Electronic license rapid signing and issuing system

Abstract

According to the electronic certificate rapid signing and issuing system provided by the invention, the electronic certificate signing and issuing tasks are classified through the signing and issuing task classification module according to the types of operations which must be performed when the electronic certificate signing and issuing tasks are executed; attribute analysis and resource state evaluation are carried out on different types of tasks through a task scheduling module, and dynamic adjustment and task execution sequence arrangement and calculation resource allocation are carried out on all electronic certificate signing and issuing tasks, so that rapid and accurate signing and issuing of electronic certificates can be ensured, and the electronic certificate signing and issuing efficiency is improved; meanwhile, based on a cryptographic operation execution module, the most preferable cryptographic machine is allocated to each electronic certificate issuing task to execute encryption and signature cryptographic operation, it is ensured that all cryptographic machines can be put into use in an equal opportunity mode, and the probability that the electronic certificate issuing efficiency is affected due to the fact that the cryptographic machines are damaged is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic certificates, and in particular to a system for quickly issuing electronic certificates. Background Art

[0002] Electronic certificates refer to electronic documents such as various certificates, proofs, approvals, appraisal reports, and service results issued by various units in accordance with the law and with legal effect, such as electronic versions of identity cards, marriage certificates, bank repayment flow certificates, business licenses, etc. In recent years, the country has vigorously promoted the application of electronic certificates. Compared with traditional certificates, electronic certificates have brought great convenience to market entities and the public in various industries. As the application field of electronic certificates continues to expand, the scale of user use has increased dramatically, and high-concurrency and high-throughput application scenarios have become more common. The issuance of traditional electronic certificates faces challenges such as increased system pressure, slow processing speed, stability and reliability risks, and it is difficult to meet the needs of efficiency and accuracy, affecting the efficiency of government services and user experience. Summary of the invention

[0003] In order to solve the problem that the existing electronic certificate issuance system cannot meet the requirements of high-concurrency and high-throughput application scenarios, the present invention provides an electronic certificate rapid issuance system, which can issue electronic certificates quickly and accurately, improve the efficiency of electronic certificate issuance, and meet the needs of various application scenarios.

[0004] The technical solution of the present invention is as follows: a system for rapid issuance of electronic certificates, characterized in that it comprises: an issuance task classification module, a task scheduling module and a cryptographic operation execution module;

[0005] The issuance task classification module analyzes the received pending electronic certificate issuance tasks based on different electronic certificate application scenarios and requirements, identifies the issuance task type to which the pending issuance task belongs according to the type of operation that must be performed when the electronic certificate issuance task is executed, and sends the pending issuance task and the issuance task type to which it belongs to to the task scheduling module;

[0006] The operations performed in the task scheduling module include the following steps:

[0007] a1: Establish a task processing work pool, and receive all pending issuance tasks and their issuance task types based on the work pool;

[0008] a2: Analyze and evaluate all pending issuance tasks received in parallel;

[0009] The analysis and evaluation operation includes: analyzing the attributes of the issuance task to be processed according to the type of issuance task to which it belongs, and then evaluating the resource status of the resources used by the issuance task to be processed;

[0010] Among them, the attributes of the electronic certificate issuance task include: required execution time, response time and resource requirements;

[0011] The resources for electronic certificate issuance tasks include: CPU usage, memory usage, disk space, and network traffic;

[0012] a3: Calculate the corresponding scheduling value Disp for the task to be processed and issued based on the resource analysis and evaluation results;

[0013] The scheduling strategy for the task scheduling process is:

[0014]

[0015] Where Disp is the scheduling value; Emergency is the task urgency parameter, p1 is the weight coefficient of the task urgency; PeakTime is the peak time parameter, p2 is the weight coefficient of the peak time; ExecTime is the required execution time parameter, p3 is the weight coefficient of the required execution time; RespTime is the response time parameter, p4 is the weight coefficient of the response time; Resource is the required resource parameter, p5 is the weight coefficient of the required resource;

[0016] a4: Dynamically adjust the task execution order and allocate computing resources;

[0017] Count the dispatch values ​​Disp corresponding to all pending issuance tasks, sort all Disps; allocate resources to each pending issuance task in descending order according to the Disp value, and execute the pending issuance tasks;

[0018] a5: Loop through steps a2 to a4;

[0019] The cryptographic operation execution module deploys multiple cryptographic machines to participate in cryptographic operations, and through initial allocation, cryptographic operation execution and balancing operations, selects the optimal cryptographic machine for encryption and signature operations during the execution of the pending issuance task.

[0020] It is further characterized by:

[0021] The types of operations include: encryption, endorsement and signature addition;

[0022] The types of issuing tasks include: type one, type two and type three;

[0023] The electronic certificate issuance task of type 1 mainly performs encryption and endorsement signature operations when issuing, wherein the encryption operation is completed once for all fields to be endorsed;

[0024] The electronic certificate issuance task of type 2 mainly performs encryption and endorsement signature operations when issuing, wherein the encryption operation is performed independently for each field to be endorsed;

[0025] When issuing the electronic certificate of type 3, the main operations are encryption, signature and annotation signature. The encryption operation is performed independently for each field to be annotated and completed once for all annotated fields.

