Network cipher machine cluster configuration file management system based on user management

Abstract

The invention belongs to the technical field of file management systems, and particularly relates to a network cipher machine cluster configuration file management system based on user management. The system comprises a user management module, a file editing module and a file transmission module. The user management module comprises a management mechanism including cluster creation, cluster joining, cluster quitting, user management, in-cluster equipment management, configuration file list management and configuration file attribute management; the file editing module comprises a management mechanism including configuration file access authority control, content editing and file legality detection; a management mechanism of the file transmission module has the functions of file encryption transmission, file active synchronization and file timing synchronization. According to the invention, the problems of untimely file synchronization, data loss during file synchronization and file conflict during simultaneous editing of multiple network cipher machines are solved, and synchronous management and configuration functions of cluster configuration files of the network cipher machines are realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of file management systems, and more specifically, relates to a network cryptographic machine cluster configuration file management system based on user management. Background Art

[0002] Most of the configuration files of network cryptographic machines are managed and configured by the management system of the network cryptographic machine itself. For a network cryptographic machine, this configuration method is very convenient. However, when there are multiple network cryptographic machines in a network cryptographic machine cluster and the same modification needs to be made to a certain configuration file of all network cryptographic machines, logging into each network cryptographic machine one by one to modify the corresponding file is a repetitive work, which is inefficient and prone to errors.

[0003] Chinese patent document CN109376135A discloses a cluster file system management method and system, which includes: configuring a DLM layer communication interface for each node in the cluster file system; transmitting DLM operation information through the DLM layer communication interface, which is suitable for concurrent access management of shared resources, and realizes a simplified and reliable cluster file system. However, although the cluster file system of the patent document is simplified and reliable, it still cannot realize the synchronous update of the network cryptographic machine configuration file in the cluster; Although some network cryptographic machine management systems in the prior art have also implemented the function of synchronous updating of configuration files, the problems of untimely file synchronization, data loss during file synchronization, and file conflicts when multiple network cryptographic machines are edited simultaneously are not handled perfectly. There are situations where configuration files that should be the same within a network cryptographic machine cluster are still inconsistent, and even due to the loss of synchronized data, the network cryptographic machine cannot operate normally after the synchronization is completed.

[0004] In this context, it is particularly important to develop an efficient, stable and reliable network cryptographic machine cluster configuration file management system. Summary of the invention

[0005] The present invention aims to overcome at least one defect of the above-mentioned prior art and provides a network cryptographic machine cluster configuration file management system based on user management to solve the problems of untimely synchronization of network cryptographic machine cluster configuration files, data loss during file synchronization, and file conflicts when multiple network cryptographic machines are edited simultaneously.

[0006] The detailed technical scheme of the present invention is as follows: A network cryptographic machine cluster configuration file management system based on user management, the system comprising: User management module, file editing module, file transfer module; The management mechanisms included in the user management module include: creating a cluster, joining a cluster, exiting a cluster, user management, device management within a cluster, configuration file list management, and configuration file attribute management; The management mechanisms included in the file editing module include: configuration file access rights control, content editing and file legitimacy detection; The management mechanisms included in the file transfer module include: file encryption transmission, file active synchronization and file timing synchronization functions, which are used to transfer files that need to be synchronized and issued to the corresponding network cryptographic machine.

[0007] Preferably, the creating a cluster comprises: When the network password machine logs in to the configuration file management system as an administrator, it selects the Create Cluster function. Under the above function, the user first defines a cluster name and creates a cluster password for this cluster. This machine exists as the first network password machine in the cluster. The joining of the cluster is specifically as follows: After the network cipher machine logs in to the configuration file management system as an administrator, it selects the function of joining a cluster. Under the above function, the user enters the name of the cluster to be joined and the IP address of the first network cipher machine. The background communicates messages to the network cipher machines in the cluster based on the custom protocol to verify the cluster name. If the cluster exists, the user is prompted to enter the password. If the password is correct, the machine successfully joins the cluster and exists as the second network cipher machine in the cluster. At the same time, the first network cipher machine in the cluster synchronizes its configuration files and management files to the second network cipher machine. The second network cipher machine has the same management capabilities and permissions as the first network cipher machine. When there is a third network cipher machine that wants to join this cluster, enter the IP address of any one of the first network cipher machine or the second network cipher machine as the introduction machine to be introduced into this cluster. The exit from the cluster is specifically as follows: When the network cryptographic machine logs in to the configuration file management system as an administrator and chooses to exit the cluster function, under the above function, the user is first in the state of joining the cluster and can communicate with at least one network cryptographic machine in the cluster. Then the user enters the cluster password, and the background communicates messages to the network cryptographic machines in the cluster based on the custom protocol, notifying other network cryptographic machines to delete the network cryptographic machine; after the network cryptographic machine receives the message that the other network cryptographic machines have been successfully deleted, it deletes the information about the cluster configuration in the local machine and becomes a network cryptographic machine without a cluster state.

