A distributed authorization management system, method and related products

Abstract

The application provides a distributed authorization management system, method and related product, and relates to the technical field of distribution.The system comprises a dynamic port management module and a seed node selection module, wherein the dynamic port management module is used for randomly selecting a port for a first node as the port corresponding to the first node in response to the start of the first node, the first node being a node not recorded on a node table, sending the port corresponding to the first node through a broadcast interface, and recording the port corresponding to the first node to the node table through the broadcast interface by other nodes except the first node; the seed node selection module is used for detecting a seed node by using a broadcast interface in response to the start of a second node, joining the seed node if the seed node is detected, and determining the second node as the seed node and listening to the request of the seed node if the seed node is not detected. In this way, the effect of management authorization can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of distributed technology, and particularly relates to a distributed authorization management system and method and related products. BACKGROUND

[0002] In the traditional network authorization management, the authorization control usually depends on the center server. However, if the center server is down, the whole authorization system cannot work normally; a special server configuration and maintenance are needed, which increases the deployment and operation and maintenance cost; and with the expansion of the network scale, the performance bottleneck of the center server gradually appears. Therefore, the effect of using the center server to manage authorization in the prior art is poor.

[0003] In summary, if the effect of managing authorization is a problem to be solved by those skilled in the art. SUMMARY

[0004] Therefore, the present application provides a distributed authorization management system and method and related products, which aims to improve the effect of managing authorization.

[0005] In a first aspect, the present application provides a distributed authorization management system, comprising:

[0006] a dynamic port management module and a seed node selection module;

[0007] The dynamic port management module is configured to randomly select a port for a first node as a port corresponding to the first node in response to the start of the first node; the first node is a node not recorded in a node table; the port corresponding to the first node is sent through a broadcast interface; and the port corresponding to the first node is recorded in the node table by other nodes except the first node through the broadcast interface;

[0008] The seed node selection module is configured to detect a seed node by using the broadcast interface in response to the start of a second node; if the seed node is detected, the second node joins the seed node; and if the seed node is not detected, the second node is determined as the seed node and listens to a request of the seed node.

[0009] Optionally, the seed node selection module is further configured to:

[0010] periodically check the availability of the seed node;

[0011] trigger a seed node election mechanism in response to checking that the seed node is invalid;

[0012] select the seed node according to the seed node election mechanism.

[0013] Optionally, the system further comprises:

[0014] a gossip state synchronization module;

[0015] The gossip state synchronization module is configured to randomly select a fourth node from the third node and send a state update request to the fourth node; the fourth node is a node other than the third node; in response to the state update request, send the node state of the fourth node to the third node; and merge and update the node states of the third node and the fourth node in the local authorization pool.

[0016] Optionally, the gossip state synchronization module is specifically configured to:

[0017] periodically generate an authorization state for the third node to obtain an authorization state of the third node;

[0018] send the state update request to the fourth node;

[0019] receive the authorization state of the fourth node sent by the fourth node;

[0020] if the authorization state of the third node conflicts with the authorization state of the fourth node, resolve the conflict according to a time stamp priority principle;

[0021] merge and update the authorization state of the third node and the authorization state of the fourth node in the local authorization pool.

[0022] Optionally, the system further comprises:

[0023] a security authentication module;

[0024] The security authentication module is configured to generate an AES session key for a fifth node; send the AES session key to a sixth node; the sixth node is a node other than the fifth node; if an encrypted channel between the fifth node and the sixth node has been established, generate communication data using the fifth node; control the fifth node to sign the communication data using a private key of the fifth node; send the signature and the communication data to the sixth node; control the sixth node to verify the signature using a public key of the fifth node; if the signature verification is passed, indicate that the communication data integrity verification is passed; if the signature verification is not passed, indicate that the communication data is tampered with, and the communication data integrity verification is not passed.

[0025] Optionally, the security authentication module is further configured to:

[0026] if the encrypted channel between the fifth node and the sixth node has not been established, control the fifth node to encrypt the AES session key using a public key of the sixth node;

[0027] The sixth node is controlled to decrypt the AES session key with a private key of the sixth node to establish an encrypted channel.

[0028] Optionally, the system further comprises:

[0029] a fault recovery module;

[0030] The fault recovery module is configured to read a local state snapshot and an operation log of the seventh node in response to a shutdown of the seventh node, to recover the seventh node.

[0031] The recovered seventh node is re-joined in the distributed network.