[0026] The cryptographic operation execution module specifically includes the following operations:

[0027] b1: Divide all cipher machines into two groups: primary cipher machines and backup cipher machines;

[0028] The cryptographic operation execution module calls the main cryptographic machine to provide cryptographic operations for the electronic certificate issuance task; only when all the main cryptographic machines are abnormal, the backup cryptographic machine is called to perform cryptographic operations;

[0029] b2: initialization;

[0030] Set the working state of the main cipher machine to normal, set the working state of the backup cipher machine to normal; set cipher machine parameters for all cipher machines, and set the initial values ​​of all cipher machine parameters to 0;

[0031] The working state includes: normal and abnormal; when the working state is normal, it means that the cipher machine is available, and when the working state is abnormal, it means that the cipher machine is unavailable;

[0032] The cryptographic machine parameters include: the load Pload in the previous time period, the current load Cload, and the number of failures Pfail in the previous time period;

[0033] b3: receiving the pending issuance task issued by the task scheduling module, and requesting the cryptographic machine to perform cryptographic operations for the pending issuance task;

[0034] b4: The number n of master cipher machines that are confirmed to be in normal working state;

[0035] If n=0, execute step b5; at the same time, start the cipher machine maintenance program for the main cipher machine;

[0036] Otherwise, execute b6;

[0037] b5: Determine the number m of backup cipher machines that are in normal working state;

[0038] If m=0, an error is reported and the cipher machine maintenance program is started for all cipher machines;

[0039] Otherwise, execute b6;

[0040] b6: If the number of cipher machines in normal working state is 1, set the cipher machine as the cipher machine to be executed and execute step b8;

[0041] If the number of cipher machines in normal working state is greater than 1, execute step b7;

[0042] b7: Confirm the number of cipher machines with the smallest Pload value among the cipher machines in normal working state, min_n;

[0043] If min_n=1, set it as the cipher machine to be executed and execute step b8;

[0044] Otherwise, if min_n>1, randomly select one of the cipher machines with the smallest Pload value and set it as the cipher machine to be executed, and execute step b8;

[0045] b8: using the cryptographic machine to be executed, executing the encryption or signing operation of the pending issuance task, and determining the execution result of the cryptographic operation;

[0046] If the execution result is successful, the value of the current load Cload of the cipher machine is increased by 1;

[0047] Otherwise, if the execution result is failure, the value of the number of failures Pfail of the cipher machine in the previous time period is increased by 1, and step b9 is executed;

[0048] b9: Compare Pfail with the preset failure threshold;

[0049] If Pfail>preset failure threshold, the working state of the cipher machine is set to: abnormal; and steps b4 to b8 are executed cyclically;

[0050] Otherwise, execute steps b4 to b8 in a loop;

[0051] The cryptographic operation execution module also includes a load balancing operation;

[0052] The load balancing operation includes the following steps:

[0053] c1: Set the polling period and start the scheduled task;

[0054] c2: based on the timed task, poll all the master cipher machines to query the difference td between the current time of the master cipher machine and the time of the last execution failure;

[0055] If td is less than the preset failure interval threshold, execute step c3;

[0056] Otherwise, execute step c4;

[0057] c3: assign the current load Cload value of each master cipher machine to the load Pload of the previous time period;

[0058] Set the current load Cload of each master cipher machine to 0; keep the value of Pfail; end this polling;

[0059] c4: assign the current load Cload value of each master cipher machine to the load Pload of the previous time period;

[0060] Set the current load Cload of each master cipher machine to 0; set Pfail to 0; end this polling;

[0061] The cryptographic operation execution module also includes an abnormal cryptographic machine troubleshooting operation;

[0062] The abnormal cipher machine troubleshooting operation is as follows: setting a polling cycle, polling the working status of all cipher machines based on a scheduled task, and starting the cipher machine troubleshooting program for all cipher machines with abnormal working status;

[0063] The cipher machine maintenance procedure is:

[0064] Start the automatic maintenance program or manual maintenance program for the cipher machine with abnormal working status; for the cipher machine after the maintenance is completed, restore its cipher machine parameters to 0 and set the working status to: normal;

[0065] It also includes: an abnormality monitoring and fault recovery module, which monitors the abnormality of task execution in real time through the status monitoring module during the execution of the pending issuance task, generates an abnormality report and records logs; designs automatic recovery strategies and task retry mechanisms, and provides manual intervention mechanisms for faults that cannot be automatically recovered;

[0066] The state monitoring module communicates with the task execution engine in the task scheduling module in real time through a heartbeat mechanism or a polling method.

[0067] The present application provides a system for rapid issuance of electronic certificates. The system classifies electronic certificate issuance tasks according to the types of operations that must be performed when executing electronic certificate issuance tasks through an issuance task classification module; performs attribute analysis and resource status evaluation on different types of tasks through a task scheduling module, dynamically adjusts the task execution sequence and allocates computing resources for all electronic certificate issuance tasks, ensures that electronic certificates can be issued quickly and accurately, and improves the efficiency of electronic certificate issuance; at the same time, the present application also allocates the most preferred cryptographic machine to perform encryption and signature cryptographic operations for each electronic certificate issuance task based on a cryptographic operation execution module, ensures that all cryptographic machines can be put into use equally, and reduces the probability of problems affecting the efficiency of electronic certificate issuance due to damage to the cryptographic machine; the technical solution of the present application is particularly suitable for high-concurrency and high-throughput electronic certificate issuance application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a structural diagram of the electronic certificate rapid issuance system of the present invention.