[0008] Preferably, according to the present invention, the user management is specifically: Only one administrator account is allowed to log in in the same cluster. The control method is as follows: when an administrator account successfully logs in to the file management system of a network cryptographic machine, a lock request message is issued to other network cryptographic machines in the cluster at a first fixed time, and the administrator accounts of other network cryptographic machines are locked, so that they cannot log in; when the administrator account logs out, an unlock message is sent to other network cryptographic machines; if the network cryptographic machine that locks the administrator account does not receive a lock request message within a second fixed time, the administrator account is automatically unlocked; The administrator account can create a common account. The common account is unique in the cluster and has a unified initial password. The common account can modify its own password after logging in. Multiple common accounts are allowed to log in and operate files at the same time in the cluster.

[0009] Preferably, the device management within the cluster is as follows: When network password machine 1 logs in to the configuration file management system as an administrator, it selects the function of deleting devices in the cluster. Under the above function, the operation interface first displays all the network password machine device IPs in the cluster. The administrator selects the device IP to be deleted and deletes it. When deleting, the cluster password is entered. After the entry is successful, network password machine 1 first notifies network password machine 2 to be deleted through a custom message. After network password machine 2 receives the deletion command, it automatically clears the cluster information of this device, and then replies to network password machine 1 with a message that it has successfully exited the cluster. After network password machine 1 receives the message that network password machine 2 has successfully exited the group, it deletes the network password machine 2 information in the local network password machine cluster list, and then synchronizes this list to other network password machines in the cluster. The operation of deleting the network password machine is completed.

[0010] Preferably, according to the present invention, the configuration file list management is specifically as follows: When the network password machine logs in to the configuration file management system as an administrator, it manages the configuration file list managed by the system, including adding new configuration files to be managed and deleting configuration files to be managed; The purpose of the configuration file list management function is that when the network cryptographic machine operating system needs to adjust the configuration file, add or delete the configuration file, the network cryptographic machine file management system can flexibly update the configuration without updating the file system.

[0011] The configuration file attribute management is specifically as follows: When the network cryptographic machine logs in to the configuration file management system as an administrator, it manages the configuration file properties managed by the system. The file properties are divided into shared and private. The configuration files with shared properties are consistent in all network cryptographic machines in the cluster. When the file is modified, the modified file will be synchronized to other network cryptographic machines in the cluster. The files with private properties are unique to the network cryptographic machine itself. Although each network cryptographic machine has the above files, the contents of the above files are unique to this network cryptographic machine and will not be synchronized to other network cryptographic machines.

[0012] Preferably, the configuration file access permission control is as follows: The configuration file management system allows ordinary users to view and edit configuration files. When a user in the cluster edits file a on network cryptography machine 1, network cryptography machine 1 sends a message to other network cryptography machines to inform them that the file is being edited. The network cryptography machines that receive the message set the file to read-only status, thereby avoiding conflicts when multiple people edit at the same time. The content editing is specifically: When a file is in an editable state, the user selects the function of editing this file and enters the editing interface of this file, and the user modifies the content of the interface; after editing, select "Save and Exit" or "Exit without Saving" to exit the editing interface; when the file with modified content is saved, the corresponding file summary file is updated at the same time, and the new file summary is updated to the summary file for file legitimacy detection; after the file modification is saved, a file modification record will be generated in the file modification record at the same time, and the main contents of the record are: the user id of the file modification, the network cipher machine ip of the file modification, the time of file modification, and the name of the file modification.

