Main node election method and device based on gPTP, terminal equipment and medium

Abstract

The invention relates to the technical field of time-sensitive networks, and discloses a gPTP-based main node election method and device, terminal equipment and a medium, and the method comprises the steps: obtaining digital certificates of all participating nodes, and carrying out the verification, so as to determine the validity of each digital certificate; taking participating nodes corresponding to the effective digital certificates as legal nodes, and generating an identity token of each legal node; inserting the identity token of each legal node into the announcement message by each legal node; and determining a master clock according to the declaration message of each legal node, and determining a master node according to the master clock. Through the election method of the digital certificate and the identity token, the reliability of the election result can be improved.

Description

Technical Field

[0001] The present application relates to the field of time-sensitive network technology, and in particular to a method, apparatus, terminal device and medium for selecting a master node based on gPTP. Background Art

[0002] Time-Sensitive Networking (TSN) is a network technology designed to meet the needs of real-time applications and aims to provide high-reliability and low-latency data transmission. TSN ensures that the clocks of all devices in the network remain consistent through time synchronization so that latency and jitter can be accurately controlled during data transmission. Among them, IEEE 1588 Precision Time Protocol (PTP) is the key standard for achieving time synchronization, and gPTP (Generalized Precision Time Protocol) is an extension of PTP, providing higher-precision time synchronization.

[0003] gPTP introduces the concepts of master clock and slave clock in the network to ensure that the clocks of all devices can be synchronized within the microsecond level. The master clock is responsible for broadcasting time information to the slave clock, and the slave clock adjusts its own clock according to the information of the master clock. BMCA (Best Master Clock Algorithm) is the core algorithm in the gPTP protocol, which is responsible for electing the best master clock in the network. The BMCA algorithm ensures that the most reliable master clock, that is, the master node, is elected by comparing the clock quality and priority of each node to achieve time synchronization for the entire network. However, in the existing master node election process, attackers obtain the status of the master node by forging identity identification, thereby controlling or interfering with the entire network; and the existing node election only depends on the results of the BMCA algorithm. When attackers manipulate the results of the BMCA algorithm, it will also affect the election of the master node, which will have a serious impact on the time synchronization of the network. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a master node election method, apparatus, terminal equipment and medium based on gPTP, which can effectively solve the security issues existing in the master node election process.

[0005] In a first aspect, an embodiment of the present application provides a master node election method based on gPTP, including:

[0006] Obtaining and verifying the digital certificates of all participating nodes to determine the validity of each of the digital certificates;

[0007] Taking the participating nodes corresponding to the valid digital certificates as legal nodes, and generating identity tokens for each legal node;

[0008] Each of the legal nodes inserts its own identity token into the announcement message;

[0009] A master clock is determined according to the declaration message of each of the legal nodes, and a master node is determined according to the master clock.

[0010] In some embodiments, the digital certificate of each participating node is pre-generated, including:

[0011] Generate a reference key and certificate content of the authentication center based on a preset algorithm; the certificate content includes the certificate validity period, issuer ID and the reference public key of the reference key;

[0012] Performing a hash calculation on the certificate content to obtain a first hash value;

[0013] The node public key of the node key of the participating node is encrypted according to the base private key of the base key and the first hash value to obtain a first signature; wherein the participating node generates the node key based on the preset algorithm;

[0014] The digital certificate of the participating node is determined according to the first signature and the certificate content.

[0015] In some embodiments, the verifying of the digital certificates pre-generated by all participating nodes to determine the validity of each digital certificate includes:

[0016] Responding to the verification request of each participating node, obtaining preset information in the digital certificate of each participating node; the preset information includes the certificate validity period, the first signature and the serial number;

[0017] If the preset information meets the preset requirements, the corresponding digital certificate is valid.

[0018] In some embodiments, generating an identity token for each of the legal nodes includes:

[0019] An identity token corresponding to the legal node is generated according to the identity identifier of the legal node, the first signature and the reference public key, and different identity tokens are distributed to the corresponding legal nodes.

