Distributed authorization management system and method and related products

Abstract

The invention provides a distributed authorization management system and method and a related product, and relates to the field of distributed technologies. The system comprises a dynamic port management module and a seed node selection module, the dynamic port management module is used for responding to starting of a first node, a port is randomly selected for the first node to serve as a port corresponding to the first node, the first node is a node which is not recorded on a node table, and the seed node selection module is used for selecting a seed node. A port corresponding to the first node is sent through a broadcast interface, and other nodes except the first node record the port corresponding to the first node into a node table through the broadcast interface; and the seed node selection module is used for responding to the starting of the second node, detecting the seed node by using the broadcast interface, if the seed node is detected, adding the seed node, and if the seed node is not detected, determining the second node as the seed node and monitoring the request of the seed node. In this way, the management authorization effect can be improved.

Description

Technical Field

[0001] The present application relates to the field of distributed technology, and in particular to a distributed authorization management system, method and related products. Background Art

[0002] In traditional network authorization management, authorization control usually relies on a central server. However, if the central server goes down, the entire authorization system cannot work properly; special server configuration and maintenance are required, which increases deployment and operation costs; as the network scale expands, the performance bottleneck of the central server gradually emerges. It can be seen that the effect of using a central server to manage authorization in the existing technology is not good.

[0003] In summary, improving the effect of management authorization is an issue that technical personnel in this field need to solve urgently. Summary of the invention

[0004] In view of this, the present application provides a distributed authorization management system, method and related products, aiming to improve the effect of managing authorization.

[0005] In a first aspect, the present application provides a distributed authorization management system, comprising:

[0006] Dynamic port management module and seed node selection module;

[0007] The dynamic port management module is used to randomly select a port for the first node in response to the startup of the first node as the port corresponding to the first node; the first node is a node not recorded in the node table; the port corresponding to the first node is sent through the broadcast interface; other nodes except the first node record the port corresponding to the first node in the node table through the broadcast interface;

[0008] The seed node selection module is used to detect the seed node using the broadcast interface in response to the startup of the second node; if the seed node is detected, the seed node is added; if the seed node is not detected, the second node is determined as a seed node and listens for seed node requests.

[0009] Optionally, the seed node selection module is further used for:

[0010] Regularly check the availability of seed nodes;

[0011] In response to detecting that the seed node is invalid, triggering a seed node election mechanism;

[0012] The seed node is selected according to the seed node election mechanism.

[0013] Optionally, the system further includes:

[0014] Gossip state synchronization module;

[0015] The Gossip state synchronization module is used to use the third node to randomly select a fourth node and send a status update request to the fourth node; the fourth node is a node other than the third node; in response to the status update request, the node state of the fourth node is sent to the third node; the node states of the third node and the fourth node are merged and the local authorization pool is updated.

[0016] Optionally, the Gossip state synchronization module is specifically used for:

[0017] Periodically generating an authorization status for the third node to obtain the authorization status of the third node;

[0018] Sending the status update request to the fourth node;

[0019] receiving an authorization status of the fourth node sent by the fourth node;

[0020] If the authorization status of the third node conflicts with the authorization status of the fourth node, resolving the conflict according to the timestamp priority principle;

[0021] The authorization status of the third node is merged with the authorization status of the fourth node and the local authorization pool is updated.

[0022] Optionally, the system further includes:

[0023] Security authentication module;

[0024] The security authentication module is used to generate an AES session key for the fifth node; send the AES session key to the sixth node; the sixth node is a node other than the fifth node; if the encryption channel between the fifth node and the sixth node has been established, use the fifth node to generate communication data; control the fifth node to sign the communication data with the private key of the fifth node; send the signature and the communication data to the sixth node; control the sixth node to verify the signature with the public key of the fifth node; if the signature verification passes, it indicates that the integrity verification of the communication data passes; if the signature verification fails, it indicates that the communication data has been tampered with and the integrity verification of the communication data fails.