[0013] The file legitimacy detection is specifically as follows: Each configuration file has a corresponding file content summary file. The content of the summary file is generated by the file management system based on the SM3 algorithm. After the file management system is started, it will periodically calculate the summary of the managed configuration files and compare them with the content of the corresponding summary file. If the comparison is consistent, the file is considered legal. If the comparison is inconsistent, the file is considered to have been illegally modified and the system is in an untrustworthy state.

[0014] Preferably, the file encryption transmission is as follows: When a network cipher machine wants to transfer a file to another network cipher machine, it first sends a set of random numbers as the initial factors of the key. The sender and the receiver use the encryption algorithm to form a set of symmetric algorithm keys based on the initial factors, the sender's IP address, and the receiver's IP address as initial data, which are used for the sender's encryption and the receiver's decryption. The sender then reads the sent file data in packets and encrypts it and sends it to the receiver, who decrypts it and stores it after receiving it. After the file transfer is completed, the sender will request the receiver to receive the information summary value of the file, and compare it with the file information summary sent by the sender. If the comparison is consistent, the sent file is considered complete and valid, and the receiver is notified that the sending is complete; if the comparison is inconsistent, the receiver is notified to discard the received file and send it again; if the sending fails for three consecutive times, the sending will be stopped and reported to the user interface, and the file synchronization is abnormal.

[0015] Preferably, according to the present invention, the files are actively synchronized, specifically: When a network cryptographic machine logs in to the configuration file management system as an administrator, it manages the list of configuration files managed by the system. When it is necessary to add a configuration file to be managed, delete a configuration file to be managed, or modify the properties of the configuration file to "shared" or "private", the above modifications will be saved in the configuration file list. The modified and saved configuration file list will be automatically synchronized to other network cryptographic machines in the cluster by the network cryptographic machine in sequence. The synchronization order starts from the network cryptographic machine with a smaller IP address and is sent in sequence according to the IP address in the network cryptographic machine cluster list. When a network cryptographic machine logs in to the configuration file management system as an administrator, the above active synchronization process will be triggered when the cluster device list is modified. When a network cryptographic machine logs in to the configuration file management system as an administrator or a common user, the above active synchronization process will be triggered when the configuration file with the property of "shared" is modified.

[0016] The file timing synchronization is specifically as follows: In the network cryptography machine cluster, one of the network cryptography machines is configured through the interface to be set as the initiator of file timing synchronization; or automatic negotiation is selected within the cluster, so that the network cryptography machine with the smallest IP address is automatically set as the initiator of file timing synchronization; the main task of the initiator is to compare the file modification lists of other network cryptography machines in the cluster in turn at regular intervals.

[0017] Preferably, according to the present invention, the processing mechanism of the comparison is as follows: When the comparison results are the same, it means that synchronization is not required; When the compared file modification list lags behind the local file modification record, it is determined that the peer end's file modification lags behind, and the initiator actively synchronizes the file to the peer end; When there is an inconsistency in the compared file modification list, it is reported to the user interface, and a file conflict occurs. The user determines the file to be synchronized finally, and selects the active synchronization function to actively synchronize the file to other network cryptographic machines in the cluster; When the compared file modification list is ahead of the local file modification record, it is determined that the peer configuration file modification failed to be successfully synchronized to other network cryptographic machines, and the synchronization initiator notifies the peer network cryptographic machine to synchronize the configuration file to other network cryptographic machines in the cluster again; the peer network cryptographic machine performs the synchronization process of the configuration file and the file modification list again, and synchronizes the files of the network cryptographic machines in the cluster in turn.

