A system for rapid issuance of electronic certificates

Abstract

The present application provides a system for rapid issuance of electronic certificates, which uses an issuance task classification module to classify electronic certificate issuance tasks according to the types of operations that must be performed when executing electronic certificate issuance tasks; uses a task scheduling module to perform attribute analysis and resource status evaluation on different types of tasks, and dynamically adjusts the task execution sequence and allocates computing resources for all electronic certificate issuance tasks to ensure that electronic certificates can be issued quickly and accurately, thereby improving the efficiency of electronic certificate issuance; at the same time, based on the cryptographic operation execution module, the present application also allocates the most preferred cryptographic machine to each electronic certificate issuance task to perform encryption and signature cryptographic operations, ensuring that all cryptographic machines can be put into use equally, thereby reducing the probability of problems affecting the efficiency of electronic certificate issuance due to damage to the cryptographic machine.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic certificates, and in particular to a system for quickly issuing electronic certificates. Background Art

[0002] Electronic certificates refer to various legally binding certificates, certifications, approvals, appraisal reports, and other electronic documents issued by various units in accordance with the law. These documents include electronic ID cards, marriage certificates, bank payment statements, and business licenses. In recent years, the country has vigorously promoted the application of electronic certificates. Compared with traditional certificates, electronic certificates have brought great convenience to market entities in various industries and the public. As the application areas of electronic certificates continue to expand and the scale of user use increases dramatically, high-concurrency and high-throughput application scenarios are becoming more common. Traditional electronic certificate issuance faces challenges such as increased system pressure, slow processing speeds, and stability and reliability risks. It is difficult to meet the needs of efficiency and accuracy, affecting the efficiency of government services and user experience. Summary of the Invention

[0003] In order to solve the problem that the existing electronic certificate issuance system cannot meet the requirements of high concurrency and high throughput application scenarios, the present invention provides an electronic certificate rapid issuance system, which can issue electronic certificates quickly and accurately, improve the efficiency of electronic certificate issuance, and meet the needs of various application scenarios.

[0004] The technical solution of the present invention is as follows: a system for rapid issuance of electronic certificates, characterized in that it comprises: an issuance task classification module, a task scheduling module and a cryptographic operation execution module;

[0005] The issuance task classification module analyzes the received pending electronic certificate issuance tasks based on different electronic certificate application scenarios and requirements, identifies the issuance task type to which the pending issuance task belongs according to the type of operation that must be performed when executing the electronic certificate issuance task, and sends the pending issuance task and the issuance task type to which it belongs to to the task scheduling module;

[0006] The operations performed in the task scheduling module include the following steps:

[0007] a1: Establish a task processing work pool, and receive all pending issuance tasks and their corresponding issuance task types based on the work pool;

[0008] a2: Analyze and evaluate all pending issuance tasks received in parallel;

[0009] The analysis and evaluation operation includes: analyzing the attributes of the issuance task to be processed according to the issuance task type to which it belongs, and then evaluating the resource status of the resources used by the issuance task to be processed;

[0010] Among them, the attributes of the electronic certificate issuance task include: required execution time, response time and resource requirements;

[0011] The resources used for electronic certificate issuance tasks include: CPU usage, memory usage, disk space, and network traffic;

[0012] a3: Calculate the corresponding scheduling value Disp for the task to be processed and issued based on the resource analysis and evaluation results;

[0013] The scheduling strategy for the task scheduling process is:

[0014]

[0015] Where Disp is the scheduling value; Emergency is the task urgency parameter, p1 is the weight coefficient of the task urgency; PeakTime is the peak time period parameter, p2 is the weight coefficient of the peak time period; ExecTime is the required execution time parameter, p3 is the weight coefficient of the required execution time; RespTime is the response time parameter, p4 is the weight coefficient of the response time; Resource is the required resource parameter, p5 is the weight coefficient of the required resource;

[0016] a4: Dynamically adjust the task execution order and allocate computing resources;

[0017] Count the dispatch values ​​Disp corresponding to all pending issuance tasks, sort all Disps, allocate resources to each pending issuance task in descending order of Disp values, and execute the pending issuance tasks;

[0018] a5: Loop through steps a2 to a4;

[0019] The cryptographic operation execution module deploys multiple cryptographic machines to participate in cryptographic operations, and through initial allocation, cryptographic operation execution and balancing operations, selects the optimal cryptographic machine to perform encryption and signature operations during the execution of the pending issuance task.

[0020] It is further characterized by:

[0021] The types of operations include: encryption, endorsing and signing;

[0022] The issuance task types include: Type 1, Type 2 and Type 3;

[0023] The type 1 electronic certificate issuance task mainly performs encryption and signature operations during issuance, wherein the encryption operation is completed once for all fields to be signed;

[0024] The second type of electronic certificate issuance task mainly performs encryption and signature operations during issuance, where the encryption operation is performed independently for each field to be signed;

[0025] The Type 3 electronic certificate issuance task mainly performs encryption, endorsement and annotation signature operations during issuance. The encryption operation is performed independently for each field to be endorsed and completed once for all annotated fields.