[0020] In some embodiments, the announcement message includes an election field and an additional field;

[0021] The election field includes election information, and the election information includes identity identification, clock quality, priority and clock source; the additional field includes the identity token.

[0022] In some embodiments, determining the master clock according to the announcement message of each of the legal nodes includes:

[0023] Verify the identity token in each of the declaration messages, and use the legal node that passes the verification as the target node;

[0024] The master clock is determined according to the election information in the announcement message of the target node.

[0025] In some embodiments, the verifying the identity token in each of the announcement messages includes:

[0026] Calculate the hash value of the corresponding legal node according to the token content of each identity token;

[0027] The first signature in the identity token is decrypted using the reference public key to obtain a token decryption result. If the token decryption result is the same as the hash value of the legal node, the identity token is valid; and the legal node corresponding to the valid identity token is used as the target node.

[0028] In a second aspect, an embodiment of the present application provides a master node election device based on gPTP, including a digital certificate module, an identity token module, a declaration message module and an election node module;

[0029] The digital certificate module is used to obtain the digital certificates of all participating nodes and verify them to determine the validity of each digital certificate;

[0030] The identity token module is used to take the participating nodes corresponding to the valid digital certificates as legal nodes and generate identity tokens for each legal node;

[0031] The declaration message module is used to insert the identity token of each of the legal nodes into the declaration message;

[0032] The node election module is used to determine the master clock according to the declaration message of each of the legal nodes, and determine the master node according to the master clock.

[0033] In a third aspect, an embodiment of the present application provides a terminal device, comprising a processor and a memory, wherein the memory stores a computer program, and the processor is used to execute the computer program to implement the above-mentioned gPTP-based master node election method.

[0034] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program, which, when executed on a processor, implements the above-mentioned gPTP-based master node election method.

[0035] The embodiments of the present application have the following beneficial effects:

[0036] This application is based on the master node election method of gPTP, which pre-generates a digital certificate for each participating node so that each participating node has its own legal information; then before entering the election process, the digital certificate of each participating node is verified to determine the legal nodes among all participating nodes, and an identity token is regenerated for the legal node, and the identity token of the legal node is inserted into the declaration message, so that the master node corresponding to the determined master clock is legal, which prevents tampering or forgery, and improves the reliability of the election. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A technical logic diagram of the master node election method based on gPTP in an embodiment of the present application is shown;

[0039] Figure 2 A flowchart of a master node election method based on gPTP in an embodiment of the present application is shown;

[0040] Figure 3 A flow chart of generating a digital certificate in an embodiment of the present application is shown;

[0041] Figure 4 A flow chart of a digital certificate in an embodiment of the present application is shown;

[0042] Figure 5 A structural diagram of a master node election device based on gPTP in an embodiment of the present application is shown.

[0043] Description of main component symbols:

[0044] 10-digital certificate module; 20-identity token module; 30-declaration message module; 40-election node module. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0046] The components of the embodiments of the present application generally described and shown in the drawings herein may be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0047] Hereinafter, the terms "including", "having" and their cognates that can be used in various embodiments of the present application are intended only to indicate specific features, numbers, steps, operations, elements, components or a combination of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or a combination of the foregoing items or increasing the possibility of one or more features, numbers, steps, operations, elements, components or a combination of the foregoing items. In addition, the terms "first", "second", "third" and the like are only used to distinguish descriptions and cannot be understood as indicating or implying relative importance.

[0048] Unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meanings as those generally understood by those skilled in the art to which the various embodiments of the present application belong. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meanings as the contextual meanings in the relevant technical field and will not be interpreted as having idealized meanings or overly formal meanings unless clearly defined in the various embodiments of the present application.