[0018] Compared with the prior art, the present invention has the following beneficial effects: The system of the present invention is an independent configuration file management system, which is used to manage the configuration files of the network cryptographic machine and synchronize the corresponding configurations to other network cryptographic machines in the cluster. Through the functions of timed synchronization, file comparison, file attribute management, file status management, data encryption transmission, file integrity verification, etc., the function of one-time editing and multi-terminal synchronization is realized, which can solve the problems of untimely synchronization of configuration files in the cluster, multi-site editing conflicts, and file synchronization data loss. When there are multiple network cryptographic machines in a network cryptographic machine cluster and the same modification is required for a certain configuration file of all network cryptographic machines, there is no need to log in to each network cryptographic machine one by one to modify the corresponding file, which improves the modification efficiency and reduces the error rate. At the same time, the legality verification mechanism of the file ensures the credibility and reliability of the file and avoids the problem of illegal modification. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is an architectural diagram of a network cryptographic machine cluster configuration file management system based on user management described in the present invention. DETAILED DESCRIPTION

[0020] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0021] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0022] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0023] In the absence of conflict, the embodiments in the present disclosure and the features in the embodiments may be combined with each other.

[0024] In order to solve the problems of untimely synchronization of configuration files in the existing network cryptographic machine cluster, multi-location editing conflicts, and file synchronization data loss, the present invention provides a network cryptographic machine cluster configuration file management system based on user management. The system realizes the synchronization management and configuration functions of the network cryptographic machine cluster configuration files through an innovative user management mechanism, a file editing anti-conflict mechanism, and a file high-reliability synchronization mechanism.

[0025] The following is a further description of a network cryptographic machine cluster configuration file management system based on user management of the present invention in conjunction with specific embodiments.

[0026] Example 1 like Figure 1 As shown, this embodiment provides a network cryptographic machine cluster configuration file management system based on user management, and the system includes: a user management module, a file editing module, and a file transmission module.

[0027] 1. About the User Management Module: The user management module is mainly responsible for creating clusters, joining clusters, exiting clusters, user management, device management within clusters, configuration file list management, and configuration file attribute management.

[0028] 1. Create a cluster: When the network password machine logs in to the configuration file management system as an administrator, you can choose to create a cluster function. Under this function, the user first defines a cluster name of at least 8 bytes and creates an 8-16-byte cluster password for this cluster. This machine exists as the first network password machine in the cluster.

[0029] 2. Join the cluster: When the network password machine logs in to the configuration file management system as an administrator, it can choose to join the cluster function. Under this function, the user enters the name of the cluster to be joined and the IP address of the first network password machine. The background communicates messages to the network password machines in the cluster based on the custom protocol to verify the cluster name. If the cluster exists, the user is prompted to enter the password. If the password is correct, the machine successfully joins the cluster and exists as the second network password machine in the cluster. At the same time, the first network password machine in this cluster will synchronize its configuration files and management files to the second network password machine. At this time, the second network password machine has the same management capabilities and permissions as the first network password machine. When a third network password machine wants to join this cluster, it can enter any network password machine IP address of the first network password machine or the second network password machine as the introduction machine to introduce it into this cluster.

[0030] 3. Exit the cluster: When the network password machine logs in to the configuration file management system as an administrator, it can choose to exit the cluster function. Under this function, the user is first in the state of joining the cluster and can communicate with at least one network password machine in the cluster. Then the user enters the cluster password, and the background sends a message to the network password machine in the cluster based on the custom protocol to notify other network password machines to delete this network password machine. At the same time, after receiving the message that other network password machines have been successfully deleted, this network password machine deletes the information about the cluster configuration in the machine, thus becoming a network password machine without a cluster state.

[0031] 4. User management: Only one administrator account is allowed to log in in the same cluster. The control method is as follows: When an administrator account successfully logs in to the file management system of a network cryptographic machine, it will send a request message to other network cryptographic machines in the cluster every first fixed time. This message is used to lock the administrator account of other network cryptographic machines so that they cannot log in; when the administrator account logs out, it will send an unlock message to other network cryptographic machines. At the same time, if the network cryptographic machine that locks the administrator account does not receive a lock request within the second fixed time, it will automatically unlock the administrator account.

[0032] The first fixed time is 5 seconds, and the second fixed time is 20 seconds.

[0033] The administrator account can create a common account. The common account consists of an 8-digit id, which is unique in the cluster. Common accounts have the same initial password, and can modify their own passwords after logging in. Multiple common accounts are allowed to log in and operate files at the same time in the cluster.