[0026] The cryptographic operation execution module specifically includes the following operations:

[0027] b1: Divide all cipher machines into two groups: primary cipher machines and backup cipher machines;

[0028] The cryptographic operation execution module calls the main cryptographic machine to provide cryptographic operations for the electronic certificate issuance task; only when all the main cryptographic machines have abnormalities, the backup cryptographic machine is called to perform cryptographic operations;

[0029] b2: initialization;

[0030] Set the working state of the main cipher machine to normal, set the working state of the backup cipher machine to normal; set cipher machine parameters for all cipher machines, and set the initial values ​​of all cipher machine parameters to 0;

[0031] The working status includes: normal and abnormal; when the working status is normal, it means that the cipher machine is available, and when the working status is abnormal, it means that the cipher machine is unavailable;

[0032] The cryptographic machine parameters include: the load Pload of the previous time period, the current load Cload, and the number of failures Pfail of the previous time period;

[0033] b3: receiving the pending issuance task sent by the task scheduling module, and requesting the cipher machine to perform a cryptographic operation for the pending issuance task;

[0034] b4: The number n of master cipher machines that are confirmed to be in normal working state;

[0035] If n=0, then execute step b5; at the same time, start the cipher machine maintenance program for the main cipher machine;

[0036] Otherwise, execute b6;

[0037] b5: Determine the number m of backup cipher machines that are in normal working state;

[0038] If m=0, an error is reported and the cipher machine maintenance program is started for all cipher machines;

[0039] Otherwise, execute b6;

[0040] b6: If the number of cipher machines in normal working state is 1, set the cipher machine as the cipher machine to be executed and go to step b8;

[0041] If the number of cipher machines in normal working state is greater than 1, execute step b7;

[0042] b7: Confirm the number of cipher machines with the smallest Pload value among the cipher machines in normal working status, min_n;

[0043] If min_n=1, set it as the cipher machine to be executed and execute step b8;

[0044] Otherwise, if min_n>1, randomly select one of the cipher machines with the smallest Pload value and set it as the cipher machine to be executed, and execute step b8;

[0045] b8: Using the cryptographic machine to be executed, perform the encryption or signing operation of the pending issuance task, and determine the result of the cryptographic operation execution;

[0046] If the execution result is successful, the value of the current load Cload of the cipher machine is increased by 1;

[0047] Otherwise, if the execution result is failure, the value of the number of failures Pfail in the previous time period of the cipher machine is increased by 1, and step b9 is executed;

[0048] b9: Compare Pfail with the preset failure threshold;

[0049] If Pfail>the preset failure threshold, the working state of the cipher machine is set to abnormal; and steps b4 to b8 are executed in a loop;

[0050] Otherwise, loop through steps b4 to b8;

[0051] The cryptographic operation execution module also includes a load balancing operation;

[0052] The load balancing operation includes the following steps:

[0053] c1: Set the polling period and start the scheduled task;

[0054] c2: Based on the timed task, poll all the master cipher machines to query the difference td between the current time of the master cipher machine and the time of the last execution failure;

[0055] If td is less than the preset failure interval threshold, execute step c3;

[0056] Otherwise, execute step c4;

[0057] c3: assign the current load Cload value of each master cipher machine to the load Pload of the previous time period;

[0058] Set the current load Cload of each master cipher machine to 0; maintain the value of Pfail; end this polling;

[0059] c4: assigning the current load Cload value of each master cipher machine to the load Pload of the previous time period;

[0060] Set the current load Cload of each master cipher machine to 0; set Pfail to 0; end this polling;

[0061] The cryptographic operation execution module also includes an abnormal cryptographic machine troubleshooting operation;

[0062] The abnormal cipher machine troubleshooting operation is as follows: setting a polling cycle, polling the working status of all cipher machines based on a scheduled task, and starting the cipher machine troubleshooting program for all cipher machines with abnormal working status;

[0063] The cipher machine maintenance procedure is as follows:

[0064] Start the automatic maintenance program or manual maintenance program for the cipher machine with abnormal working status; for the cipher machine after the maintenance is completed, restore its cipher machine parameters to 0 and set the working status to: normal;

[0065] It also includes: an anomaly monitoring and fault recovery module, which uses the status monitoring module to monitor task execution anomalies in real time during the execution of pending issuance tasks, generate anomaly reports and record logs; design automatic recovery strategies and task retry mechanisms, and provide manual intervention mechanisms for failures that cannot be automatically recovered;

[0066] The state monitoring module communicates with the task execution engine in the task scheduling module in real time through a heartbeat mechanism or a polling method.

[0067] The present application provides a system for rapid issuance of electronic certificates, which uses an issuance task classification module to classify electronic certificate issuance tasks according to the types of operations that must be performed when executing electronic certificate issuance tasks; uses a task scheduling module to perform attribute analysis and resource status evaluation on different types of tasks, and dynamically adjusts the task execution order and allocates computing resources for all electronic certificate issuance tasks to ensure that electronic certificates can be issued quickly and accurately, thereby improving the efficiency of electronic certificate issuance; at the same time, the present application also allocates the most preferred cipher machine to each electronic certificate issuance task based on the cryptographic operation execution module to perform encryption and signature cryptographic operations, ensuring that all cipher machines can be put into use equally, reducing the probability of problems affecting the efficiency of electronic certificate issuance due to damage to the cipher machine; the technical solution of the present application is particularly suitable for high-concurrency, high-throughput electronic certificate issuance application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a structural diagram of the electronic certificate rapid issuance system of the present invention.