[0049] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0050] The gPTP protocol ensures the time consistency of each node in the network through precise timestamps and synchronization mechanisms, thereby supporting real-time data transmission and efficient network resource management. Among them, the gPTP protocol adopts the BMCA algorithm, and its election process includes: first, each node exchanges information by sending self-reported clock information (such as clock ID, clock quality, etc.); then, the node compares the received clock information and finally selects the best master clock. The efficiency and accuracy of this process are the key to the successful implementation of the gPTP protocol.

[0051] However, in the current master node election process, many systems have not introduced an effective identity authentication mechanism, which means that any node can try to participate in the election, and even disguise itself as a legitimate node. This lack of identity authentication makes the network vulnerable to malicious attacks. At the same time, since the current node election scheme only relies on the results of the BMCA algorithm and lacks multiple verifications of the election results, the credibility of the election results is reduced. Attackers can influence the election of the master node by manipulating the results of BMCA, which in turn has a serious impact on the network's time synchronization.

[0052] In the implementation process of the BMCA algorithm of the gPTP protocol, security is a factor that cannot be ignored. To this end, this application introduces identity authentication and multiple verification mechanisms to effectively prevent interference from malicious nodes and ensure the credibility of the election results.

[0053] The gPTP-based master node election method is described below with reference to some specific embodiments.

[0054] Figure 1 A technical logic diagram of the master node election method based on gPTP in an embodiment of the present application is shown; Figure 2 A flow chart of a gPTP-based master node election method according to an embodiment of the present application is shown. Exemplarily, the gPTP-based master node election method includes the following steps:

[0055] S100, pre-generate a digital certificate for each participating node, and distribute different digital certificates to corresponding participating nodes.

[0056] In this embodiment, the process of pre-generating the digital certificate of each participating node is as follows: Figure 3 As shown, including:

[0057] S110, generating a node key for each participating node based on a preset algorithm, and sending the node public key of the node key to the authentication center.

[0058] The preset algorithm of this embodiment adopts an asymmetric encryption algorithm, such as RSA or ECC. The node key of each participating node is generated by an asymmetric encryption algorithm, and each pair of node keys includes a node public key (e, n) and a node secret key (d, n); wherein n is the identification information of the participating node, e is the public key, and d is the secret key. The Certificate Authority (CA) is an authoritative organization responsible for issuing and managing digital certificates.

[0059] S120, generating a reference key and certificate content of the authentication center based on a preset algorithm.

[0060] In this embodiment, the preset algorithm used by the authentication center CA is also an asymmetric encryption algorithm. When the authentication center generates a reference key, it also generates a file. The reference key includes a reference public key e0 and a reference key d0; the generated file is the certificate content, which at least includes the issuer ID, certificate validity period, reference public key e0, etc.

[0061] S130, the authentication center performs a hash calculation on the certificate content to obtain a first hash value.

[0062] In this embodiment, the certification authority CA performs hash calculation on the certificate content as follows:

[0063] H=Hash(M)

[0064] Where H is the first hash value, M is the certificate content, and Hash is the hash function.

[0065] S140, the authentication center encrypts the node public key of each node key according to the base private key of the base key and the first hash value to obtain a first signature.

[0066] In this embodiment, the authentication center uses the base private key of its base key to sign the node public key of the participating node, and obtains the first signature of the authentication center on the participating node, which is expressed as:

[0067] S=H d0 mod(n)

[0068] In the formula, S is the first signature, d0 is the base private key of the authentication center, mod is the modular operation, and n is the identification information of the participating node.

[0069] S150, determining the digital certificate of the participating node according to the first signature and the certificate content.

[0070] After the authentication center CA encrypts the node public key of the participating node, it obtains the digital certificate corresponding to each participating node. The final digital certificate includes the identity of the participating node, the certificate validity period, and the first signature of the authentication center. The digital certificate can ensure the uniqueness and credibility of the identity of each participating node.

[0071] The certification authority CA distributes all digital certificates to each corresponding participating node through a preset secure channel to ensure that each participating node can securely receive its own identity credentials, namely digital certificates.