[0025] Optionally, the security authentication module is further used to:

[0026] If the encryption channel between the fifth node and the sixth node is not established, controlling the fifth node to encrypt the AES session key with the public key of the sixth node;

[0027] The sixth node is controlled to decrypt the AES session key using the private key of the sixth node to establish an encryption channel.

[0028] Optionally, the system further includes:

[0029] Fault recovery module;

[0030] The fault recovery module is used to read the local state snapshot and operation log of the seventh node in response to the downtime of the seventh node, so as to recover the seventh node;

[0031] Re-adding the restored seventh node to the distributed network;

[0032] The restored seventh node is synchronized with other nodes.

[0033] In a second aspect, the present application provides a distributed authorization management method, including:

[0034] In response to the startup of the first node, randomly selecting a port for the first node as the port corresponding to the first node; the first node is a node not recorded in the node table;

[0035] Send the port corresponding to the first node through the broadcast interface;

[0036] The other nodes except the first node record the port corresponding to the first node into the node table through the broadcast interface;

[0037] In response to the startup of the second node, detecting a seed node using the broadcast interface;

[0038] If the seed node is detected, the seed node is added; if the seed node is not detected, the second node is determined as the seed node and the seed node request is listened.

[0039] Optionally, the method further includes:

[0040] Regularly check the availability of seed nodes;

[0041] In response to detecting that the seed node is invalid, triggering a seed node election mechanism;

[0042] The seed node is selected according to the seed node election mechanism.

[0043] Optionally, the method further includes:

[0044] Gossip state synchronization module;

[0045] Using the third node to randomly select a fourth node and send a status update request to the fourth node; the fourth node is a node other than the third node;

[0046] In response to the status update request, sending the node status of the fourth node to the third node;

[0047] The node states of the third node and the fourth node are merged and the local authorization pool is updated.

[0048] Optionally, the method further includes:

[0049] Periodically generating an authorization status for the third node to obtain the authorization status of the third node;

[0050] Sending the status update request to the fourth node;

[0051] receiving an authorization status of the fourth node sent by the fourth node;

[0052] If the authorization status of the third node conflicts with the authorization status of the fourth node, resolving the conflict according to the timestamp priority principle;

[0053] The authorization status of the third node is merged with the authorization status of the fourth node and the local authorization pool is updated.

[0054] Optionally, the method further includes:

[0055] generating an AES session key for the fifth node;

[0056] Sending the AES session key to a sixth node; the sixth node is a node other than the fifth node;

[0057] If the encryption channel between the fifth node and the sixth node has been established, generating communication data using the fifth node;

[0058] Controlling the fifth node to sign the communication data using the private key of the fifth node;

[0059] Sending the signature and the communication data to the sixth node;

[0060] Controlling the sixth node to verify the signature using the public key of the fifth node;

[0061] If the signature verification is passed, it indicates that the communication data integrity verification is passed;

[0062] If the signature verification fails, it indicates that the communication data has been tampered with and the integrity verification of the communication data fails.

[0063] Optionally, the method further includes:

[0064] If the encryption channel between the fifth node and the sixth node is not established, controlling the fifth node to encrypt the AES session key with the public key of the sixth node;

[0065] The sixth node is controlled to decrypt the AES session key using the private key of the sixth node to establish an encryption channel.

[0066] Optionally, the method further includes:

[0067] In response to the seventh node being down, reading a local state snapshot and an operation log of the seventh node to restore the seventh node;

[0068] Re-adding the restored seventh node to the distributed network;

[0069] The restored seventh node is synchronized with other nodes.

[0070] In a third aspect, an embodiment of the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the distributed authorization management method described in any one of the implementation methods in the second aspect of the embodiment of the present application.

[0071] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes a distributed authorization management method as described in any one of the implementation methods in the second aspect of the embodiment of the present application.