[0069] Figure 2 Schematic diagram of the task scheduling process of the present invention.

[0070] Figure 3 Schematic diagram of the cryptographic operation execution flow of the present invention. DETAILED DESCRIPTION

[0071] like Figure 1 As shown, the present invention includes a system for rapid issuance of electronic certificates, which includes: an issuance task classification module, a task scheduling module, a cryptographic operation execution module and an anomaly monitoring and fault recovery module.

[0072] The issuance task classification module analyzes the received pending electronic certificate issuance tasks based on different electronic certificate application scenarios and requirements, and identifies the issuance task type to which the pending issuance task belongs according to the type of operation task that must be performed when the electronic certificate issuance task is executed; and sends the pending issuance task and the issuance task type to which it belongs to to the task scheduling module.

[0073] The task scheduling module analyzes the execution time, response time, resource requirements and other attributes of each type of pending issuance task, and evaluates the resource status of each type of pending issuance task. It schedules tasks based on the analysis and evaluation results, and dynamically adjusts the task execution order and allocates computing resources.

[0074] The cryptographic operation execution module deploys multiple cryptographic machines to participate in cryptographic operations. During the execution of pending issuance tasks, the optimal cryptographic machine is selected to provide encryption and signature operations through initial allocation, cryptographic operation execution and balancing operations.

[0075] The exception monitoring and fault recovery module uses the status monitoring module to monitor execution anomalies of pending tasks in real time, generate exception reports, and record them in logs. It also designs automatic recovery strategies and task retry mechanisms, and provides manual intervention mechanisms for failures that cannot be automatically recovered.

[0076] In this application, through task classification, scheduling, and cryptographic execution modules, dynamic allocation and load balancing of tasks in the electronic certificate issuance process are achieved, significantly improving the issuance efficiency and resource utilization of electronic certificates. Through the exception monitoring and fault recovery modules, the stability and reliability of the electronic certificate system are ensured, enhancing the user experience of applying for electronic certificates. By using encryption and digital signature technology during the endorsement and annotation processes, the authenticity and integrity of electronic certificate information are ensured, thus guaranteeing the security of electronic certificate issuance.

[0077] The types of operations that must be performed for a specific electronic certificate issuance task vary depending on the type of electronic certificate. The electronic certificate-related operations in this embodiment include: encryption, endorsing signature, and adding signature.

[0078] The electronic certificate issuance task types in this embodiment include: Type 1, Type 2, and Type 3;

[0079] Type 1 electronic certificate issuance tasks primarily perform encryption and signature operations during issuance, with encryption performed on all fields to be signed at once. The specific contents of Type 1 electronic certificate issuance tasks include:

[0080] The electronic certificate system collects and enters basic information about electronic certificates, such as certificate type, inspection agency, validity period, and vehicle identification number. It performs pre-processing, including format verification and data cleaning, before encoding the information. The electronic certificate system encrypts the encoded certificate information using the CBC encryption mode. The system then signs the encrypted electronic certificate information.

[0081] Type 2 electronic certificate issuance tasks primarily perform encryption and signature operations during issuance, with encryption performed independently for each field to be signed. The specific contents of Type 2 electronic certificate issuance tasks include:

[0082] The electronic certificate system collects and enters basic information about electronic certificates, such as certificate type, owner information, permitted vehicle type, and file number. It then performs pre-processing, including format verification and data cleaning, before encoding the information. The electronic certificate system encrypts the encoded certificate information using CFB mode. The system then signs the encrypted electronic certificate information.

[0083] Type 3 electronic certificate issuance tasks mainly perform encryption, endorsement and annotation signature operations during issuance. The encryption operation is performed independently for each field to be endorsed, and all annotation fields are completed at once. The specific contents of Type 3 electronic certificate issuance tasks include:

[0084] The electronic certificate system collects and enters basic information about electronic certificates, such as certificate type, license plate number, vehicle type, and vehicle identification number. It then performs pre-processing, including format verification and data cleaning, before encoding the information. The electronic certificate system encrypts the encoded certificate information using CFB mode. The electronic certificate system then signs the encrypted electronic certificate information and then adds the signature.

[0085] Type 2 differs from Type 1 in the way it encrypts the annotation fields. In actual applications, all data in Type 1 electronic certificates is shared and provided to the caller, eliminating the need for separate encryption. Considering that CBC mode is a block encryption mode with a block length that is an integer multiple of 16, it is suitable for encrypting longer certificates, while CFB mode can be used for encryption of any length, making it suitable for encrypting shorter certificates, Type 1 uses CBC mode, while Type 2 uses CFB mode. Type 3 adds an annotation signature compared to Type 2, primarily due to the high demand for cross-industry and cross-departmental applications. The annotation indicates the intended use and validity period.