[0069] Figure 2 It is a schematic diagram of the task scheduling process of the present invention.

[0070] Figure 3 It is a schematic diagram of the cryptographic operation execution flow of the present invention. DETAILED DESCRIPTION

[0071] like Figure 1 As shown, the present invention includes a system for rapid issuance of electronic certificates, which includes: an issuance task classification module, a task scheduling module, a cryptographic operation execution module and an abnormality monitoring and fault recovery module.

[0072] The issuance task classification module analyzes the received pending electronic certificate issuance tasks based on different electronic certificate application scenarios and requirements, identifies the issuance task type to which the pending issuance task belongs according to the type of operation task that must be performed when the electronic certificate issuance task is executed, and sends the pending issuance task and the issuance task type to which it belongs to to the task scheduling module.

[0073] The task scheduling module analyzes the execution time, response time, resource requirements and other attributes of each type of pending issuance task, and evaluates the resource status of each type of pending issuance task. It performs task scheduling based on the analysis and evaluation results, and dynamically adjusts the task execution order and allocates computing resources.

[0074] The cryptographic operation execution module deploys multiple cryptographic machines to participate in cryptographic operations. During the execution of pending issuance tasks, the optimal cryptographic machine is selected to provide encryption and signature operations through initial allocation, cryptographic operation execution and balancing operations.

[0075] The abnormality monitoring and fault recovery module monitors the abnormality of task execution of pending issued tasks in real time through the status monitoring module, generates abnormality reports and records logs. It designs automatic recovery strategies and task retry mechanisms, and provides manual intervention mechanisms for faults that cannot be automatically recovered.

[0076] In this application, through task classification, scheduling processing and cryptographic operation execution modules, dynamic allocation and load balancing of various tasks in the process of electronic certificate issuance are realized, which greatly improves the issuance efficiency and resource utilization of electronic certificates. Through the abnormal monitoring and fault recovery module, the stability and reliability of the electronic certificate system are ensured, and the user experience of applying for electronic certificates is improved. By using encryption and digital signature technology in the signing and annotation process, the authenticity and integrity of electronic certificate information are ensured, and the issuance security of electronic certificates is guaranteed.

[0077] The types of operations that must be performed in a specific electronic certificate issuance task vary according to the types of electronic certificates. The operations related to the electronic certificates in this embodiment include: encryption, endorsement and signature, and annotation and signature.

[0078] The electronic certificate issuance task types in this embodiment include: type one, type two and type three;

[0079] When issuing electronic certificates, type 1 tasks mainly perform encryption and endorsement signature operations, where the encryption operation is completed at one time for all fields to be endorsed. The specific contents of type 1 electronic certificate issuance tasks include:

[0080] The electronic certificate system collects and enters basic information of electronic certificates, such as certificate type, inspection agency, inspection validity period, vehicle identification number, etc., and encodes the information after format verification and data cleaning. The electronic certificate system encrypts the encoded certificate information in CBC mode. The electronic certificate system signs the encrypted electronic certificate information.

[0081] When issuing electronic certificates of type 2, encryption and signature operations are mainly performed, where the encryption operation is performed independently for each field to be signed. The specific contents of the electronic certificate issuance task of type 2 include:

[0082] The electronic certificate system collects and enters the basic information of the electronic certificate, such as the certificate type, owner information, permitted vehicle type, file number, etc., and encodes the information after format verification and data cleaning. The electronic certificate system encrypts the encoded certificate information, and the encryption adopts CFB mode. The electronic certificate system signs the encrypted electronic certificate information.

[0083] When issuing electronic certificates of type 3, the main operations are encryption, signature and signature addition. The encryption operation is performed independently for each field to be signed and all the added fields are completed at once. The specific contents of the electronic certificate issuance task of type 3 include:

[0084] The electronic certificate system collects and enters the basic information of the electronic certificate, such as the certificate type, license plate number, vehicle type, vehicle identification number, etc., and encodes the information after format verification and data cleaning. The electronic certificate system encrypts the encoded certificate information, and the encryption adopts CFB mode. After the electronic certificate system signs the encrypted electronic certificate information, it will add the signature.

[0085] Type 2 has a different way of encrypting the annotation field than Type 1. In the actual application of Type 1 electronic certificates, all data is shared and provided to the caller without the need for separate encryption. At the same time, considering that the CBC mode is a block encryption mode, the block length is an integer multiple of 16, which is suitable for encryption of longer certificates, while the CFB mode can be used for encryption of any length, which is suitable for encryption of shorter certificates. Therefore, Type 1 uses the CBC mode, and Type 2 uses the CFB mode. Type 3 adds an annotation signature compared to Type 2, mainly based on the consideration of more cross-industry and cross-departmental application needs, and indicates the purpose and validity period when annotating.