[0072] The present application provides a distributed authorization management system. The system includes a dynamic port management module and a seed node selection module, wherein the dynamic port management module is used to randomly select a port for the first node in response to the startup of the first node as the port corresponding to the first node, the first node is a node not recorded in the node table, and the port corresponding to the first node is sent through the broadcast interface. Other nodes except the first node record the port corresponding to the first node in the node table through the broadcast interface; the seed node selection module is used to detect the seed node using the broadcast interface in response to the startup of the second node. If the seed node is detected, the seed node is added. If the seed node is not detected, the second node is determined as a seed node and the seed node request is monitored. In this way, the effect of management authorization can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0074] Figure 1 A schematic diagram of the structure of a distributed authorization management system is provided for an embodiment of the present application;

[0075] Figure 2 A flowchart of a new seed election method provided in an embodiment of the present application;

[0076] Figure 3 A flowchart of a state synchronization method provided in an embodiment of the present application;

[0077] Figure 4 A flowchart of a security authentication method provided in an embodiment of the present application;

[0078] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0079] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. The present application provides a distributed authorization management system, method and related products for use in the field of distributed technology. The above is only an example and does not limit the application field of the method and system name provided by the present application.

[0080] In traditional network authorization management, authorization control usually relies on a central server. However, if the central server goes down, the entire authorization system cannot work properly; special server configuration and maintenance are required, which increases deployment and operation costs; as the network scale expands, the performance bottleneck of the central server gradually emerges. It can be seen that the effect of using a central server to manage authorization in the existing technology is not good.

[0081] After research, the inventor proposed the technical solution of this application. The distributed authorization management system includes a dynamic port management module and a seed node selection module, wherein the dynamic port management module is used to randomly select a port for the first node in response to the startup of the first node as the port corresponding to the first node, the first node is a node not recorded in the node table, and the port corresponding to the first node is sent through the broadcast interface. The other nodes except the first node record the port corresponding to the first node in the node table through the broadcast interface; the seed node selection module is used to detect the seed node using the broadcast interface in response to the startup of the second node. If the seed node is detected, the seed node is added. If the seed node is not detected, the second node is determined as a seed node and the seed node request is monitored. In this way, the effect of management authorization can be improved.

[0082] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. It should be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0083] See also Figure 1 , Figure 1 A schematic diagram of the structure of a distributed authorization management system is provided for an embodiment of the present application. The distributed authorization management system 100 includes:

[0084] Dynamic port management module 110 , seed node selection module 120 , Gossip state synchronization module 130 , security authentication module 140 and fault recovery module 150 .

[0085] The dynamic port management module 110 is used to execute the following method:

[0086] In response to the startup of the first node, a port is randomly selected for the first node as the port corresponding to the first node. The first node is a node not recorded in the node table. The port corresponding to the first node is sent through the UDP broadcast interface. Other nodes except the first node receive the port corresponding to the first node through the broadcast interface, and the port corresponding to the first node is recorded in the node table.

[0087] The seed node selection module 120 is used to perform the following method:

[0088] In response to the start-up of the second node, the seed node is detected using the broadcast interface. If the seed node is detected, the seed node is added; if the seed node is not detected, the second node is determined as the seed node and the seed node request is monitored.

[0089] In addition, the seed node selection module 120 can also be used to elect new seed nodes, such as Figure 2 As shown, Figure 2 A flowchart of a new seed election method provided in an embodiment of the present application includes:

[0090] S201: In response to a seed node failure, a seed node selection mechanism is triggered.

[0091] All seed nodes periodically check the availability of the current seed node. If communication with the seed node cannot be established within a certain period of time, the current seed node is deemed to be invalid. In response to the failure of the seed node, the seed node selection mechanism is triggered.

[0092] S202: Select a new seed node according to the seed node selection mechanism.

[0093] First, each node will inform all nodes in the network through broadcast or multicast that the current seed node has expired and request to initiate a new seed node election.

[0094] Then, all nodes will decide whether to participate in the election based on the following criteria:

[0095] (1) Survival time: Nodes with a longer online time can participate in the election first.

[0096] (2) Authorization pool status: Nodes with more authorization pool information can be used as candidate nodes.