[0086] In this embodiment, during the execution of the three types of electronic certificate issuance tasks, encryption keys are generated and managed by a dedicated key management system, ensuring the security of the keys and encryption process. The domestic SM2 cryptographic algorithm is used for endorsing and adding signatures, and the domestic SM3 cryptographic algorithm is used to perform digest operations on the electronic certificate information before digital signing. The private key used in the signing process is generated and securely stored using a hardware cryptographic device, and export of the hardware cryptographic device is prohibited. By encrypting and signing electronic certificates, privacy leaks of electronic certificate information are prevented, the authenticity and integrity of electronic certificate information are ensured, and the security of electronic certificate issuance is further guaranteed.

[0087] like Figure 2 As shown, the operations performed in the task scheduling module include the following steps.

[0088] a1: Establish a task processing work pool, and receive all pending issuance tasks and their corresponding issuance task types based on the work pool.

[0089] a2: Analyze and evaluate all pending issuance tasks received in parallel;

[0090] The analysis and evaluation operation includes: analyzing the attributes of the pending issuance task according to its issuance task type, and then evaluating the resource status of the resources used by the pending issuance task;

[0091] Among them, the attributes of the electronic certificate issuance task include: required execution time, response time and resource requirements;

[0092] The resources used for electronic certificate issuance tasks include: CPU usage, memory usage, disk space, and network traffic.

[0093] Type 1 issuance task performs one encryption and endorsement signature operation, Type 2 issuance task performs several encryption and endorsement signature operations, and Type 3 issuance task performs several encryption, endorsement signature, and annotation signature operations. In terms of execution time and resource consumption, Type 3 tasks are the most time-consuming and resource-consuming, while Type 1 tasks are relatively less time-consuming and resource-consuming.

[0094] From the perspective of actual application requirements, Type 1 tasks are generally requested in advance and have low response time requirements; Type 2 and 3 tasks are generally requested in real time and have relatively high response time requirements. Furthermore, the execution time of Type 1 and 2 tasks is relatively evenly distributed, while Type 3 tasks are generally executed during peak travel times in the morning and evening.

[0095] Resource monitoring: The electronic certificate system continuously collects resource usage data during task execution, including but not limited to CPU usage, memory usage, disk space, network traffic, etc.

[0096] Load balancing: The electronic certificate system analyzes the load of each system resource to ensure that the load is evenly distributed when tasks are assigned, avoiding excessive concentration or idleness of resources.

[0097] Dynamic adjustment: During task execution, task progress is monitored in real time and dynamic adjustments are made as needed, such as increasing or decreasing resources, reallocating tasks, etc.

[0098] Through the above task analysis, the specific requirements and constraints of task scheduling are clarified. Through the above resource status evaluation process, the current status of all resources is monitored and accurately evaluated in real time, providing a reliable basis for task allocation.

[0099] Based on the results of task analysis and resource status assessment, select or design appropriate scheduling algorithms and strategies.

[0100] Typically, task scheduling algorithms include priority scheduling, fair share scheduling, and cost-based scheduling. In this embodiment, a scheduling algorithm combining priority and fair share is selected based on the execution time, time and resource consumption, response time requirements, and task execution time distribution of type 1, 2, and 3 tasks. This ensures that certain higher-priority tasks are allocated resources and completed as much as possible, preventing certain tasks from being left unexecuted for long periods of time. At the same time, certain more evenly distributed, lower-priority tasks are executed during off-peak hours to meet the execution needs of higher-priority tasks during peak hours.

[0101] a3: Calculate the corresponding scheduling value Disp for the task to be processed and issued based on the resource analysis and evaluation results;

[0102] The scheduling strategy for task scheduling processing is:

[0103]

[0104] Among them, Disp is the scheduling value; Emergency is the task urgency parameter, p1 is the weight coefficient of the task urgency; PeakTime is the peak time period parameter, p2 is the weight coefficient of the peak time period; ExecTime is the required execution time parameter, p3 is the weight coefficient of the required execution time; RespTime is the response time parameter, p4 is the weight coefficient of the response time; Resource is the required resource parameter, p5 is the weight coefficient of the required resources.

[0105] In this embodiment, considering that when scheduling tasks, the urgency of the task and the task response time requirements have a greater impact, while the execution time required for the task, the resources required for the task, and whether the task needs to be executed during peak hours have a smaller impact, the initial weight coefficient values ​​are set to: p1 = 0.4, p2 = 0.1, p3 = 0.1, p4 = 0.3, p5 = 0.1.

[0106] The Emergency parameter has three values: 3 for extremely urgent, 2 for relatively urgent, and 1 for moderately urgent. Important security tasks that require the issuance of electronic certificates are considered extremely urgent.

[0107] The PeakTime parameter has two values: 1 if the task must be executed during the peak time period, and 0 if the task does not need to be executed during the peak time period. For example, for a certain type of task, according to statistics, the peak time period is generally from 8:00 AM to 10:00 AM and from 2:00 PM to 4:00 PM. If a task is requested during these time periods and needs to be executed as soon as possible, set PeakTime to 1.