[0072] In order to ensure that digital certificates are not tampered with or stolen during transmission, the preset security channels include TLS, virtual private networks based on VPN, and SSL / TLS channels; VPN uses encrypted communication to effectively prevent network eavesdropping and man-in-the-middle attacks; SSL / TLS channels require a secure connection to be established between the node and the CA in advance.

[0073] S200, obtaining the digital certificates of all participating nodes and verifying them to determine the validity of each digital certificate.

[0074] After each participating node receives the corresponding digital certificate, all participating nodes have their own digital certificate and node private key. Before performing the BMCA algorithm of the gTPT protocol, the legitimacy of each participating node needs to be verified.

[0075] In this embodiment, the digital certificates of all participating nodes are verified by the authentication center. The verification process is as follows: Figure 4 As shown, including:

[0076] S210, responding to the verification request of each participating node, and obtaining preset information in the digital certificate of each participating node.

[0077] The authentication center receives the first verification request of each participating node, which includes the digital certificate and node public key of each participating node. The preset information corresponding to the digital certificate includes the certificate validity period, the first signature and the serial number. Among them, the serial number of each digital certificate is stored in the authentication center CA, and will be used for authentication comparison when the participating node authenticates its identity to the authentication center CA.

[0078] S220: If the preset information meets the preset requirements, the corresponding digital certificate is valid.

[0079] The preset information of this implementation meets the preset requirements, including that the current verification time is within the validity period of the certificate, the serial number is not in the certificate revocation list, and the first signature of the digital certificate is valid; that is, if the current verification time is within the validity period, the serial number is not in the certificate revocation list and the first signature of the digital certificate is valid, the corresponding digital certificate is valid.

[0080] For example, whether a digital certificate has been revoked can be determined by judging whether the serial number is in the certificate revocation list. The certificate revocation list CRL is a list regularly issued by the certification authority CA, which lists the serial numbers of revoked digital certificates. The certification authority CA compares the serial number of the digital certificate with the certificate revocation list CRL. If the serial number of the digital certificate exists in the certificate revocation list CRL, the corresponding digital certificate has been revoked. If the serial number of the digital certificate is not in the certificate revocation list CRL, the corresponding digital certificate has not been revoked and is therefore deemed valid.

[0081] For example, the verification process for a digital certificate signature is as follows:

[0082] The second hash value H' of each participating node is calculated according to the certificate content of each digital certificate;

[0083] H`=Hash(M)

[0084] The node private key of the participating node is decrypted based on the base public key and the second hash value to obtain the certificate decryption result of the participating node by the certification center, which is expressed as:

[0085] S`=H e0 mod(n)

[0086] In the formula, S' is the certificate decryption result, e0 is the base public key of the authentication center, mod is the modular operation, and n is the identification information of the participating node.

[0087] If the certificate decryption result is equal to the second hash value, it means that the first signature in the digital certificate is valid, and the corresponding digital certificate is valid.

[0088] By verifying the first signature of the digital certificate, it is ensured that the digital certificate is issued by a trusted certification authority CA.

[0089] S300, taking the participating nodes corresponding to the valid digital certificates as legal nodes, and generating identity tokens for each legal node.

[0090] In this embodiment, the participating nodes corresponding to the valid digital certificates are regarded as legal nodes, and identity tokens are generated for each legal node, wherein the generation of identity tokens for legal nodes includes: the authentication center generates identity tokens for the corresponding legal nodes based on the identity identifier of the legal node, the first signature and the base public key of the authentication center, and transmits different identity tokens back to the corresponding legal nodes.

[0091] S400, each legitimate node inserts its own identity token into the declaration message.

[0092] During the execution of the BMCA algorithm, each legitimate node that receives the identity token will also verify the validity of the identity token to ensure that the legitimate node can continue to participate in the BMCA algorithm. Compared with the traditional declaration message, the declaration message of this embodiment adds an additional field at the end of the declaration message; that is, the identity token is added to the additional field of the declaration message. The election information corresponding to the election field includes the first priority, the second priority, the identity identifier, the clock quality, the time source, etc. The identity token is located after the election information; therefore, the declaration message of this embodiment includes an election information field and an additional field.