[0086] In this embodiment, during the execution of the three types of electronic certificate issuance tasks, the encryption key is generated and managed by a dedicated key management system to ensure the security of the key and encryption process. The domestic SM2 cryptographic algorithm is used for the endorsement signature and the annotation signature, and the domestic SM3 cryptographic algorithm is used to perform a summary operation on the electronic certificate information before the digital signature. The private key used in the signing process is generated and securely stored using a hardware cryptographic device, and the export of the hardware cryptographic device is not allowed. By encrypting and signing the electronic certificate, the privacy of the electronic certificate information is prevented from being leaked, the authenticity and integrity of the electronic certificate information is ensured, and the security of the issuance of the electronic certificate is further guaranteed.

[0087] like Figure 2 As shown, the operations performed in the task scheduling module include the following steps.

[0088] a1: Establish a task processing work pool, and receive all pending issuance tasks and their corresponding issuance task types based on the work pool.

[0089] a2: Analyze and evaluate all pending issuance tasks received in parallel;

[0090] The analysis and evaluation operation includes: analyzing the attributes of the issuance task to be processed according to the issuance task type, and then evaluating the resource status of the resources used by the issuance task to be processed;

[0091] Among them, the attributes of the electronic certificate issuance task include: required execution time, response time and resource requirements;

[0092] The resources for electronic certificate issuance tasks include: CPU usage, memory usage, disk space, and network traffic.

[0093] Type 1 issuance tasks perform one encryption and endorsement signature operation, type 2 issuance tasks perform several encryption and endorsement signature operations, and type 3 issuance tasks perform several encryption, endorsement signature and annotation signature operations. In terms of execution time and resource consumption, type 3 tasks are the most time-consuming and resource-consuming, while type 1 tasks are relatively less time-consuming and resource-consuming.

[0094] From the perspective of actual application needs, type 1 tasks are generally applied in advance, and the response time requirement is not high; type 2 and 3 tasks are generally applied in real time, and the response time requirement is relatively high. At the same time, the execution time of type 1 and 2 tasks is relatively evenly distributed, and the execution time of type 3 tasks is generally during the morning and evening travel peak hours.

[0095] Resource monitoring: The electronic certificate system continuously collects resource usage data during task execution, including but not limited to CPU usage, memory usage, disk space, network traffic, etc.

[0096] Load balancing: The electronic certificate system analyzes the load of each system resource to ensure that the load is evenly distributed when tasks are assigned, avoiding excessive concentration or idleness of resources.

[0097] Dynamic adjustment: During the task execution process, the task progress is monitored in real time and dynamic adjustments are made as needed, such as increasing or decreasing resources, reallocating tasks, etc.

[0098] Through the above task analysis, the specific requirements and constraints of task scheduling are clarified. Through the above resource status evaluation process, the current status of all resources is monitored and accurately evaluated in real time, providing a reliable basis for task allocation.

[0099] Based on the results of task analysis and resource status assessment, select or design appropriate scheduling algorithms and strategies.

[0100] Typically, task scheduling algorithms include priority scheduling, fair share scheduling, cost-based scheduling, etc. In this embodiment, based on the execution time, time and resource consumption, response time requirements, and task execution time distribution of type 1, 2, and 3 tasks, a scheduling algorithm combining priority and fair share is selected to ensure that certain tasks with higher priorities can allocate resources and complete operations as much as possible, to avoid certain tasks not being executed for a long time, and at the same time, certain tasks with relatively even distribution and lower priority are executed in non-peak time periods to meet the execution requirements of tasks with higher priority in peak time periods.

[0101] a3: Calculate the corresponding scheduling value Disp for the task to be processed and issued based on the resource analysis and evaluation results;

[0102] The scheduling strategy for task scheduling processing is:

[0103]

[0104] Among them, Disp is the scheduling value; Emergency is the task urgency parameter, p1 is the weight coefficient of the task urgency; PeakTime is the peak time period parameter, p2 is the weight coefficient of the peak time period; ExecTime is the required execution time parameter, p3 is the weight coefficient of the required execution time; RespTime is the response time parameter, p4 is the weight coefficient of the response time; Resource is the required resource parameter, p5 is the weight coefficient of the required resources.

[0105] In this embodiment, considering that when scheduling tasks, the urgency of the task and the task response time requirements have a greater impact, while the execution time required for the task, the resources required for the task, and whether the task needs to be executed during peak hours have a smaller impact, the initial weight coefficient values ​​are set to: p1=0.4, p2=0.1, p3=0.1, p4=0.3, p5=0.1.

[0106] The value of the task urgency parameter Emergency is divided into three types: 3 for extremely urgent, 2 for relatively urgent, and 1 for generally urgent. For example, if an important security task requires the issuance of an electronic license, it is extremely urgent.

[0107] PeakTime parameter value: There are two types: the value of 1 is when the task needs to be executed during the peak time period; the value of 0 is when the task does not need to be executed during the peak time period. For example, for a certain type of task, according to statistics, the peak time period is generally from 8 am to 10 am and from 2 pm to 4 pm. If there is a task applied in the above time period and needs to be executed as soon as possible, set PeakTime to 1.