[0108] The ExecTime parameter (ExecuteTime) takes approximately 150 milliseconds for Type 1 tasks, 300 milliseconds for Type 2 tasks, and 350 milliseconds for Type 3 tasks, based on the computing power of mainstream servers and cryptographic machines. In practice, the execution time will vary dynamically based on server and cryptographic machine resources and computing power.

[0109] The response time parameter RespTime value is as follows: Based on the application requirements of different types of tasks, the RespTime of type 1 tasks is approximately 5 seconds, the ExecTime of type 2 tasks is approximately 2 seconds, and the ExecTime of type 3 tasks is approximately 2 seconds.

[0110] The required resource parameter, Resource, primarily includes CPU, storage, and bandwidth. Required resources are calculated based on the encryption and signing operations included in different task types. Type 1 tasks primarily involve encryption and signature signing, Type 2 tasks primarily involve encryption and signature signing, and Type 3 tasks primarily involve encryption, signature signing, and signature addition. The default Resource value for Type 1 tasks is 1. Type 2 tasks, compared to Type 1 tasks, add several encryption operations. Considering that encryption operations require approximately one-tenth the resources of signature operations, the default Resource value for Type 2 tasks is 1.5. Type 3 tasks, compared to Type 1 tasks, add several encryption operations and one signature operation, the default Resource value for Type 3 tasks is 2.5. Required resources will change dynamically during execution.

[0111] In specific implementation, considering the inconsistency of units of different parameters, to avoid large differences in parameter values ​​during calculation, when Disp is actually calculated, ExecTime is first divided by 100 before calculation, and ExecTime, RespTime, and Resource are calculated without units.

[0112] To better adapt to environmental factors such as current system load and resource availability, and to ensure that the scheduling mechanism is adaptive and flexible, capable of automatically adjusting to environmental changes, the weight distribution settings, and parameters are dynamically adjusted during the actual operation of the task. In practice, to further evaluate the selected scheduling strategy, historical data or simulated environments are used to test the selected strategy before actual deployment to evaluate its performance and make adjustments and optimizations as necessary.

[0113] a4: Dynamically adjust the task execution order and allocate computing resources;

[0114] Count the scheduling values ​​Disp corresponding to all currently pending issuance tasks and sort all Disps; allocate resources to each pending issuance task in descending order according to the Disp value, and execute the pending issuance tasks.

[0115] a5: Loop through steps a2 to a4.

[0116] According to the above scheduling strategy, tasks with higher Disp values ​​are prioritized for processing. In this embodiment, dynamic decisions are made based on task attributes (such as required execution time, response time, resource requirements, etc.) and system status (such as current load, resource availability, etc.), dynamically adjusting the order of task execution and the allocation of computing resources, thereby improving resource utilization, reducing latency, and ensuring the reliability and fairness of task completion.

[0117] The cryptographic operation execution module deploys multiple cryptographic machines to participate in cryptographic operations. Through initial allocation, cryptographic operation execution and balancing operations, it selects the optimal cryptographic machine for encryption and signature operations during the execution of pending issuance tasks.

[0118] The task scheduling module obtains the currently available tasks and calls the cryptographic machine to perform encryption and signature operations. Typically, electronic certificate systems deploy multiple cryptographic machines to improve efficiency. To prevent cryptographic machine overload or idleness during task execution, this system designs a method for balancing operations across multiple machines.

[0119] like Figure 3 As shown, the cryptographic operation execution module specifically includes the following operations.

[0120] b1: Divide all cipher machines into two groups: primary cipher machines and backup cipher machines;

[0121] The cryptographic operation execution module calls the main cryptographic machine to provide cryptographic operations for the electronic certificate issuance task; when all the main cryptographic machines have abnormalities, the backup cryptographic machine is called to perform cryptographic operations.

[0122] b2: initialization;

[0123] Set the working status of the main cipher machine to normal, set the working status of the backup cipher machine to normal; set the cipher machine parameters for all cipher machines, and set the initial values ​​of all cipher machine parameters to 0;

[0124] The working status includes: normal and abnormal. When the working status is normal, it means that the cipher machine is available. When the working status is abnormal, it means that the cipher machine is unavailable.

[0125] The cipher machine parameters include: the load Pload in the previous time period, the current load Cload, and the number of failures Pfail in the previous time period.

[0126] b3: Receive the pending issuance task sent by the task scheduling module, and request the cipher machine to perform cryptographic operations for the pending issuance task;

[0127] b4: The number n of master cipher machines that are confirmed to be in normal working state;

[0128] If n=0, execute step b5; at the same time, start the cipher machine maintenance program for the main cipher machine; otherwise, execute b6.

[0129] In order to ensure that the main cipher machine can be put into use as much as possible, once it is found that the working status of all the main cipher machines is abnormal, there is no need to wait for the polling thread of the abnormal cipher machine, but to actively start the cipher machine maintenance program.

[0130] b5: Determine the number m of backup cipher machines that are in normal working state;

[0131] If m=0, an error is reported and the cipher machine maintenance program is started for all cipher machines;

[0132] Otherwise, execute b6.

[0133] Similarly, if it is found that the working status of the backup cipher machine is abnormal, the cipher machine maintenance program will be actively started.