[0093] S500, determining a master clock according to the declaration message of each legal node, and taking a target node corresponding to the master clock as a master node.

[0094] In this embodiment, the legal node to be verified sends its own declaration message to any other legal node; after receiving the declaration message of the legal node to be verified, the legal node verifies the identity token in the declaration message of the legal node to be verified, and takes the legal node that passes the verification as the target node, and then determines the master clock according to the election information in the declaration message of the target node.

[0095] For example, the identity token in the declaration message of the legal node to be verified is verified to ensure the legitimacy of the identity token, so as to determine whether the legal node can be used as the target node for electing the master node. The verification process includes: calculating the hash value of the corresponding legal node based on the token content of each identity token; wherein the token content does not include the first signature; using the base public key to decrypt the first signature in the identity token to obtain the token decryption result. If the token decryption result is the same as the hash value of the legal node, it means that the corresponding identity token is legal and the verification is successful. Otherwise, the identity token is illegal and cannot be verified.

[0096] For example, a legitimate node B verifies the identity token of a legitimate node A. If the identity token is valid, node B regards node A as the target node and continues to participate in the BMCA algorithm. At this time, node B will update its internal state, record the identity and priority of node A, and may send its own election information to other nodes. If the identity token is invalid, node B will reject node A's election information and exclude it from the election. Node B will record the reason for the rejection (such as an invalid identity token) for subsequent audits, and broadcast the rejection information to other nodes to ensure that other nodes in the network can also understand the status of node A.

[0097] After all nodes complete identity authentication, the BMCA algorithm will proceed to elect the master node. Node B and other legitimate nodes will compare based on priority and clock quality information to select the master clock. Among them, the process of comparing and electing the master clock is a prior art and will not be elaborated in this embodiment. Finally, the participating node (i.e., the target node) corresponding to the master clock is used as the master node.

[0098] The master node election method based on gPTP in this embodiment significantly improves network security through a phased identity authentication process during the BMCA process, ensuring the legitimacy of the nodes participating in the election. The node generates a key pair and a digital certificate issued by the certification center CA, effectively preventing the risks of forgery and identity impersonation. During the identity authentication process, combined with the first signature of the certification center CA and the multiple verification system of the identity token, even if a certain link is attacked, the overall system can still maintain security and reduce the risk of single point failure. The identity authentication mechanism in the BMCA election process ensures the accuracy of the time information.

[0099] Figure 5 A structural schematic diagram of a gPTP-based master node election device of an embodiment of the present application is shown. Exemplarily, the gPTP-based master node election device includes a digital certificate module 10, an identity token module 20, a declaration message module 30 and an election node module 40; the digital certificate module 10 is used to obtain the digital certificates of all participating nodes and verify them to determine the validity of each digital certificate; the identity token module 20 is used to take the participating nodes corresponding to the valid digital certificates as legal nodes, and generate an identity token for each legal node; the declaration message module 30 is used to insert the identity token of each legal node into the declaration message; the election node module 40 is used to determine the master clock according to the declaration message of each legal node, and determine the master node according to the master clock.

[0100] It can be understood that the device of this embodiment corresponds to the gPTP-based master node election method of the above-mentioned embodiment, and the optional options in the above-mentioned embodiment are also applicable to this embodiment, so they will not be repeated here.

[0101] The present application also provides a terminal device, which exemplarily includes a processor and a memory, wherein the memory stores a computer program, and the processor runs the computer program to enable the terminal device to execute the functions of each module in the above-mentioned gPTP-based master node election method or the above-mentioned gPTP-based master node election device. The terminal device can be a computer device, and the computer devices in the cluster can participate in the election process of the master node as nodes; the terminal device can also be a node device, and in a distributed system, each node device may participate in the election process of the master node.