[0097] (3) Network quality: Nodes with low latency and high bandwidth are more likely to become seed nodes.

[0098] Specifically, the seed node election process is as follows: First, the node evaluates its own weight based on its own status, which includes but is not limited to survival time, load, etc. Then other nodes vote based on the status of each candidate node, and the node with the highest votes is determined as the seed node. If multiple nodes vote in a tie, the node with the smallest delay is selected as the new seed node.

[0099] When a new seed node is determined, the new seed node will notify all nodes in the network through broadcast or multicast, announcing itself as the new seed node. After receiving the announcement of the new seed node, all nodes immediately stop trying to contact the failed seed node and switch to the new seed node for subsequent communication and management.

[0100] S203: Continue to detect new seed nodes.

[0101] The new seed node will periodically send heartbeat packets to other nodes to ensure their health. If the new seed node also fails, the election mechanism will be re-triggered to ensure high availability of the system.

[0102] The Gossip state synchronization module 130 is used to execute the following method:

[0103] The Gossip protocol is usually a protocol that propagates states based on exchanging information between nodes. Each node exchanges information with its randomly selected neighbor nodes until all nodes in the entire network reach a consensus. This protocol can be used to propagate states, events, or update information, and is widely used in distributed systems. It is characterized by decentralization, no leader, and high fault tolerance.

[0104] In the embodiments provided in this application, based on the standard Gossip protocol, the following features are also included:

[0105] (1) Each node periodically exchanges authorization status with a random node to ensure that the status of all nodes is as consistent as possible.

[0106] (2) When two nodes exchange states, they may find that their state information conflicts. In this case, the conflict is resolved by using a timestamp-first strategy, that is, the newer authorized state is accepted first.

[0107] (3) In some cases, the state conflicts between multiple nodes may be complicated. In this case, the system will determine which state is correct based on the states of the majority of nodes.

[0108] like Figure 3 As shown, Figure 3 A flowchart of a state synchronization method provided in an embodiment of the present application includes:

[0109] S301: Randomly select a fourth node.

[0110] Each node periodically generates a copy of its own local authorization status, such as whether it is authorized, the number of authorizations, etc., and sends it to a random node in the network. This random node is generally selected by the neighboring nodes in the Gossip network to ensure the rapid propagation of information in the network. In this embodiment, the third node is regarded as its own node, and the fourth node is regarded as a random node selected by its own node.

[0111] S302: Send the local authorization status to the fourth node.

[0112] The third node sends the local authorization status to the fourth node.

[0113] S303: Send the local authorization status to the third node.

[0114] In response to receiving the local authorization status sent by the large-screen third node, the fourth node sends the local authorization status to the third node.

[0115] S304: Merge the local authorization states of the third node and the fourth node, and update the local authorization pool.

[0116] The node that receives the update request will first compare its local authorization status with the authorization status in the request. If they differ, the node will choose to update its own authorization status based on the timestamp priority principle.

[0117] If a node finds a conflict, it will choose the authorization state with the larger update timestamp based on the principle of timestamp priority. In addition, if the timestamps are the same, the node will decide which authorization state to use based on the majority consensus mechanism, that is, choose the state that is consistent with the majority of nodes. After the conflict is resolved, the node will merge the newly received authorization state. If there are multiple state updates, it will classify and merge these states and finally select the best state.

[0118] In addition, after updating the local state, the node will continue to broadcast the updated state to other random nodes to ensure that the information is spread as widely as possible in the network until the state of all nodes is consistent.

[0119] The security authentication module 140 is used to execute the following method: Figure 4 As shown, Figure 4 A flowchart of a security authentication method provided in an embodiment of the present application includes:

[0120] S401: Generate an AES session key.

[0121] The advantage of symmetric encryption is that the same key is used for encryption and decryption, so the computation and resource consumption is relatively small. By generating a new AES session key before each communication, even if the key is exposed after a period of time, it will not affect the security of previous communications.