[0134] b6: If the number of cipher machines in normal working state is 1, set the cipher machine as the cipher machine to be executed and go to step b8;

[0135] If the number of cipher machines in normal working state is greater than 1, then execute step b7.

[0136] b7: Confirm the number of cipher machines with the smallest Pload value among the cipher machines in normal working status, min_n;

[0137] If min_n=1, set it as the cipher machine to be executed and execute step b8;

[0138] Otherwise, if min_n>1, randomly select one of the cipher machines with the smallest Pload value and set it as the cipher machine to be executed, and execute step b8.

[0139] b8: Use the pending cipher machine to perform the encryption or signing operation of the pending issuance task and determine the result of the cipher operation.

[0140] If the execution result is successful, the value of the current load Cload of the cipher machine is increased by 1;

[0141] Otherwise, if the execution result is failure, the value of the number of failures Pfail in the previous time period of the cipher machine is increased by 1, and step b9 is executed.

[0142] b9: Compare Pfail with the preset failure threshold;

[0143] If Pfail>the preset failure threshold, the working state of the cipher machine is set to abnormal; and steps b4 to b8 are executed in a loop;

[0144] Otherwise, execute steps b4 to b8 in a loop.

[0145] If the number of failures in the cipher machine in the previous time period exceeds a preset threshold, it indicates that the cipher machine may be abnormal and the cipher machine is set to abnormal. The specific failure threshold is adaptively set according to the model and parameters of the cipher machine. In this embodiment, the failure threshold is set to 5 times.

[0146] This method describes the current usage status of each cipher machine by setting three cipher machine parameters for each cipher machine: the load Pload in the previous time period, the current load Cload, and the number of failures Pfail in the previous time period. It also marks whether each cipher machine can be used by setting the working status. Based on the comparison of the numerical values ​​of the cipher machine parameters, it controls each cipher machine to be used in tasks in a balanced manner. The parameter Pfail is used to control the working status of each cipher machine, thereby controlling whether the cipher machine can be put into use, thereby improving the success rate of encryption or signing operations for pending issuance tasks.

[0147] The cryptographic operation execution module also includes a load balancing operation, which includes the following steps.

[0148] c1: Set the polling cycle and start the scheduled task; the specific polling cycle time is set according to actual needs. In this embodiment, the polling cycle is set to 1 hour.

[0149] c2: Based on the scheduled task, poll all the master cipher machines and query the difference td between the current time of the master cipher machine and the time of the last execution failure;

[0150] If td is less than the preset failure interval threshold, execute step c3;

[0151] Otherwise, go to step c4.

[0152] During each poll, if the difference between the current time and the last failure time is less than 1 minute, and it is impossible to accurately determine whether the anomaly is a random exception or caused by a cipher machine failure, the value is not set to 0 and remains at the original value until the next timing cycle arrives. In this application, a failure interval threshold is set to ensure that abnormal cipher machines can be discovered promptly and quickly, thereby improving the success rate of encryption or signing operations for pending issuance tasks. The specific failure interval threshold is adaptively set based on actual computing efficiency. In this embodiment, the failure interval threshold is set to 1 minute.

[0153] c3: Assign the current load Cload value of each master cipher machine to the load Pload of the previous time period;

[0154] Set the current load Cload of each master cipher machine to 0; maintain the value of Pfail; and end this polling.

[0155] c4: Assign the current load Cload value of each master cipher machine to the load Pload of the previous time period;

[0156] Set the current load Cload of each master cipher machine to 0; set Pfail to 0; and end this polling.

[0157] This application uses load balancing operations to ensure that the idle resources of all main cipher machines are used as much as possible during task execution, avoiding idle conditions of cipher machines, improving resource utilization of cipher machines, and at the same time, preventing overload conditions on the main cipher machines and avoiding increased failure rates caused by long-term use of cipher machines. The balancing operation in this system is only implemented for the main cipher machine, because under normal circumstances only the main cipher machine is performing operations, and the backup cipher machine only temporarily performs operations when all main cipher machines are abnormal. After the abnormality is resolved, the backup cipher machine remains silent. In the system, by controlling the object of the balancing operation to be the main cipher machine, the execution efficiency of polling is ensured, while the load on the system host is reduced. The load balancing algorithm in this method has a simple concept and high execution efficiency, and is particularly suitable for high-concurrency, high-throughput electronic certificate issuance scenarios.

[0158] To ensure that frequently abnormal cipher machines can be promptly detected, the cryptographic operation execution module of this application also includes an abnormal cipher machine troubleshooting operation. This abnormal cipher machine troubleshooting operation involves setting a polling cycle, polling the operating status of all cipher machines based on a scheduled task, and initiating a cipher machine maintenance program for all cipher machines with abnormal operating status. The abnormal cipher machine troubleshooting operation targets both primary and backup cipher machines.

[0159] In this application, the cipher machine maintenance procedure is:

[0160] Start the automatic maintenance program or manual maintenance program for the cipher machine with abnormal working status; for the cipher machine after the maintenance is completed, restore its cipher machine parameters to 0 and set the working status to: normal.