[0032] The recovered seventh node is synchronized with other nodes in state.

[0033] In a second aspect, the present application provides a distributed authorization management method, comprising:

[0034] In response to a start of a first node, a port is randomly selected for the first node as a corresponding port of the first node; the first node is a node not recorded in a node table;

[0035] The corresponding port of the first node is sent through a broadcast interface;

[0036] Other nodes except the first node record the corresponding port of the first node in the node table through the broadcast interface;

[0037] In response to a start of a second node, a seed node is detected by using the broadcast interface;

[0038] If the seed node is detected, the second node is joined in the seed node; if the seed node is not detected, the second node is determined as a seed node and listens to a request of a seed node.

[0039] Optionally, the method further comprises:

[0040] The availability of the seed node is periodically checked;

[0041] In response to a check that the seed node is invalid, a seed node election mechanism is triggered;

[0042] The seed node is selected according to the seed node election mechanism.

[0043] Optionally, the method further comprises:

[0044] a Gossip state synchronization module;

[0045] randomly selecting a fourth node from the third node and sending a state update request to the fourth node; the fourth node is a node other than the third node;

[0046] sending the node state of the fourth node to the third node in response to the state update request;

[0047] merging the node states of the third node and the fourth node and updating the local authorization pool.

[0048] Optionally, the method further comprises:

[0049] generating an authorization state of the third node periodically to obtain an authorization state of the third node;

[0050] sending the state update request to the fourth node;

[0051] receiving the authorization state of the fourth node sent by the fourth node;

[0052] if the authorization state of the third node conflicts with the authorization state of the fourth node, resolving the conflict according to a time stamp priority principle;

[0053] merging the authorization state of the third node and the authorization state of the fourth node and updating the local authorization pool.

[0054] Optionally, the method further comprises:

[0055] generating an AES session key for a fifth node;

[0056] sending the AES session key to a sixth node; the sixth node is a node other than the fifth node;

[0057] if an encrypted channel between the fifth node and the sixth node has been established, generating communication data by using the fifth node;

[0058] controlling the fifth node to sign the communication data by using a private key of the fifth node;

[0059] sending the signature and the communication data to the sixth node;

[0060] controlling the sixth node to verify the signature by using a public key of the fifth node;

[0061] if the signature verification is passed, indicating that the communication data integrity verification is passed;

[0062] if the signature verification is not passed, indicating that the communication data is tampered and the communication data integrity verification is not passed.

[0063] Optionally, the method further comprises:

[0064] if the fifth node and the sixth node do not establish the encrypted channel, controlling the fifth node to encrypt the AES session key with the public key of the sixth node;

[0065] controlling the sixth node to decrypt the AES session key with the private key of the sixth node to establish the encrypted channel.

[0066] Optionally, the method further comprises:

[0067] in response to a failure of a seventh node, reading a local state snapshot and an operation log of the seventh node to recover the seventh node;

[0068] rejoining the recovered seventh node into the distributed network;

[0069] synchronizing the recovered seventh node with other nodes.

[0070] In a third aspect, an embodiment of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, the distributed authorization management method as introduced in any of the embodiments of the second aspect of the present application is implemented.

[0071] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device performs the distributed authorization management method as introduced in any of the embodiments of the second aspect of the present application.

[0072] The present application provides a distributed authorization management system. The system comprises a dynamic port management module and a seed node selection module, wherein the dynamic port management module is configured to randomly select a port for a first node as a port corresponding to the first node in response to the start of the first node, the first node being a node not recorded in a node table, and the first node sends the port corresponding to the first node through a broadcast interface, and other nodes except the first node record the port corresponding to the first node in the node table through the broadcast interface; the seed node selection module is configured to detect a seed node through a broadcast interface in response to the start of a second node, and if the seed node is detected, the second node joins the seed node, and if the seed node is not detected, the second node is determined as the seed node and listens to a request of the seed node. In this way, the effect of management authorization can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0073] In order to more clearly illustrate the technical solutions in the embodiments or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0074] Figure 1 A structural schematic diagram of a distributed authorization management system is provided for the embodiments of the present application.

[0075] Figure 2 A flowchart of a new seed election method is provided for the embodiments of the present application.

[0076] Figure 3 A flowchart of a state synchronization method is provided for the embodiments of the present application.

[0077] Figure 4 A flowchart of a security authentication method is provided for the embodiments of the present application.