[0034] 5. Device management within the cluster: When network password machine 1 logs in to the configuration file management system as an administrator, it can choose to delete the device within the cluster. Under this function, the operation interface first displays all the device IPs within the cluster. The administrator can select the device IP to be deleted and delete it. When deleting, the cluster password needs to be entered. After the input is successful, the device first notifies the network password machine 2 to be deleted through a custom message. After receiving the deletion command, the network password machine 2 will automatically clear the cluster information of this device, and then reply to the network password machine 1 with a message that the cluster exit is successful. After network password machine 1 receives the message that network password machine 2 has successfully exited the group, it deletes the network password machine information in the local network password machine cluster list, and then synchronizes this list to other network password machines in the cluster. The operation of deleting the network password machine is completed.

[0035] 6. Configuration file list management: When the network cryptographic machine logs in to the configuration file management system as an administrator, the system can manage the configuration file list managed by the system, add new configuration files to be managed, and delete configuration files to be managed. The purpose of this function is that when the network cryptographic machine operating system needs to adjust the configuration file, add or delete the configuration file, the network cryptographic machine file management system can flexibly update the configuration without updating the file system.

[0036] 7. Configuration file attribute management: When the network cryptographic machine logs in to the configuration file management system as an administrator, the attributes of the configuration files managed by the system can be managed. The file attributes are divided into "shared" and "private". The configuration file with "shared" attributes is the same for all network cryptographic machines in the cluster. When the file is modified, it will be synchronized to other network cryptographic machines in the cluster. The file with "private" attributes is unique to the network cryptographic machine itself. Although each network cryptographic machine has this file, the content of this file is unique to this network cryptographic machine and will not be synchronized to other network cryptographic machines.

[0037] (II) About the file editing module: The file editing module is mainly responsible for configuring file access control, content editing, and file legitimacy detection functions.

[0038] 1. Configuration file access control: The file management system allows ordinary users to view and edit configuration files. However, when a user in the cluster edits file a on network cryptography machine 1, network cryptography machine 1 will send a message to other network cryptography machines to notify them that the file is being edited. The network cryptography machines that receive this message will set the file to read-only status, thereby avoiding conflicts when multiple people edit at the same time.

[0039] 2. Content editing: When a file is in an editable state, the user selects the function of editing this file to enter the editing interface of this file, and the user can modify the content of the interface accordingly. After editing, you can select "Save and Exit" or "Don't Save and Exit" to exit the editing interface. When the file with modified content is saved, the corresponding file summary file will be updated at the same time, and the new file summary will be updated to the summary file for file legitimacy detection. After the file modification is saved, a file modification record will be generated in the file modification record at the same time. The main contents of the record are: the user ID of the file modification, the network password machine IP of the file modification, the time of the file modification, and the name of the file modification.

[0040] 3. File legitimacy detection: Each configuration file has a corresponding file content summary file, and the content of the summary file is generated by the file management system based on a specific summary algorithm. After the file system is started, it will periodically calculate the summary of the managed configuration file and compare it with the content of the corresponding summary file. If the comparison is consistent, the file is considered legal. If the comparison is inconsistent, the file is considered to have been illegally modified and the system is in an untrustworthy state.

[0041] (III) Regarding the file transfer module: The file transfer module is mainly used to transfer files that need to be synchronized, such as configuration files, file modification records, configuration file lists, cluster device lists, etc., to the corresponding network cryptographic machine. The main functions include file encryption transmission, file active synchronization, and file scheduled synchronization.

[0042] 1. File encryption transmission: When network cipher machine 1 wants to transfer a file to network cipher machine 2, it first sends a set of 32-bit random numbers as the initial key factor. Then the sender and the receiver use the agreed algorithm to form a set of 16-bit symmetric algorithm keys based on the initial factor, sender IP, and receiver IP as initial data, which are used for encryption by the sender and decryption by the receiver. The sender then reads the sent file data in packets and encrypts it to the receiver, who decrypts it and stores it after receiving it. After the file transfer is completed, the sender will request the receiver to receive the information summary value of the file, and compare it with the local file information summary. If the comparison is consistent, the sent file is considered complete and valid, and the receiver is notified that the sending is complete. If the comparison is inconsistent, the receiver is notified to discard the received file and send it again. If the sending fails three times in a row, the sending will stop and report to the user interface, and the file synchronization is abnormal.