[0161] The anomaly monitoring and fault recovery module uses the status monitoring module to monitor task execution anomalies in real time during the execution of pending issued tasks, generate anomaly reports and record logs; design automatic recovery strategies and task retry mechanisms, and provide manual intervention mechanisms for faults that cannot be automatically recovered; the status monitoring module communicates in real time with the task execution engine in the task scheduling module through a heartbeat mechanism or polling.

[0162] The abnormality monitoring and fault recovery module includes two operations: abnormality monitoring and fault recovery, which specifically include the following contents.

[0163] Anomaly monitoring includes: real-time detection and log recording.

[0164] Real-time detection. Deploy a status monitoring module to capture each task's status changes in real time and store them in a task status database. The status monitoring module communicates with the task execution engine through a heartbeat mechanism or polling to ensure real-time and accurate status updates. An anomaly detection algorithm is integrated into the status monitoring module. When a task's status is abnormal (such as excessive processing time, excessive resource usage, or incorrect return values), an alarm mechanism is automatically triggered and an anomaly report is generated.

[0165] Logging. Generate detailed log records for each task, including task start time, end time, status changes, exception information, etc. Log records are stored in the log database to facilitate subsequent analysis and troubleshooting.

[0166] Fault recovery includes: automatic recovery strategy, task retry mechanism and manual intervention.

[0167] Automatic recovery strategies. Design and implement a series of automatic recovery strategies for common failure types. For example, for insufficient resources, try to release some occupied resources or increase resource quotas; for code errors, try to restart the task or roll back to the last stable version; for network failures, try to reconnect or switch to a backup network.

[0168] Task retry mechanism. Design and implement a task retry mechanism for tasks that are aborted due to temporary failures. Set a reasonable number of retries and retry interval based on the failure type and severity to ensure successful task completion.

[0169] Manual intervention. For faults that cannot be automatically recovered, a manual intervention mechanism is designed and implemented. When a task is in an abnormally suspended or pending recovery state for a long time, the system automatically notifies the relevant personnel to handle the problem and provides detailed fault information and log records to quickly locate and resolve the problem.

[0170] After using the technical solution of the present invention, the issuance tasks are first divided into three categories based on the application scenarios and requirements of electronic certificates. Then, the attributes of each task are analyzed, and a task scheduling and processing strategy is designed after evaluating the resource status. Finally, the most appropriate cryptographic machine is selected for the scheduled tasks to perform cryptographic operations and complete the electronic certificate issuance task. In this application, by classifying the issuance tasks and performing attribute analysis and resource status evaluation on different types of tasks, a scheduling algorithm is selected and a scheduling and processing strategy is designed. The most preferred cryptographic machine is assigned to perform encryption and signature cryptographic operations, and anomaly monitoring and fault recovery are implemented at the same time. This achieves the purpose of improving the efficiency of electronic certificate issuance while ensuring the reliability and security of issuance.

Claims

1. A system for rapid issuance of electronic certificates, characterized in that: It includes: Issuing task classification module, task scheduling module and cryptographic operation execution module; The issuance task classification module analyzes the received pending electronic certificate issuance tasks based on different electronic certificate application scenarios and requirements, and identifies the issuance task type to which the pending issuance task belongs according to the type of operation that must be performed when executing the electronic certificate issuance task; Sending the pending issuance task and the issuance task type to which it belongs to the task scheduling module; The operations performed in the task scheduling module include the following steps: a1: Establish a task processing work pool, and receive all pending issuance tasks and their corresponding issuance task types based on the work pool; a2: Analyze and evaluate all pending issuance tasks received in parallel; The analysis and evaluation operation includes: analyzing the attributes of the issuance task to be processed according to the issuance task type to which it belongs, and then evaluating the resource status of the resources used by the issuance task to be processed; Among them, the attributes of the electronic certificate issuance task include: required execution time, response time and resource requirements; The resources used for electronic certificate issuance tasks include: CPU usage, memory usage, disk space, and network traffic; a3: Calculate the corresponding scheduling value Disp for the task to be processed and issued based on the resource analysis and evaluation results; The scheduling strategy for the task scheduling process is: ； Where Disp is the scheduling value; Emergency is the task urgency parameter, p1 is the weight coefficient of the task urgency; PeakTime is the peak time period parameter, p2 is the weight coefficient of the peak time period; ExecTime is the required execution time parameter, p3 is the weight coefficient of the required execution time; RespTime is the response time parameter, p4 is the weight coefficient of the response time; Resource is the required resource parameter, p5 is the weight coefficient of the required resource; a4: Dynamically adjust the task execution order and allocate computing resources; Count the dispatch values ​​Disp corresponding to all pending issuance tasks, sort all Disps, allocate resources to each pending issuance task in descending order of Disp values, and execute the pending issuance tasks; a5: Loop through steps a2 to a4; The cryptographic operation execution module deploys multiple cryptographic machines to participate in cryptographic operations, and through initial allocation, cryptographic operation execution and balancing operations, selects the optimal cryptographic machine to perform encryption and signature operations during the execution of the pending issuance task.