[0078] Figure 5 A structural schematic diagram of a computer device is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0079] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the accompanying drawings in the embodiments of the present application. The distributed authorization management system, method and related products provided by the present application are used in the field related to distributed technology. The above are only examples, and do not limit the application field of the method and system provided by the present application.

[0080] In the traditional network authorization management, the authorization control usually depends on the center server. However, if the center server is down, the whole authorization system cannot work normally; special server configuration and maintenance are needed, which increases the deployment and operation and maintenance cost; with the expansion of the network scale, the performance bottleneck of the center server gradually appears. Therefore, the effect of using the center server to manage authorization in the prior art is not good.

[0081] The inventor proposes the technical scheme of the application through research. The distributed authorization management system comprises a dynamic port management module and a seed node selection module. The dynamic port management module is configured to randomly select a port for a first node as a port corresponding to the first node in response to the start of the first node, the first node being a node not recorded in a node table, and send the port corresponding to the first node through a broadcast interface, and other nodes except the first node record the port corresponding to the first node in the node table through the broadcast interface. The seed node selection module is configured to detect a seed node through a broadcast interface in response to the start of a second node, and if the seed node is detected, join the seed node, and if the seed node is not detected, determine the second node as the seed node and listen to a request of the seed node. In this way, the effect of management authorization can be improved.

[0082] In order to enable personnel in the technical field to better understand the scheme of the application, the application will be further described in detail below in combination with the drawings and specific embodiments. Obviously, the described embodiments are only some of the embodiments of the application, but not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application. It should be noted that, for the convenience of description, only the parts related to the application are shown in the drawings. The embodiments in the application and the features in the embodiments can be combined with each other without conflict.

[0083] Reference is made to Figure 1 , Figure 1 An embodiment of the application provides a structure schematic diagram of a distributed authorization management system. The distributed authorization management system 100 comprises:

[0084] The dynamic port management module 110, the seed node selection module 120, the Gossip state synchronization module 130, the security authentication module 140 and the fault recovery module 150.

[0085] The dynamic port management module 110 is configured to execute the following method:

[0086] In response to the start of a first node, a port is randomly selected for the first node as a port corresponding to the first node, the first node being a node not recorded in a node table, and the port corresponding to the first node is sent through a UDP broadcast interface, and other nodes except the first node receive the port corresponding to the first node through the broadcast interface, and record the port corresponding to the first node in the node table.

[0087] The seed node selection module 120 is configured to execute the following method:

[0088] In response to the start of the second node, the seed node is probed by using the broadcast interface. If the seed node is probed, the seed node is joined; if the seed node is not probed, the second node is determined as the seed node and the seed node request is listened to.

[0089] In addition, the seed node selection module 120 can also be used to elect a new seed node, as shown in Figure 2 Figure 2 A flowchart of a new seed election method provided by the embodiment of the application, comprising:

[0090] S201: In response to the failure of the seed node, the seed node selection mechanism is triggered.

[0091] All seed nodes periodically detect the availability of the current seed node. If communication with the seed node cannot be established within a certain time, the current seed node is determined to be failed. In response to the failure of the seed node, the seed node selection mechanism is triggered.

[0092] S202: According to the seed node selection mechanism, a new seed node is selected.

[0093] Firstly, each node will inform all nodes in the network that the current seed node has failed by broadcast or multicast, and request to initiate new seed node election.

[0094] Then, all nodes will decide whether to participate in the election according to the following criteria:

[0095] (1) Survival time: nodes with longer online time can participate in the election preferentially.

[0096] (2) Authorized pool state: nodes with more authorized pool information can be candidate nodes.

[0097] (3) Network quality: nodes with low delay and high bandwidth are more likely to become seed nodes.

[0098] Specifically, the election process of the seed node is as follows: first, the node evaluates the weight according to its own state, which includes but is not limited to survival time, load, etc., then other nodes vote according to the situation of each candidate node, and the node with the highest votes is determined as the seed node. If there is a tie in voting, the node with the smallest delay is selected as the new seed node.

[0099] After the new seed node is determined, the new seed node will notify all nodes in the network by broadcast or multicast that it becomes the new seed node. After receiving the announcement of the new seed node, all nodes immediately stop trying to contact the failed seed node, and switch to the new seed node for subsequent communication and management.

[0100] ​S203: Continuously detect new seed nodes.

[0101] The new seed node periodically sends a heartbeat packet to other nodes to ensure its health status. If the new seed node also fails, the election mechanism is retriggered to ensure system high availability.