[0122] That is, when the fifth node and the sixth node establish communication for the first time, the fifth node generates an AES session key, which is used to encrypt data in subsequent communications. The AES session key is usually a randomly generated symmetric key, and its length depends on the selected encryption strength. The session key is only used for communication between a pair of nodes, and different nodes will use different session keys for communication.

[0123] S402: Send the AES session key to the sixth node.

[0124] The fifth node sends the AES session key to the sixth node.

[0125] S403: Determine whether an encrypted channel is established with the sixth node.

[0126] Determine whether an encrypted channel is established between the fifth node and the sixth node. If not, execute the implementation method in step S404; if yes, execute the implementation method in step S407.

[0127] S404: Encrypt the AES session key using the public key of the sixth node.

[0128] Public key encryption is used to protect the transmission of session keys, ensuring that even if the transmission process is eavesdropped, attackers cannot obtain the session keys. The security of public key encryption relies on the confidentiality of the private key. Only the node holding the private key can decrypt the key, ensuring that only the legitimate recipient can decrypt the communication key.

[0129] The fifth node uses the public key of the sixth node to encrypt the AES session key. This encrypted session key cannot be cracked by any means other than the public key, and only the sixth node can decrypt it.

[0130] S405: Send the encrypted AES session key to the sixth node.

[0131] The fifth node sends the encrypted AES session key to the sixth node.

[0132] S406: Decrypt the AES session key using the private key of the sixth node.

[0133] The sixth node decrypts the AES session key using its own private key to build an encrypted channel between the fifth node and the sixth node.

[0134] S407: Generate communication data.

[0135] The fifth node generates communication data.

[0136] S408: Use the private key of the fifth node to sign the communication data.

[0137] During the data transmission process, each data packet needs to be digitally signed, that is, the sender signs the data with a private key to ensure that the receiver can verify the source and integrity of the data. That is, the fifth node uses its own private key to sign the communication data and obtain the signed data.

[0138] S409: Send the communication data and signature to the sixth node.

[0139] The fifth node sends the signature data together with the communication data to the sixth node.

[0140] S410: Verify the signature using the public key of the fifth node.

[0141] The sixth node verifies the signature using the public key of the fifth node. If the signature verification passes, it indicates that the communication data integrity verification passes; if the signature verification fails, it indicates that the communication data has been tampered with and the communication data integrity verification fails.

[0142] In the embodiment provided by the present application, the distributed authorization management system includes a dynamic port management module and a seed node selection module, wherein the dynamic port management module is used to randomly select a port for the first node in response to the startup of the first node as the port corresponding to the first node, the first node is a node not recorded in the node table, and the port corresponding to the first node is sent through the broadcast interface, and other nodes except the first node record the port corresponding to the first node in the node table through the broadcast interface; the seed node selection module is used to detect the seed node using the broadcast interface in response to the startup of the second node, if the seed node is detected, then the seed node is added, if the seed node is not detected, then the second node is determined as a seed node and the seed node request is monitored. In this way, the effect of management authorization can be improved.

[0143] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.

[0144] like Figure 5 As shown, the computer device 01 is in the form of a general computing device. The components of the computer device 01 may include but are not limited to: one or more processors or processing units 03, a system memory 08, and a bus 04 connecting different system components (including the system memory 08 and the processing unit 03).

[0145] Bus 04 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0146] The computer device 01 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 01, including volatile and non-volatile media, removable and non-removable media.

[0147] The system memory 08 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 09 and / or cache memory 10. The computer device 01 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 11 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 04 via one or more data medium interfaces. The memory 08 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0148] A program / utility 12 having a set (at least one) of program modules 13 may be stored, for example, in the memory 08, such program modules 13 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may include an implementation of a network environment. The program modules 13 generally perform the functions and / or methods of the embodiments described herein.