[0108] ExecTime value of the required execution time parameter: According to the calculation based on the computing power of mainstream servers and cryptographic machines, the ExecTime of type 1 tasks is about 150 milliseconds, the ExecTime of type 2 tasks is about 300 milliseconds, and the ExecTime of type 3 tasks is about 350 milliseconds. In actual execution, the required execution time will change dynamically according to the changes in the resources and computing power of the server and cryptographic machine.

[0109] Response time parameter RespTime value: According to the application requirements of different types of tasks, the RespTime of type 1 task is about 5 seconds, the ExecTime of type 2 task is about 2 seconds, and the ExecTime of type 3 task is about 2 seconds.

[0110] Required resource parameter Resource value: The required resources are mainly CPU, storage, bandwidth, etc., calculated based on the encryption and signature operations included in different types of tasks. Type 1 tasks are mainly encryption and signature, Type 2 tasks are mainly encryption and signature, and Type 3 tasks are mainly encryption, signature, and signature. The preset Resource of Type 1 tasks is 1; Type 2 tasks have several more encryption operations than Type 1 tasks. Considering that the resources required for encryption operations are about one-tenth of the resources required for signature operations, the preset Resource of Type 2 tasks is 1.5; Type 3 tasks have several more encryption operations and 1 signature operation than Type 1 tasks, and the preset Resource of Type 3 tasks is 2.5. In actual execution, the required resources will change dynamically.

[0111] In the specific implementation, considering the inconsistency of units of different parameters, in order to avoid large differences in parameter values ​​during calculation, when Disp is actually calculated, ExecTime is divided by 100 before calculation, and ExecTime, RespTime, and Resource are calculated without units.

[0112] In order to better adapt to the current system load, resource availability and other environmental factors, ensure that the scheduling mechanism has a certain degree of adaptability and flexibility, and can automatically adjust according to environmental changes, dynamically adjust its weight distribution settings, add or reduce parameters during the actual operation of the task. In actual work, in order to further evaluate the selected scheduling strategy, use historical data or simulated environment to test the selected strategy before actual deployment, evaluate its performance, and make adjustments and optimizations when necessary.

[0113] a4: Dynamically adjust the task execution order and allocate computing resources;

[0114] The scheduling values ​​Disp corresponding to all the pending issuance tasks are counted, and all Disps are sorted; resources are allocated to each pending issuance task in descending order according to the Disp value, and the pending issuance tasks are executed.

[0115] a5: Loop through steps a2 to a4.

[0116] According to the above scheduling processing strategy, tasks with higher Disp values ​​are preferentially selected for processing. In this embodiment, dynamic decisions are made based on the attributes of the tasks (such as required execution time, response time, resource requirements, etc.) and the system status (such as current load, resource availability, etc.), and the task execution order and computing resources are dynamically adjusted to improve resource utilization, reduce latency, and ensure the reliability and fairness of task completion.

[0117] The cryptographic operation execution module deploys multiple cryptographic machines to participate in cryptographic operations. Through initial allocation, cryptographic operation execution and balancing operations, it selects the optimal cryptographic machine for encryption and signature operations during the execution of pending issuance tasks.

[0118] According to the task scheduling module, the currently executable tasks are obtained and the cryptographic machine is called to perform encryption and signature operations. Usually, the electronic certificate system deploys multiple cryptographic machines to participate in cryptographic operations to improve the efficiency of cryptographic operations. In order to avoid the cryptographic machine being overloaded or idle during task execution, a multi-cryptographic machine balanced operation method is designed in this system.

[0119] like Figure 3 As shown, the cryptographic operation execution module specifically includes the following operations.

[0120] b1: Divide all cipher machines into two groups: primary cipher machines and backup cipher machines;

[0121] The cryptographic operation execution module calls the main cryptographic machine to provide cryptographic operations for the electronic certificate issuance task; when all the main cryptographic machines are abnormal, the backup cryptographic machine is called to perform cryptographic operations.

[0122] b2: initialization;

[0123] Set the working status of the main cipher machine to normal, set the working status of the backup cipher machine to normal; set the cipher machine parameters for all cipher machines, and set the initial values ​​of all cipher machine parameters to 0;

[0124] The working status includes: normal and abnormal. When the working status is normal, it means that the cipher machine is available, and when the working status is abnormal, it means that the cipher machine is unavailable.

[0125] The parameters of the cipher machine include: the load Pload in the previous time period, the current load Cload, and the number of failures Pfail in the previous time period.

[0126] b3: receiving the pending issuance task sent by the task scheduling module, and requesting the cipher machine to perform cryptographic operations for the pending issuance task;

[0127] b4: The number n of master cipher machines that are confirmed to be in normal working state;

[0128] If n=0, execute step b5; at the same time, start the cipher machine maintenance program for the main cipher machine; otherwise, execute b6.

[0129] In order to ensure that the main cipher machines can be put into use as much as possible, once it is found that the working status of all the main cipher machines is abnormal, there is no need to wait for the polling thread of the abnormal cipher machine, but to actively start the cipher machine maintenance program.

[0130] b5: Determine the number m of backup cipher machines that are in normal working state;

[0131] If m=0, an error is reported and the cipher machine maintenance program is started for all cipher machines;

[0132] Otherwise, execute b6.