[0102] The Gossip state synchronization module 130 is used to execute the following method:

[0103] The Gossip protocol is generally a protocol for propagating state based on the exchange of information between nodes, each node exchanges information with its randomly selected neighbor node until all nodes in the entire network reach an agreement. This protocol can be used to propagate state, event or update information, and is widely used in distributed systems. Its characteristics are decentralization, no leadership and high fault tolerance.

[0104] In the embodiments provided in the present application, the following features are included on the basis of the standard Gossip protocol:

[0105] (1) Each node periodically exchanges authorization state with a random node to ensure that the state of all nodes is as consistent as possible.

[0106] (2) When two nodes exchange states, they may find that their state information conflicts. At this time, the conflict is resolved by a time stamp priority strategy, that is, the newer authorization state is accepted first.

[0107] (3) In some cases, the state conflict between multiple nodes may be complex. At this time, the system determines which state is correct by the state of the majority of nodes.

[0108] As shown in Figure 3 , a flowchart of a state synchronization method provided in an embodiment of the present application includes: Figure 3

[0109] S301: Randomly select a fourth node.

[0110] Each node periodically generates its own local authorization state, such as whether it is authorized, the number of authorizations, etc., and sends it to a random node in the network. This random node is generally selected through the neighbor nodes in the Gossip network to ensure the rapid propagation of information in the network. In this embodiment, the third node is regarded as the own node, and the fourth node is regarded as the random node selected by the own node.

[0111] S302: Send the local authorization state to the fourth node.

[0112] The third node sends the local authorization state to the fourth node.

[0113] ​S303: Send the local authorization status to the third node.

[0114] In response to receiving the local authorization status sent by the third node on the large screen, the fourth node sends the local authorization status back to the third node.

[0115] S304: Merge the local authorization states of the third and fourth nodes and update the local authorization pool.

[0116] Upon receiving an update request, the node first compares its local authorization status with the authorization status in the request. If there are differences, the node will choose to update its own authorization status based on the timestamp priority principle.

[0117] If a node detects a conflict, it selects the authorization state with the larger timestamp as the priority. Furthermore, if timestamps are the same, the node will decide which authorization state to use based on the majority consensus mechanism, i.e., choosing the state consistent with the majority of nodes. After the conflict is resolved, the node merges the newly received authorization states. If multiple states are updated, it categorizes and merges these states, ultimately selecting the optimal one.

[0118] In addition, after updating its local state, the node will continue to broadcast the updated state to other random nodes to ensure that the information is spread as widely as possible in the network until all nodes have the same state.

[0119] Security authentication module 140 is used to perform the following methods, such as Figure 4 As shown, Figure 4 A flowchart of a security authentication method provided in this application embodiment includes:

[0120] S401: Generate AES session key.

[0121] The advantage of symmetric encryption is that it uses the same key for both encryption and decryption, resulting in relatively low computational and resource consumption. By generating a new AES session key before each communication, the security of previous communications is not affected even if the key is exposed after a period of time.

[0122] When the fifth and sixth nodes first establish communication, the fifth node generates an AES session key, which is used to encrypt data in subsequent communications. The AES session key is typically a randomly generated symmetric key, and its length depends on the chosen encryption strength. This session key is used only for communication between a single pair of nodes; different nodes will use different session keys for communication.

[0123] S402: Send the AES session key to the sixth node.

[0124] The fifth node sends the AES session key to the sixth node.

[0125] S403: Determine whether an encrypted channel is established between the fifth node and the sixth node.

[0126] Determine whether an encrypted channel is established between the fifth node and the sixth node. If not, execute the implementation in step S404; if yes, execute the implementation in step S407.

[0127] S404: Encrypt the AES session key with the public key of the sixth node.

[0128] The transmission of the session key is protected by public key encryption, ensuring that even if the transmission process is eavesdropped, the attacker cannot obtain the session key. The security of public key encryption relies on the secrecy of the private key, only the node holding the private key can decrypt the key, ensuring that only the legitimate recipient can decrypt the communication key.

[0129] The fifth node encrypts the AES session key with the public key of the sixth node. This encrypted session key cannot be cracked by any means other than the public key, and only the sixth node can decrypt it.

[0130] S405: Send the encrypted AES session key to the sixth node.

[0131] The fifth node sends the encrypted AES session key to the sixth node.