[0149] The computer device 01 may also communicate with one or more external devices 02 (e.g., keyboard, pointing device, display 07, etc.), one or more devices that enable a user to interact with the computer device 01, and / or any device that enables the computer device 01 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed via input / output (I / O) interface 06. Furthermore, the computer device 01 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) via network adapter 05. Figure 5 As shown, the network adapter 05 communicates with other modules of the computer device 01 via the bus 04. It should be understood that although Figure 5 Not shown, other hardware and / or software modules may be used in conjunction with computer device 01, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0150] The processor unit 03 executes various functional applications and data processing by running programs stored in the system memory 08, for example, implementing a distributed authorization management method provided in an embodiment of the present application.

[0151] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0152] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0153] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0154] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A distributed authorization management system, characterized in that: include: Dynamic port management module and seed node selection module; The dynamic port management module is used to randomly select a port for the first node in response to the startup of the first node as the port corresponding to the first node; the first node is a node not recorded in the node table; Sending the port corresponding to the first node through a broadcast interface; other nodes except the first node record the port corresponding to the first node into the node table through the broadcast interface; The seed node selection module is used to detect the seed node using the broadcast interface in response to the start of the second node; If the seed node is detected, the seed node is added; if the seed node is not detected, the second node is determined as the seed node and the seed node request is listened.

2. The system according to claim 1, characterized in that The seed node selection module is also used for: Regularly check the availability of seed nodes; In response to detecting that the seed node is invalid, triggering a seed node election mechanism; The seed node is selected according to the seed node election mechanism.

3. The system according to claim 1, characterized in that The system further comprises: Gossip state synchronization module; The Gossip state synchronization module is used to use the third node to randomly select a fourth node and send a status update request to the fourth node; the fourth node is a node other than the third node; in response to the status update request, the node state of the fourth node is sent to the third node; the node states of the third node and the fourth node are merged and the local authorization pool is updated.

4. The system according to claim 3, characterized in that The Gossip state synchronization module is specifically used for: Periodically generating an authorization status for the third node to obtain the authorization status of the third node; Sending the status update request to the fourth node; receiving an authorization status of the fourth node sent by the fourth node; If the authorization status of the third node conflicts with the authorization status of the fourth node, resolving the conflict according to the timestamp priority principle; The authorization status of the third node is merged with the authorization status of the fourth node and the local authorization pool is updated.

5. The system according to claim 1, characterized in that The system further comprises: Security authentication module; The security authentication module is used to generate an AES session key for the fifth node; send the AES session key to the sixth node; the sixth node is a node other than the fifth node; if the encryption channel between the fifth node and the sixth node has been established, use the fifth node to generate communication data; control the fifth node to sign the communication data with the private key of the fifth node; send the signature and the communication data to the sixth node; control the sixth node to verify the signature with the public key of the fifth node; if the signature verification passes, it indicates that the integrity verification of the communication data passes; if the signature verification fails, it indicates that the communication data has been tampered with and the integrity verification of the communication data fails.

6. The system according to claim 5, characterized in that The security authentication module is also used for: If the encryption channel between the fifth node and the sixth node is not established, controlling the fifth node to encrypt the AES session key with the public key of the sixth node; The sixth node is controlled to decrypt the AES session key using the private key of the sixth node to establish an encryption channel.

7. The system according to claim 1, characterized in that The system further comprises: Fault recovery module; The fault recovery module is used to read the local state snapshot and operation log of the seventh node in response to the downtime of the seventh node, so as to recover the seventh node; Re-adding the restored seventh node to the distributed network; The restored seventh node is synchronized with other nodes.

8. A distributed authorization management method, characterized in that: include: In response to the startup of the first node, randomly selecting a port for the first node as the port corresponding to the first node; The first node is a node not recorded in the node table; Sending the port corresponding to the first node through the broadcast interface; The other nodes except the first node record the port corresponding to the first node into the node table through the broadcast interface; In response to the startup of the second node, detecting a seed node using the broadcast interface; If the seed node is detected, the seed node is added; if the seed node is not detected, the second node is determined as the seed node and the seed node request is listened.

9. A computer device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the distributed authorization management method as claimed in claim 8 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on the terminal device, the terminal device executes the distributed authorization management method as claimed in claim 8.

Images