2. The electronic certificate rapid issuance system according to claim 1, characterized in that: The types of operations include: encryption, endorsing and signing; The issuance task types include: Type 1, Type 2 and Type 3; The electronic certificate issuance task of type 1 performs encryption and endorsement signature operations when issuing, wherein the encryption operation is completed once for all fields to be endorsed; The electronic certificate issuance task of type 2 performs encryption and endorsement signature operations when issuing, wherein the encryption operation is performed independently for each field to be endorsed; When issuing the electronic certificate of type three, encryption, signature and annotation signature operations are performed, wherein the encryption operation is performed independently for each field to be annotated and completed once for all annotated fields.

3. The electronic certificate rapid issuance system according to claim 1, characterized in that: The cryptographic operation execution module specifically includes the following operations: b1: Divide all cipher machines into two groups: primary cipher machines and backup cipher machines; The cryptographic operation execution module calls the main cryptographic machine to provide cryptographic operations for the electronic certificate issuance task; only when all the main cryptographic machines have abnormalities, the backup cryptographic machine is called to perform cryptographic operations; b2: initialization; Set the working state of the main cipher machine to normal, set the working state of the backup cipher machine to normal; set cipher machine parameters for all cipher machines, and set the initial values ​​of all cipher machine parameters to 0; The working status includes: normal and abnormal; when the working status is normal, it means that the cipher machine is available, and when the working status is abnormal, it means that the cipher machine is unavailable; The cryptographic machine parameters include: the load Pload of the previous time period, the current load Cload, and the number of failures Pfail of the previous time period; b3: receiving the pending issuance task sent by the task scheduling module, and requesting the cipher machine to perform a cryptographic operation for the pending issuance task; b4: The number n of master cipher machines that are confirmed to be in normal working state; If n=0, execute step b5; at the same time, start the cipher machine maintenance program for the main cipher machine; Otherwise, execute b6; b5: Determine the number m of backup cipher machines that are in normal working state; If m=0, an error is reported and the cipher machine maintenance program is started for all cipher machines; Otherwise, execute b6; b6: If the number of cipher machines in normal working state is 1, set the cipher machine as the cipher machine to be executed and go to step b8; If the number of cipher machines in normal working state is greater than 1, execute step b7; b7: Confirm the number of cipher machines with the smallest Pload value among the cipher machines in normal working status, min_n; If min_n = 1, set it as the cipher machine to be executed and execute step b8; Otherwise, if min_n>1, randomly select one of the cipher machines with the smallest Pload value and set it as the cipher machine to be executed, and execute step b8; b8: Using the cryptographic machine to be executed, perform the encryption or signing operation of the pending issuance task, and determine the result of the cryptographic operation execution; If the execution result is successful, the value of the current load Cload of the cipher machine is increased by 1; Otherwise, if the execution result is failure, the value of the number of failures Pfail in the previous time period of the cipher machine is increased by 1, and step b9 is executed; b9: Compare Pfail with the preset failure threshold; If Pfail>the preset failure threshold, the working state of the cipher machine is set to abnormal; and steps b4 to b8 are executed in a loop; Otherwise, loop through steps b4 to b8.

4. The electronic certificate rapid issuance system according to claim 3, characterized in that: The cryptographic operation execution module also includes a load balancing operation; The load balancing operation includes the following steps: c1: Set the polling period and start the scheduled task; c2: Based on the timed task, poll all the master cipher machines to query the difference td between the current time of the master cipher machine and the time of the last execution failure; If td is less than the preset failure interval threshold, execute step c3; Otherwise, execute step c4; c3: assign the current load Cload value of each master cipher machine to the load Pload of the previous time period; Set the current load Cload of each master cipher machine to 0; maintain the value of Pfail; end this polling; c4: assigning the current load Cload value of each master cipher machine to the load Pload of the previous time period; The current load Cload of each master cipher machine is set to 0; Pfail is set to 0; and the polling is ended.

5. The electronic certificate rapid issuance system according to claim 1, characterized in that: The cryptographic operation execution module also includes an abnormal cryptographic machine troubleshooting operation; The abnormal cipher machine troubleshooting operation is as follows: setting a polling cycle, polling the working status of all cipher machines based on a scheduled task, and starting the cipher machine maintenance program for all cipher machines with abnormal working status.

6. The electronic certificate rapid issuance system according to claim 5, characterized in that: The cipher machine maintenance procedure is as follows: Start the automatic maintenance program or manual maintenance program for the cipher machine with abnormal working status; for the cipher machine after the maintenance is completed, restore its cipher machine parameters to 0 and set the working status to: normal.

7. The electronic certificate rapid issuance system according to claim 1, characterized in that: It also includes: an exception monitoring and fault recovery module, which uses the status monitoring module to monitor the execution of task exceptions in real time during the execution of the pending issuance task, generate exception reports and record logs; design automatic recovery strategies and task retry mechanisms, and provide manual intervention mechanisms for faults that cannot be automatically recovered.

8. The electronic certificate rapid issuance system according to claim 7, characterized in that: The state monitoring module communicates with the task execution engine in the task scheduling module in real time through a heartbeat mechanism or a polling method.

Images