy module in the virtual machine to complete the transmission of the cluster status monitoring instruction;

[0057] The cluster instruction proxy module is used to call the cluster monitoring command line tool 5 according to the received cluster status monitoring instruction to obtain the current virtual machine status, and return the status step by step along the original path;

[0058] The cloud cryptographic machine management platform 1 makes corresponding processing strategies according to the status of the virtual machine. For example, if the status of the virtual machine is abnormal, the cloud cryptographic machine management platform 1 executes the virtual machine drift strategy, drifts the faulty virtual machine to the normal virtual machine, and replaces the faulty node with a new normal node to ensure the healthy operation status of the cluster and improve service availability and reliability. For specific implementation methods, please refer to the specific steps of master node drift and slave node drift in the method part.

[0059] In this embodiment, a file server 3 is also included;

[0060] The cluster status monitoring module is used to regularly monitor the data changes of the cluster master node and slave nodes. If data changes are detected, the node image is exported and uploaded to the file server 3;

[0061] The file server 3 is used to store node images 6, including a master node virtual machine image and a slave node virtual machine image.

[0062] In this embodiment, the cluster management instructions include cluster creation instructions, cluster adding slave node instructions, cluster removing slave node instructions, cluster node reset instructions and cluster status monitoring instructions.

[0063] The embodiment of the present invention discloses a cloud cryptographic machine cluster management method, such as Figure 2 As shown, including:

[0064] Receive cluster management requests and analyze the cluster management requests, including cluster management requests or cluster status monitoring requests;

[0065] Parse cluster management requests and call cluster management command line tool 4 according to cluster management instructions to complete cluster management work;

[0066] Obtain the cluster node status according to the cluster status monitoring request, and call the cluster monitoring command line tool 5 according to the cluster status monitoring instruction to obtain the current virtual machine status;

[0067] Make corresponding processing strategies according to the status of the virtual machine.

[0068] In this embodiment, the cluster management instructions include cluster creation instructions, cluster adding slave node instructions, cluster removing slave node instructions, cluster node reset instructions and cluster status monitoring instructions.

[0069] In this embodiment, the cluster management request is parsed, and the cluster management command line tool 4 is called according to the cluster management instruction to complete the cluster management work, which specifically includes:

[0070] Determine the number of virtual machine IDs in the cluster management request:

[0071] If there is only one virtual machine ID, it is identified as a cluster creation instruction, and the virtual machine corresponding to the virtual machine ID is identified as the master node;

[0072] If there are at least 2 virtual machine IDs, perform the following cluster management tasks:

[0073] Except for the virtual machine IDs contained in the current cluster and the cluster management request, remove the virtual machines corresponding to the remaining virtual machine IDs in the current cluster;

[0074] In addition to the virtual machine IDs contained in both the current cluster and the cluster management request, add the virtual machines corresponding to the remaining virtual machine IDs in the cluster management request to the current cluster;

[0075] The virtual machine corresponding to the virtual machine ID included in both the current cluster and the cluster management request is a node that does not need to be changed.

[0076] Specifically, Figure 3 As shown, if there are only 2 or more virtual machine IDs in the request, the following set operation is performed. The circle on the left is the virtual machine ID contained in the current cluster, and the set CLUSTER = {vsm_01, vsm_02, vsm_03}. The circle on the right is the virtual machine ID contained in the cluster management request, and the set REQ = {vsm_01, vsm_02, vsm_04, vsm_05}. The set operations from 2.1 to 2.3 are performed, and the set operation results are A, B, and C. The specific cluster processing method for the set operation results is as follows;

[0077] 2.1. Difference set A indicates the ID of the virtual machine to be removed from the cluster at the current time. vsm_03 needs to be removed from the cluster. This is applicable to scenarios where the cluster has excess resources and the cluster needs to be scaled down to save virtual machine resources, or when the virtual machine is abnormal and the faulty virtual machine needs to be removed from the cluster.

[0078] Difference set A = CLUSTER - (CLUSTER ∩ REQ)

[0079] 2.2. Difference set B indicates the ID of the new virtual machine to be added to the cluster at the current time. vsm_04 and vsm_05 need to be added to the cluster. This is applicable to scenarios where a slave node virtual machine is added after a newly created cluster is created or new virtual machines need to be added when resources are insufficient to expand cluster resources.

[0080] Difference set B = CLUSTER - (CLUSTER ∩ REQ)

[0081] 2.3. The intersection C represents the nodes that do not need to be changed in the cluster at the current time. The vsm_01 and vsm_02 in the cluster do not need to be changed. Because the cluster must have and can only have one master node, the intersection at least contains the master node virtual machine ID, otherwise the request is illegal data;

[0082] Intersection C = CLUSTER ∩ REQ

[0083] In this embodiment, cluster node status is monitored. In the event of node abnormality, the cloud cryptographic machine management platform 1 automatically completes node drift, implements automatic fault repair, shortens fault time, reduces operation and maintenance costs, and improves service reliability. The drift of faulty nodes includes master node drift and slave node drift.

[0084] like Figure 4 As shown, master node drift includes:

[0085] Query and obtain the latest image of the master node virtual machine from file server 3;

[0086] Import the latest image of the master node virtual machine into a normal virtual machine. After the import, the normal virtual machine becomes a new master node virtual machine.

[0087] Restart the VM to try to restore the failed master node.

[0088] If the failed master node virtual machine resumes operation, reset the restored master node virtual machine to put the node into the initial state, and use the node as a normal node to create a cluster master node or join another cluster as a slave node.

[0089] The present invention achieves master node fault repair by obtaining a virtual machine image through a historical backup derived when the master node virtual machine is normal, and taking the latest image when multiple historical backups exist.