[0133] Similarly, if the working status of the backup cipher machine is found to be abnormal, the cipher machine maintenance program will be actively started.

[0134] b6: If the number of cipher machines in normal working state is 1, set the cipher machine as the cipher machine to be executed and execute step b8;

[0135] If the number of cipher machines in normal working state is greater than 1, execute step b7.

[0136] b7: Confirm the number of cipher machines with the smallest Pload value among the cipher machines in normal working state, min_n;

[0137] If min_n=1, set it as the cipher machine to be executed and execute step b8;

[0138] Otherwise, if min_n>1, randomly select one of the cipher machines with the smallest Pload value and set it as the cipher machine to be executed, and execute step b8.

[0139] b8: Use the cryptographic machine to be executed to perform the encryption or signing operation of the pending issuance task and determine the result of the cryptographic operation execution;

[0140] If the execution result is successful, the value of the current load Cload of the cipher machine is increased by 1;

[0141] Otherwise, if the execution result is failure, the value of the number of failures Pfail of the cipher machine in the previous time period is increased by 1, and step b9 is executed.

[0142] b9: Compare Pfail with the preset failure threshold;

[0143] If Pfail>preset failure threshold, the working state of the cipher machine is set to: abnormal; and steps b4 to b8 are executed cyclically;

[0144] Otherwise, execute steps b4 to b8 in a loop.

[0145] When the number of failures of the cipher machine in the previous time period exceeds the preset threshold, it indicates that the cipher machine may be abnormal, and the working state of the cipher machine is set to abnormal. The specific failure threshold is adaptively set according to the model and parameters of the cipher machine. In this embodiment, the failure threshold is set to 5 times.

[0146] The method describes the current use status of each cipher machine by setting three cipher machine parameters for each cipher machine: the load Pload in the previous time period, the current load Cload, and the number of failures Pfail in the previous time period; marks whether each cipher machine can be used by setting the working status; controls each cipher machine to be used in tasks in a balanced manner based on the comparison of the numerical values ​​of the cipher machine parameters; controls the working status of each cipher machine by the parameter Pfail, and further controls whether the cipher machine can be put into use, thereby improving the success rate of encryption or signature operations of pending issuance tasks.

[0147] The cryptographic operation execution module also includes a load balancing operation, which includes the following steps.

[0148] c1: Set the polling cycle and start the scheduled task. The specific polling cycle time is set according to actual needs. In this embodiment, the polling cycle is set to 1 hour.

[0149] c2: Based on the scheduled task, poll all the master cipher machines to query the difference td between the current time of the master cipher machine and the time of the last execution failure;

[0150] If td is less than the preset failure interval threshold, execute step c3;

[0151] Otherwise, execute step c4.

[0152] During each polling, if the difference between the current time and the last failure time does not exceed 1 minute, it is impossible to accurately determine whether it is an occasional exception or an exception caused by a cipher machine failure. It is not set to 0, and the original value is maintained. It is judged and set when the next timing cycle arrives. In this application, by setting a failure interval threshold, it is ensured that the cipher machine with abnormal status can be discovered in a timely and rapid manner, thereby improving the success rate of encryption or signing operations of pending issuance tasks. The specific failure interval threshold is adaptively set according to the actual computing efficiency. In this embodiment, the failure interval threshold is set to 1 minute.

[0153] c3: Assign the current load Cload value of each master cipher machine to the load Pload of the previous time period;

[0154] Set the current load Cload of each master cipher machine to 0; maintain the value of Pfail; and end this polling.

[0155] c4: Assign the current load Cload value of each master cipher machine to the load Pload of the previous time period;

[0156] Set the current load Cload of each master cipher machine to 0; set Pfail to 0; and end this polling.

[0157] This application can ensure that the idle resources of all main cipher machines are used as much as possible during the execution of the task through load balancing operations, avoid idle cipher machines, improve cipher machine resource utilization, and at the same time, prevent the main cipher machine from being overloaded, and avoid the increase in failure rate caused by long-term use of the cipher machine. The balancing operation in this system is only implemented for the main cipher machine, because under normal circumstances only the main cipher machine is performing operations, and the backup cipher machine only temporarily performs operations when all main cipher machines are abnormal. After the abnormality is resolved, the backup cipher machine remains silent. In the system, the object of the control balancing operation is controlled as the main cipher machine to ensure the execution efficiency of polling and reduce the load on the system host. The load balancing algorithm in this method has a simple concept and high execution efficiency, and is particularly suitable for high-concurrency and high-throughput electronic certificate issuance scenarios.

[0158] In order to ensure that the cipher machines with frequent abnormalities can be discovered in time, the cryptographic operation execution module of the present application also includes an abnormal cipher machine troubleshooting operation; the abnormal cipher machine troubleshooting operation is: setting a polling cycle, based on a scheduled task, polling the working status of all cipher machines, and starting the cipher machine maintenance program for all cipher machines with abnormal working status. The objects of the abnormal cipher machine troubleshooting operation include both the main cipher machine and the backup cipher machine.

[0159] In this application, the cipher machine maintenance procedure is:

[0160] Start the automatic maintenance program or manual maintenance program for the cipher machine with abnormal working status; for the cipher machine after the maintenance is completed, restore its cipher machine parameters to 0 and set the working status to: normal.