[0132] S406: Decrypt the AES session key with the private key of the sixth node.

[0133] The sixth node decrypts the AES session key with its own private key to build an encrypted channel between the fifth node and the sixth node.

[0134] S407: Generate communication data.

[0135] The fifth node generates communication data.

[0136] S408: Sign the communication data with the private key of the fifth node.

[0137] During the transmission of the data, each data packet needs to be digitally signed, i.e. the sender signs the data with the private key, ensuring that the recipient can verify the source and integrity of the data. That is, the fifth node signs the communication data with its own private key to obtain signed data.

[0138] S409: Send the communication data and signature to the sixth node.

[0139] The fifth node sends the signed data and communication data to the sixth node.

[0140] S410: Verify the signature using the fifth node's public key.

[0141] The sixth node uses the fifth node's public key to verify the signature. If the signature verification passes, it indicates that the integrity of the communication data has been verified. If the signature verification fails, it indicates that the communication data has been tampered with and the integrity of the communication data has failed.

[0142] In the embodiments provided in this application, the distributed authorization management system includes a dynamic port management module and a seed node selection module. The dynamic port management module, in response to the startup of a first node, randomly selects a port for the first node (which is not recorded in the node table). The port is then broadcast through a broadcast interface, and other nodes, excluding the first node, record the corresponding port in their node tables via the same broadcast interface. The seed node selection module, in response to the startup of a second node, uses a broadcast interface to detect seed nodes. If a seed node is detected, it is added to the list of seed nodes; otherwise, the second node is designated as a seed node, and the system listens for seed node requests. This improves the effectiveness of authorization management.

[0143] This application also provides corresponding devices and computer storage media for implementing the solutions provided in this application.

[0144] like Figure 5 As shown, the computer device 01 is represented in the form of a general-purpose computing device. The components of the computer device 01 may include, but are not limited to: one or more processors or processing units 03, system memory 08, and bus 04 connecting different system components (including system memory 08 and processing unit 03).

[0145] Bus 04 represents one or more of several bus architectures, including memory buses or memory controllers, peripheral buses, graphics acceleration ports, processors, or local buses using any of the various bus architectures. Examples of these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0146] Computer device 01 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by computer device 01, including volatile and non-volatile media, removable and non-removable media.

[0147] System memory 08 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 09 and / or cache memory 10. Computer device 01 can further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 11 can be provided for reading from and writing to a non-removable, non-volatile magnetic media (not shown and typically called a "hard drive"). Figure 5 Although not shown, computer device 01 can further include a data repository 12 that stores sets of data 13 fetched or generated by computer device 01. Figure 5 Although not shown in the computer device 01, a disk drive can be provided to read from or write to a removable, non-volatile magnetic media (e.g., a "floppy drive" within the storage system 11). As with the disk drive case, each of the drives can be connected to the bus 04 by one or more data media interfaces. The memory 08 can include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the application.

[0148] Program / utility 12, having a set (at least one) of program modules 13, can be stored in memory 08 by way of example, such as an operating system, one or more application programs, other program modules, and program data, each or some combination thereof, may

[0149] Computer device 01 can also communicate with one or more external devices 02 such as a keyboard or a pointing device, a display 07, etc.; one or more devices that enable a user to interact with computer device 01; and / or one or more devices that enable computer device 01 to communicate with one or more other computing devices. Such communication can be via input / output (I / O) interfaces 06. Similarly, such Figure 5 communication can be enabled by a network adaptation 05. As will be appreciated by persons skilled in the art, a network adaptation 05 can include and / or interface with both analog and / or digital communication Figure 5 modems, etc. The network adaptation 05 will be discussed in more detail below in conjunction with the example of the computer device 01 as a network computer.

[0150] The processor unit 03 performs various function applications and data processing by running programs stored in the system memory 08, such as implementing a distributed authorization management method provided by the embodiments of the present application.

[0151] It should be noted that the relative terms such as first and second, and the like are used herein only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by an indefinite article "a" or "an" does not exclude the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0152] From the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment methods can be implemented by means of software plus a general hardware platform. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product. The computer software product can be stored in a storage medium, such as a read-only memory (English: read-only memory, ROM) / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in the various embodiments or some parts of the embodiments.

[0153] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the system embodiments, since they are basically similar to the method embodiments, they are described more simply, and the relevant parts can be referred to the part of the method embodiments. According to the actual needs, some or all of the modules can be selected to achieve the purpose of the embodiments. Those skilled in the art can understand and implement without creative labor.