[0090] like Figure 5 As shown, slave node drift includes:

[0091] Query and obtain the latest image of the slave node virtual machine from the file server 3, where the slave node virtual machine is the faulty virtual machine;

[0092] Import the latest image of the slave node virtual machine into a normal virtual machine. After the import, the normal virtual machine becomes a new slave node virtual machine and restores the key data.

[0093] Remove the faulty VM from the cluster.

[0094] Add the new slave node virtual machine to the cluster, and the new slave node becomes a member of the cluster;

[0095] Try to restore the failed slave node virtual machine to run, that is, restart and try to restore the new slave node virtual machine to run;

[0096] Reset the restored slave node virtual machine to put the node into the initial state. The node can be used as a normal node to create a cluster or join a cluster as a slave node.

[0097] The node image 6 includes cluster information and configuration data. The node image includes a master node virtual machine image and a slave node virtual machine image. The same master node virtual machine or slave node virtual machine can be restored through the virtual machine image.

[0098] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0099] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A cloud cryptographic machine cluster management method, characterized in that: include: Receive cluster management requests and analyze the cluster management requests, including cluster management requests or cluster status monitoring requests; Parse cluster management requests and call cluster management command line tools according to cluster management instructions to complete cluster management tasks; Obtain the cluster node status according to the cluster status monitoring request, and call the cluster monitoring command line tool according to the cluster status monitoring instruction to obtain the current virtual machine status; Make corresponding processing strategies according to the status of the virtual machine.

2. A cloud cryptographic machine cluster management method according to claim 1, characterized in that: Parse cluster management requests and call cluster management command line tools according to cluster management instructions to complete cluster management tasks, including: Determine the number of virtual machine IDs in the cluster management request: If there is only one virtual machine ID, it is identified as a cluster creation instruction, and the virtual machine corresponding to the virtual machine ID is identified as the master node; If there are at least 2 virtual machine IDs, perform the following cluster management tasks: Except for the virtual machine IDs contained in the current cluster and the cluster management request, remove the virtual machines corresponding to the remaining virtual machine IDs in the current cluster; In addition to the virtual machine IDs contained in both the current cluster and the cluster management request, add the virtual machines corresponding to the remaining virtual machine IDs in the cluster management request to the current cluster; The virtual machine corresponding to the virtual machine ID included in both the current cluster and the cluster management request is a node that does not need to be changed.

3. A cloud cryptographic machine cluster management method according to claim 2, characterized in that: Make corresponding processing strategies according to the virtual machine status. If the virtual machine status is abnormal, execute the virtual machine drift strategy, including master node drift and slave node drift.

4. A cloud cryptographic machine cluster management method according to claim 3, characterized in that: Masternode drift includes: Get the latest image of the master node virtual machine; Import the latest image of the master node virtual machine into a normal virtual machine. After the import, the normal virtual machine becomes a new master node virtual machine. Restart the VM to try to restore the failed master node. If the failed master node virtual machine resumes operation, reset the restored master node virtual machine to put the node into the initial state, and use the node as a normal node to create a cluster master node or join another cluster as a slave node.

5. A cloud cryptographic machine cluster management method according to claim 3, characterized in that: Slave node drift includes: Obtain the latest image of the slave node virtual machine, where the slave node virtual machine is a faulty virtual machine; Import the latest image of the slave node virtual machine into a normal virtual machine. After the import, the normal virtual machine becomes a new slave node virtual machine and restores the key data. Remove the faulty VM from the cluster. Add the new slave node virtual machine to the cluster, and the new slave node becomes a member of the cluster; Try to restore the failed slave node virtual machine. Reset the restored slave node virtual machine to put the node into the initial state. The node can be used as a normal node to create a cluster or join a cluster as a slave node.

6. A cloud cryptographic machine cluster management device, characterized in that: include: A cloud cryptographic machine management platform and a cloud cryptographic machine host. The cloud cryptographic machine host includes a cluster management service, a cluster management instruction parsing module, a cluster status monitoring module, and multiple virtual machines. Each virtual machine includes a cluster instruction proxy module. The cluster management service is used to receive cluster management requests from the cloud cryptographic machine management platform and analyze the cluster management requests. If it is a cluster management request, it is forwarded to the cluster management instruction parsing module. If it is a cluster status monitoring request, it is forwarded to the cluster status monitoring module. The cluster management instruction parsing module is used to parse cluster management requests and communicate with the cluster instruction proxy module in the virtual machine to complete the transmission of cluster management instructions; The cluster command proxy module is used to call the cluster management command line tool to complete cluster management work according to the received cluster management commands; The cluster status monitoring module is used to obtain the cluster node status according to the cluster status monitoring request, and communicate with the cluster instruction proxy module in the virtual machine to complete the transmission of the cluster status monitoring instruction; The cluster command proxy module is used to call the cluster monitoring command line tool according to the received cluster status monitoring command to obtain the current virtual machine status, and return the status step by step along the original path; The cloud cryptographic machine management platform makes corresponding processing strategies based on the status of the virtual machine.

7. A cloud cryptographic machine cluster management device according to claim 6, characterized in that: Also includes file servers; The cluster status monitoring module is used to regularly monitor the data changes of the cluster master node and slave nodes. If data changes are detected, the node image is exported and uploaded to the file server; The file server is used to store node images, including the master node virtual machine image and the slave node virtual machine image.

8. A cloud cryptographic machine cluster management device according to claim 6, characterized in that: Cluster management instructions include cluster creation instructions, cluster add slave node instructions, cluster remove slave node instructions, cluster node reset instructions and cluster status monitoring instructions.

Images