[0161] The anomaly monitoring and fault recovery module monitors the execution anomalies of the task in real time through the status monitoring module, generates anomaly reports and records logs during the execution of the pending issued tasks; designs automatic recovery strategies and task retry mechanisms, and provides manual intervention mechanisms for faults that cannot be automatically recovered; the status monitoring module communicates with the task execution engine in the task scheduling module in real time through a heartbeat mechanism or polling.

[0162] The abnormality monitoring and fault recovery module includes two operations: abnormality monitoring and fault recovery, which specifically include the following contents.

[0163] Anomaly monitoring includes: real-time detection and log recording.

[0164] Real-time detection. Deploy a status monitoring module to capture the status changes of each task in real time and store them in the task status database. The status monitoring module communicates with the task execution engine through a heartbeat mechanism or polling to ensure the real-time and accuracy of the status. Integrate anomaly detection algorithms in the status monitoring module. When the task status is abnormal (such as too long processing time, too high resource usage, wrong return value, etc.), the alarm mechanism is automatically triggered and an abnormality report is generated.

[0165] Logging. Generate detailed log records for each task, including task start time, end time, status changes, exception information, etc. Log records are stored in the log database for subsequent analysis and troubleshooting.

[0166] Fault recovery includes: automatic recovery strategy, task retry mechanism and manual intervention.

[0167] Automatic recovery strategy. Design and implement a series of automatic recovery strategies for common failure types. For example, for failures caused by insufficient resources, try to release some occupied resources or increase resource quotas; for code errors, try to restart the task or roll back to the last stable version; for network failures, try to reconnect to the network or switch to a backup network.

[0168] Task retry mechanism. For tasks that are aborted due to temporary failures, design and implement a task retry mechanism. According to the type and severity of the failure, set a reasonable number of retries and retry intervals to ensure that the task can be successfully completed.

[0169] Manual intervention. For faults that cannot be automatically recovered, a manual intervention mechanism is designed and implemented. When the task status is abnormally terminated or pending recovery for a long time, the system automatically notifies the relevant personnel to handle it and provides detailed fault information and log records to quickly locate and solve the problem.

[0170] After using the technical solution of the present invention, the issuance tasks are first divided into three categories according to the application scenarios and requirements of electronic certificates, and then the attributes of each type of task are analyzed, and the task scheduling and processing strategy is designed after the resource status is evaluated. Finally, the most suitable cryptographic machine is selected for the scheduled task to perform cryptographic operations to complete the electronic certificate issuance task. In this application, the issuance tasks are classified and the attributes of different types of tasks are analyzed and the resource status is evaluated, the scheduling algorithm is selected and the scheduling and processing strategy is designed, and the most preferred cryptographic machine is assigned to perform encryption and signature cryptographic operations, and abnormal monitoring and fault recovery are implemented at the same time, so as to achieve the purpose of improving the efficiency of electronic certificate issuance and ensure the reliability and security of issuance.

Claims

1. A system for rapid issuance of electronic certificates, characterized in that: It includes: Issuing task classification module, task scheduling module and cryptographic operation execution module; The issuance task classification module analyzes the received pending electronic certificate issuance tasks based on different electronic certificate application scenarios and requirements, and identifies the issuance task type to which the pending issuance task belongs according to the type of operation that must be performed when the electronic certificate issuance task is executed; Sending the pending issuance task and the issuance task type to which it belongs to the task scheduling module; The operations performed in the task scheduling module include the following steps: a1: Establish a task processing work pool, and receive all pending issuance tasks and their issuance task types based on the work pool; a2: Analyze and evaluate all pending issuance tasks received in parallel; The analysis and evaluation operation includes: analyzing the attributes of the issuance task to be processed according to the type of issuance task to which it belongs, and then evaluating the resource status of the resources used by the issuance task to be processed; Among them, the attributes of the electronic certificate issuance task include: required execution time, response time and resource requirements; The resources for electronic certificate issuance tasks include: CPU usage, memory usage, disk space, and network traffic; a3: Calculate the corresponding scheduling value Disp for the task to be processed and issued based on the resource analysis and evaluation results; The scheduling strategy of the task scheduling process is: Wherein, Disp is the scheduling value; Emergency is the task urgency parameter, p1 is the weight coefficient of the task urgency; PeakTime is the peak time parameter, p2 is the weight coefficient of the peak time; ExecTime is the required execution time parameter, p3 is the weight coefficient of the required execution time; RespTime is the response time parameter, p4 is the weight coefficient of the response time; Resource is the required resource parameter, p5 is the weight coefficient of the required resource; a4: Dynamically adjust the task execution order and allocate computing resources; Count the dispatch values ​​Disp corresponding to all pending issuance tasks, sort all Disps; allocate resources to each pending issuance task in descending order according to the Disp value, and execute the pending issuance tasks; a5: Loop through steps a2 to a4; The cryptographic operation execution module deploys multiple cryptographic machines to participate in cryptographic operations, and through initial allocation, cryptographic operation execution and balancing operations, selects the optimal cryptographic machine for encryption and signature operations during the execution of the pending issuance task.