[0043] 2. Active file synchronization: When network cryptography machine 1 logs in to the configuration file management system as an administrator, it can manage the configuration file list managed by the system, such as adding configuration files to be managed, deleting configuration files to be managed, and modifying the properties of configuration files to "shared" or "private", etc. These modifications will be saved in the configuration file list. The modified and saved configuration file list will be actively synchronized by network cryptography machine 1 to other network cryptography machines in the cluster in turn. The synchronization order starts from the network cryptography machine with a smaller IP address and is sent in sequence according to the IP addresses in the network cryptography machine cluster list. Similarly, when the cluster device list, the configuration file with the property of "shared" and the configuration file modification list are modified, the above synchronization process will be triggered.

[0044] 3. File timing synchronization: In the network cipher cluster, you can configure a network cipher as the file timing synchronization initiator through the interface; you can also choose automatic negotiation within the cluster, so that the network cipher with the smallest IP address will be automatically set as the file timing synchronization initiator. The main task of the initiator is to compare the file modification list of other devices in the cluster in turn at regular intervals; each interval can be selected as 10 minutes.

[0045] The comparison results and processing mechanism are as follows: When the comparison results are the same, it means that synchronization is not required; When the compared file modification list lags behind the local file modification record, for example, the local file record is 1 / 2 / 3 / 4 and the peer is 1 / 2 / 3, it can be determined that the peer file modification lags behind, and the initiator will actively synchronize the file to the other party. This phenomenon mainly occurs when a network cryptographic machine in the cluster is offline for a period of time and then comes back online.

[0046] When there is an inconsistency in the compared file modification list, such as when a file is edited offline on a certain terminal, such as the local file record is 1 / 2 / 3 / 4 and the peer end is 1 / 2 / 3 / 5, this situation should be reported to the user interface, and the file conflict should be allowed to let the user decide which file to use as the final synchronized file. And select the active synchronization function to actively synchronize the file to other network cryptographic machines in the cluster.

[0047] When the compared file modification list is ahead of the local file modification record, such as the local file record is 1 / 2 / 3 and the peer is 1 / 2 / 3 / 4, it can be determined that the peer configuration file modification failed to be successfully synchronized to other network cryptographic machines. The synchronization initiator will notify the peer network cryptographic machine to synchronize the configuration file to other devices in the cluster again. The peer network cryptographic machine will perform the synchronization process of the configuration file and the file modification list again, and synchronize the files of the network cryptographic machines in the cluster in turn.

[0048] In summary, the present invention is a network cryptographic machine cluster configuration file management system based on user management. The system is an independent configuration file management system, which is used to manage the configuration files of the network cryptographic machines and synchronize the corresponding configurations to other network cryptographic machines in the cluster, realizing the function of one-time editing and multi-terminal synchronization. It can solve the problems of untimely synchronization of configuration files in the cluster, editing conflicts in multiple locations, and file synchronization data loss. When there are multiple network cryptographic machines in a network cryptographic machine cluster and the same modification is required to a certain configuration file of all network cryptographic machines, there is no need to log in to each network cryptographic machine one by one to modify the corresponding file, which improves the modification efficiency and reduces the error rate.

Claims

1. A network cryptographic machine cluster configuration file management system based on user management, characterized in that: The system includes a user management module, a file editing module and a file transmission module; The management mechanisms included in the user management module include: creating a cluster, joining a cluster, exiting a cluster, user management, device management within a cluster, configuration file list management, and configuration file attribute management; The management mechanisms included in the file editing module include: configuration file access rights control, content editing and file legitimacy detection; The management mechanisms included in the file transfer module include: file encryption transmission, file active synchronization and file timing synchronization functions, which are used to transfer files that need to be synchronized and issued to the corresponding network cryptographic machine.