[0102] Among them, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, including a central processing unit (CPU), a graphics processing unit (GPU) and a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or at least one of other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc., which can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application.

[0103] The memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The memory is used to store a computer program, and the processor may execute the computer program accordingly after receiving an execution instruction.

[0104] The present application also provides a computer-readable storage medium for storing the computer program used in the above-mentioned terminal device. For example, the computer-readable storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0105] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and structure diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in an alternative implementation, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the structure diagram and / or the flow diagram, and the combination of boxes in the structure diagram and / or the flow diagram, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0106] In addition, the functional modules or units in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0107] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a smart phone, a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application.

[0108] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A master node election method based on gPTP, characterized in that: include: Obtaining and verifying the digital certificates of all participating nodes to determine the validity of each of the digital certificates; Taking the participating nodes corresponding to the valid digital certificates as legal nodes, and generating identity tokens for each legal node; Each of the legal nodes inserts its own identity token into the announcement message; A master clock is determined according to the announcement message of each of the legal nodes, and a master node is determined according to the master clock.

2. The gPTP-based master node election method according to claim 1, characterized in that: The digital certificate of each participating node is generated in advance, including: Generate a reference key and certificate content of the authentication center based on a preset algorithm; the certificate content includes the certificate validity period, issuer ID and the reference public key of the reference key; Performing a hash calculation on the certificate content to obtain a first hash value; The node public key of the node key of the participating node is encrypted according to the base private key of the base key and the first hash value to obtain a first signature; wherein the participating node generates the node key based on the preset algorithm; The digital certificate of the participating node is determined according to the first signature and the certificate content.

3. The gPTP-based master node election method according to claim 1, characterized in that: The obtaining of the digital certificates of all participating nodes and verification to determine the validity of each digital certificate includes: Responding to the verification request of each participating node, obtaining preset information in the digital certificate of each participating node; the preset information includes the certificate validity period, the first signature and the serial number; If the preset information meets the preset requirements, the corresponding digital certificate is valid.

4. The gPTP-based master node election method according to claim 2, characterized in that: The generating of the identity token of each legal node comprises: An identity token corresponding to the legal node is generated according to the identity identifier of the legal node, the first signature and the reference public key, and different identity tokens are distributed to the corresponding legal nodes.

5. The gPTP-based master node election method according to claim 1, characterized in that: The announcement message includes an election field and an additional field; The election field includes election information, and the election information includes identity identification, clock quality, priority and clock source; the additional field includes the identity token.

6. The gPTP-based master node election method according to claim 1, characterized in that: The determining the master clock according to the declaration message of each of the legal nodes includes: Verify the identity token in each of the declaration messages, and use the legal node that passes the verification as the target node; The master clock is determined according to the election information in the announcement message of the target node.

7. The gPTP-based master node election method according to claim 6, characterized in that: The verifying the identity token in each of the declaration messages includes: Calculate the hash value of the corresponding legal node according to the token content of each identity token; The first signature in the identity token is decrypted using the reference public key to obtain a token decryption result. If the token decryption result is the same as the hash value of the legal node, the identity token is valid; and the legal node corresponding to the valid identity token is used as the target node.

8. A master node election device based on gPTP, characterized in that: It includes a digital certificate module, an identity token module, a declaration message module and an election node module; The digital certificate module is used to obtain the digital certificates of all participating nodes and verify them to determine the validity of each digital certificate; The identity token module is used to take the participating nodes corresponding to the valid digital certificates as legal nodes and generate identity tokens for each legal node; The declaration message module is used to insert the identity token of each of the legal nodes into the declaration message; The node election module is used to determine the master clock according to the declaration message of each of the legal nodes, and determine the master node according to the master clock.

9. A terminal device, characterized in that: The terminal device includes a processor and a memory, the memory stores a computer program, and the processor is used to execute the computer program to implement the gPTP-based master node election method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed on a processor, implements the gPTP-based master node election method according to any one of claims 1-7.

Images