2. According to claim 1, a system for rapid issuance of electronic certificates is characterized by: The types of operations include: encryption, endorsement and signature addition; The types of issuing tasks include: type one, type two and type three; The electronic certificate issuance task of type 1 mainly performs encryption and endorsement signature operations when issuing, wherein the encryption operation is completed once for all fields to be endorsed; The electronic certificate issuance task of type 2 mainly performs encryption and endorsement signature operations when issuing, wherein the encryption operation is performed independently for each field to be endorsed; When issuing the electronic certificate of type three, the main operations are encryption, endorsement and annotation. The encryption operation is performed independently for each field to be endorsed and completed at one time for all the annotated fields.

3. According to claim 1, a system for rapid issuance of electronic certificates is characterized by: The cryptographic operation execution module specifically includes the following operations: b1: Divide all cipher machines into two groups: primary cipher machines and backup cipher machines; The cryptographic operation execution module calls the main cryptographic machine to provide cryptographic operations for the electronic certificate issuance task; only when all the main cryptographic machines are abnormal, the backup cryptographic machine is called to perform cryptographic operations; b2: initialization; Set the working state of the main cipher machine to normal, set the working state of the backup cipher machine to normal; set cipher machine parameters for all cipher machines, and set the initial values ​​of all cipher machine parameters to 0; The working state includes: normal and abnormal; when the working state is normal, it means that the cipher machine is available, and when the working state is abnormal, it means that the cipher machine is unavailable; The cryptographic machine parameters include: the load Pload in the previous time period, the current load Cload, and the number of failures Pfail in the previous time period; b3: receiving the pending issuance task issued by the task scheduling module, and requesting the cryptographic machine to perform cryptographic operations for the pending issuance task; b4: The number n of master cipher machines that are confirmed to be in normal working state; If n=0, execute step b5; at the same time, start the cipher machine maintenance program for the main cipher machine; Otherwise, execute b6; b5: Determine the number m of backup cipher machines that are in normal working state; If m=0, an error is reported and the cipher machine maintenance program is started for all cipher machines; Otherwise, execute b6; b6: If the number of cipher machines in normal working state is 1, set the cipher machine as the cipher machine to be executed and execute step b8; If the number of cipher machines in normal working state is greater than 1, execute step b7; b7: Confirm the number of cipher machines with the smallest Pload value among the cipher machines in normal working state, min_n; If min_n=1, set it as the cipher machine to be executed and execute step b8; Otherwise, if min_n>1, randomly select one of the cipher machines with the smallest Pload value and set it as the cipher machine to be executed, and execute step b8; b8: using the cryptographic machine to be executed, executing the encryption or signing operation of the pending issuance task, and determining the execution result of the cryptographic operation; If the execution result is successful, the value of the current load Cload of the cipher machine is increased by 1; Otherwise, if the execution result is failure, the value of the number of failures Pfail of the cipher machine in the previous time period is increased by 1, and step b9 is executed; b9: Compare Pfail with the preset failure threshold; If Pfail>preset failure threshold, the working state of the cipher machine is set to: abnormal; and steps b4 to b8 are executed cyclically; Otherwise, execute steps b4 to b8 in a loop.

4. According to claim 1, a system for rapid issuance of electronic certificates is characterized by: The cryptographic operation execution module also includes a load balancing operation; The load balancing operation includes the following steps: c1: Set the polling period and start the scheduled task; c2: based on the timed task, poll all the master cipher machines to query the difference td between the current time of the master cipher machine and the time of the last execution failure; If td is less than the preset failure interval threshold, execute step c3; Otherwise, execute step c4; c3: assigning the current load Cload value of each master cipher machine to the load Pload of the previous time period; Set the current load Cload of each master cipher machine to 0; keep the value of Pfail; end this polling; c4: assign the current load Cload value of each master cipher machine to the load Pload of the previous time period; The current load Cload of each master cipher machine is set to 0; Pfail is set to 0; and the polling is terminated.

5. According to claim 1, the electronic certificate rapid issuance system is characterized by: The cryptographic operation execution module also includes an abnormal cryptographic machine troubleshooting operation; The abnormal cipher machine troubleshooting operation is: setting a polling cycle, polling the working status of all cipher machines based on a scheduled task, and starting the cipher machine maintenance program for all cipher machines with abnormal working status.

6. According to claim 5, a system for rapid issuance of electronic certificates is characterized by: The cipher machine maintenance procedure is: Start the automatic maintenance program or manual maintenance program for the cipher machine with abnormal working status; for the cipher machine after the maintenance is completed, restore its cipher machine parameters to 0 and set the working status to: normal.

7. The electronic certificate rapid issuance system according to claim 1 is characterized by: It also includes: an exception monitoring and fault recovery module, which uses the status monitoring module to monitor the execution abnormalities of the task in real time during the execution of the pending issuance task, generate an exception report and record a log; design an automatic recovery strategy and task retry mechanism, and provide a manual intervention mechanism for faults that cannot be automatically recovered.

8. The electronic certificate rapid issuance system according to claim 7, characterized in that: The state monitoring module communicates with the task execution engine in the task scheduling module in real time through a heartbeat mechanism or a polling method.

Images