2. According to the user management-based network cryptographic machine cluster configuration file management system according to claim 1, it is characterized in that: The cluster creation is specifically as follows: When the network password machine logs in to the configuration file management system as an administrator, it selects the Create Cluster function. Under the above function, the user first defines a cluster name and creates a cluster password for this cluster. This machine exists as the first network password machine in the cluster. The joining of the cluster is specifically as follows: After the network cipher machine logs in to the configuration file management system as an administrator, it selects the function of joining a cluster. Under the above function, the user enters the name of the cluster to be joined and the IP address of the first network cipher machine. The background communicates messages to the network cipher machines in the cluster based on the custom protocol to verify the cluster name. If the cluster exists, the user is prompted to enter the password. If the password is correct, the machine successfully joins the cluster and exists as the second network cipher machine in the cluster. At the same time, the first network cipher machine in the cluster synchronizes its configuration files and management files to the second network cipher machine. The second network cipher machine has the same management capabilities and permissions as the first network cipher machine. When there is a third network cipher machine that wants to join this cluster, enter the IP address of any one of the first network cipher machine or the second network cipher machine as the introduction machine to be introduced into this cluster. The exit from the cluster is specifically as follows: When the network cryptographic machine logs in to the configuration file management system as an administrator and chooses to exit the cluster function, under the above function, the user is first in the state of joining the cluster and can communicate with at least one network cryptographic machine in the cluster. Then the user enters the cluster password, and the background communicates messages to the network cryptographic machines in the cluster based on the custom protocol, notifying other network cryptographic machines to delete the network cryptographic machine; after the network cryptographic machine receives the message that the other network cryptographic machines have been successfully deleted, it deletes the information about the cluster configuration in the local machine and becomes a network cryptographic machine without a cluster state.

3. According to the user management-based network cryptographic machine cluster configuration file management system of claim 1, it is characterized in that: The user management is specifically as follows: Only one administrator account is allowed to log in in the same cluster. The control method is as follows: when an administrator account successfully logs in to the file management system of a network cryptographic machine, a lock request message is issued to other network cryptographic machines in the cluster at a fixed time, and the administrator accounts of other network cryptographic machines are locked so that they cannot log in; When the administrator account is logged out, a message to unlock the account is sent to other network cryptographic machines; if the network cryptographic machine that has locked the administrator account does not receive a lock request message within a second fixed time, the administrator account is automatically unlocked; The administrator account can create a common account. The common account is unique in the cluster and has a unified initial password. The common account can modify its own password after logging in. Multiple common accounts are allowed to log in and operate files at the same time in the cluster.

4. According to a user management-based network cryptographic machine cluster configuration file management system according to claim 1, it is characterized in that: The device management within the cluster is specifically as follows: When network password machine 1 logs in to the configuration file management system as an administrator, it selects the function of deleting devices in the cluster. Under the above function, the operation interface first displays all the network password machine device IPs in the cluster. The administrator selects the device IP to be deleted and deletes it. When deleting, the cluster password is entered. After the entry is successful, network password machine 1 first notifies network password machine 2 to be deleted through a custom message. After network password machine 2 receives the deletion command, it automatically clears the cluster information of this device, and then replies to network password machine 1 with a message that it has successfully exited the cluster. After network password machine 1 receives the message that network password machine 2 has successfully exited the group, it deletes the network password machine 2 information in the local network password machine cluster list, and then synchronizes this list to other network password machines in the cluster. The operation of deleting the network password machine is completed.

5. The user-managed network cryptographic machine cluster configuration file management system according to claim 1, characterized in that: The configuration file list management is specifically as follows: When the network password machine logs in to the configuration file management system as an administrator, it manages the configuration file list managed by the system, including adding new configuration files to be managed and deleting configuration files to be managed; The configuration file attribute management is specifically as follows: When the network cryptographic machine logs in to the configuration file management system as an administrator, it manages the configuration file properties managed by the system. The file properties are divided into shared and private. The configuration files with shared properties are consistent in all network cryptographic machines in the cluster. When the file is modified, the modified file will be synchronized to other network cryptographic machines in the cluster. The files with private properties are unique to the network cryptographic machine itself and will not be synchronized to other network cryptographic machines.