[0154] The above description is only an exemplary embodiment of the present application, and is not intended to limit the protection scope of the present application.

Claims

1. A distributed authorization management system, characterized in that, The application relates to a dynamic port management module, a seed node selection module, a Gossip state synchronization module and a security authentication module. The dynamic port management module is used for randomly selecting a port for a first node as a corresponding port of the first node in response to the start of the first node; the first node is a node not recorded in a node table; The corresponding port of the first node is sent through a broadcast interface; other nodes except the first node record the corresponding port of the first node in the node table through the broadcast interface; The seed node selection module is used for detecting a seed node through the broadcast interface in response to the start of a second node; If the seed node is detected, the second node is added to the seed node; if the seed node is not detected, the second node is determined as the seed node and a seed node request is listened to; The Gossip state synchronization module is used for randomly selecting a fourth node by a third node and sending a state update request to the fourth node; The fourth node is a node other than the third node; the node state of the fourth node is sent to the third node in response to the state update request; The node states of the third node and the fourth node are combined and the local authorization pool is updated; The security authentication module is used for generating an AES session key for a fifth node; the AES session key is sent to a sixth node; The sixth node is a node other than the fifth node; if an encryption channel between the fifth node and the sixth node is established, communication data is generated by using the fifth node; the communication data is signed by the fifth node by using a private key of the fifth node; the signature and the communication data are sent to the sixth node; the sixth node verifies the signature by using a public key of the fifth node; if the signature verification is passed, the communication data integrity verification is passed; if the signature verification is not passed, the communication data is tampered, and the communication data integrity verification is not passed. The seed node selection module is further used for:

2. The system of claim 1, wherein, Periodically checking the availability of the seed node; Triggering a seed node election mechanism in response to checking that the seed node is invalid; Selecting the seed node according to the seed node election mechanism. The Gossip state synchronization module is specifically used for:

3. The system of claim 1, wherein, Periodically generating an authorization state for the third node to obtain the authorization state of the third node; Sending the state update request to the fourth node; Receiving the authorization state of the fourth node sent by the fourth node; If the authorization state of the third node conflicts with the authorization state of the fourth node, the conflict is solved according to a time stamp priority principle; The authorization state of the third node and the authorization state of the fourth node are combined and the local authorization pool is updated. The security authentication module is further used for:

4. The system of claim 1, wherein, If the encryption channel between the fifth node and the sixth node is not established, the AES session key is encrypted by the fifth node by using the public key of the sixth node. ​ The sixth node is controlled to decrypt the AES session key with a private key of the sixth node to establish an encrypted channel.

5. The system of claim 1, wherein, The system further comprises: a fault recovery module; The fault recovery module is configured to read a local state snapshot and an operation log of the seventh node to recover the seventh node in response to a shutdown of the seventh node; The recovered seventh node is re-added to a distributed network; The recovered seventh node is synchronized with other nodes.

6. A distributed authorization management method, characterized by, The method comprises: selecting a port for the first node randomly as a corresponding port of the first node in response to a start of the first node; The first node is a node not recorded in a node table; sending the corresponding port of the first node through a broadcast interface; recording the corresponding port of the first node to the node table by other nodes than the first node through the broadcast interface; detecting a seed node by the second node through the broadcast interface in response to a start of the second node; joining the seed node if the seed node is detected, and determining the second node as the seed node and listening for a seed node request if the seed node is not detected; selecting a fourth node randomly by the third node and sending a state update request to the fourth node; The fourth node is a node other than the third node; sending a node state of the fourth node to the third node in response to the state update request; merging and updating a local authorization pool with the node states of the third node and the fourth node; generating an AES session key for a fifth node; sending the AES session key to a sixth node; The sixth node is a node other than the fifth node; generating communication data by the fifth node if an encrypted channel between the fifth node and the sixth node is established; controlling the fifth node to sign the communication data with a private key of the fifth node; sending the signature and the communication data to the sixth node; controlling the sixth node to verify the signature with a public key of the fifth node; indicating that the communication data passes integrity verification if the signature verification passes; indicating that the communication data is tampered and the integrity verification of the communication data fails if the signature verification fails.

7. A computer device, comprising: The method comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the distributed authorization management method of claim 6 when executing the computer program.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores instructions, and when the instructions run on a terminal device, the terminal device executes the distributed authorization management method of claim 6.

Images