6. A network cryptographic machine cluster configuration file management system based on user management according to claim 1, characterized in that: The configuration file access permission control is specifically as follows: The configuration file management system allows ordinary users to view and edit configuration files. When a user in the cluster edits file a on network cryptography machine 1, network cryptography machine 1 sends a message to other network cryptography machines to inform them that the file is being edited. The network cryptography machines that receive the message set the file to read-only status. The content editing is specifically: When a file is in an editable state, the user selects the function of editing this file, enters the editing interface of this file, and modifies the content of the interface; after editing, select "Save and Exit" or "Exit without Saving" to exit the editing interface; when the file with modified content is saved, the corresponding file summary file is updated at the same time, and the new file summary is updated to the summary file for file legitimacy detection; after the file modification is saved, a file modification record will be generated in the file modification record at the same time, and the main content of the record is: the user ID of the file modification, the network cipher IP of the file modification, the time of the file modification, and the name of the file modification; The file legitimacy detection is specifically as follows: Each configuration file has a corresponding file content summary file. The content of the summary file is generated by the file management system based on the SM3 algorithm. After the file management system is started, it will periodically calculate the summary of the managed configuration files and compare them with the content of the corresponding summary file. If the comparison is consistent, the file is considered legal. If the comparison is inconsistent, the file is considered to have been illegally modified and the system is in an untrustworthy state.

7. The user-managed network cryptographic machine cluster configuration file management system according to claim 1, characterized in that: The encrypted transmission of the file is specifically as follows: When a network cipher machine wants to transfer a file to another network cipher machine, it first sends a set of random numbers as the initial factors of the key. The sender and the receiver use the encryption algorithm to form a set of symmetric algorithm keys based on the initial factors, the sender's IP address, and the receiver's IP address as initial data, which are used for the sender's encryption and the receiver's decryption. The sender then reads the sent file data in packets and encrypts it and sends it to the receiver, who decrypts it and stores it after receiving it. After the file transfer is completed, the sender will request the receiver to receive the information summary value of the file, and compare it with the file information summary sent by the sender. If the comparison is consistent, the sent file is considered complete and valid, and the receiver is notified that the sending is complete; if the comparison is inconsistent, the receiver is notified to discard the received file and send it again; if the sending fails for three consecutive times, the sending will be stopped and reported to the user interface, and the file synchronization is abnormal.

8. The user-managed network cryptographic machine cluster configuration file management system according to claim 1, characterized in that: The files are automatically synchronized, specifically: When a network cryptographic machine logs in to the configuration file management system as an administrator, it manages the configuration file list managed by the system. When it is necessary to add a configuration file to be managed, delete a configuration file to be managed, or modify the attribute of a configuration file to "shared" or "private", the above modifications will be saved in the configuration file list. The modified and saved configuration file list will be automatically synchronized to other network cryptographic machines in the cluster by the network cryptographic machine in sequence. The synchronization order is to start from the network cryptographic machine with a smaller IP address and send it in sequence according to the IP address in the network cryptographic machine cluster list; when a network cryptographic machine logs in to the configuration file management system as an administrator, the above active synchronization process will be triggered after the cluster device list is modified; when a network cryptographic machine logs in to the configuration file management system as an administrator or a common user, the above active synchronization process will be triggered when the configuration file with the attribute of "shared" is modified; The file timing synchronization is specifically as follows: In the network cryptography machine cluster, one of the network cryptography machines is configured through the interface to be set as the initiator of file timing synchronization; or automatic negotiation is selected within the cluster, so that the network cryptography machine with the smallest IP address is automatically set as the initiator of file timing synchronization; the main task of the initiator is to compare the file modification lists of other network cryptography machines in the cluster in turn at regular intervals.

9. A network cryptographic machine cluster configuration file management system based on user management according to claim 8, characterized in that: The processing mechanism of the comparison is as follows: When the comparison results are the same, it means that synchronization is not required; When the compared file modification list lags behind the local file modification record, it is determined that the peer end's file modification lags behind, and the initiator actively synchronizes the file to the peer end; When there is an inconsistency in the compared file modification list, it is reported to the user interface, and a file conflict occurs. The user determines the file to be synchronized finally, and selects the active synchronization function to actively synchronize the file to other network cryptographic machines in the cluster; When the compared file modification list is ahead of the local file modification record, it is determined that the peer configuration file modification failed to be successfully synchronized to other network cryptographic machines, and the synchronization initiator notifies the peer network cryptographic machine to synchronize the configuration file to other network cryptographic machines in the cluster again; the peer network cryptographic machine performs the synchronization process of the configuration file and the file modification list again, and synchronizes the files of the network cryptographic machines in the cluster in turn.

Images