Authentication information storage method, system, device and product of edge computing device

Abstract

An authentication information storage method, system, device and product of an edge computing device, relating to the technical field of edge computing, the method comprising: in response to a service instance of a cluster receiving first revoked authentication information, determining a first shard Bloom filter according to an effective expiration time of the first revoked authentication information and a preset time interval corresponding to a plurality of shard Bloom filters of the service instance, and storing the first revoked authentication information in the first shard Bloom filter; in response to all revoked authentication information stored in the first shard Bloom filter being expired, emptying all revoked authentication information stored in the first shard Bloom filter. By storing revoked authentication information according to the effective expiration time, expired deletion of revoked authentication information in the shard Bloom filter is realized, which provides protection for local authentication revocation checking of large data levels in the edge computing scenario, not only saving storage space, but also ensuring the accuracy and reliability of authentication revocation checking.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of edge computing, in particular, to an authentication information storage method, system, device and product of an edge computing device. BACKGROUND

[0002] In an edge computing scenario, an edge computing device needs to confirm its legitimacy and authority through device authentication information. In some scenarios, it is necessary to revoke the authentication information that has not expired. The edge computing device that is revoked will no longer be able to pass the authentication, so it is necessary to check the revocation of the authentication information of the edge computing device.

[0003] In the related art, a Bloom filter is used to store the revoked authentication information to realize local revocation checking. However, as the revoked authentication information accumulates, the accuracy of the revocation checking will gradually decrease. SUMMARY

[0004] This summary is provided to introduce a selection of concepts that are further described below in the detailed description. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it used to limit the scope of the claimed subject matter's scope.

[0005] In a first aspect, the present disclosure provides an authentication information storage method of an edge computing device, the authentication information storage method comprising:

[0006] In response to a service instance of a cluster receiving first revoked authentication information, determining a first shard Bloom filter from a plurality of shard Bloom filters of the service instance according to an effective expiration time of the first revoked authentication information and a preset time interval corresponding to the plurality of shard Bloom filters, and storing the first revoked authentication information in the first shard Bloom filter; the service instance comprises a plurality of shard Bloom filters, and each shard Bloom filter is used to store revoked authentication information with an effective expiration time within a corresponding preset time interval.

[0007] In response to all revoked authentication information stored in the first shard Bloom filter being expired, the service instance clears all revoked authentication information stored in the first shard Bloom filter.

[0008] In a second aspect, the present disclosure provides an authentication information storage system of an edge computing device, the authentication information storage system comprising:

[0009] The controller is used to receive a device revocation request, determine the first revocation authentication information based on the device authentication information carried in the device revocation request, and send the first revocation authentication information to the service instance of the cluster. The service instance includes multiple sharded Bloom filters, and one sharded Bloom filter is used to store revocation authentication information whose effective expiration time is within the corresponding preset time interval.

[0010] The service instance is configured to respond to receiving the first revocation authentication information, determine the first sharded Bloom filter from the plurality of sharded Bloom filters according to the effective expiration time of the first revocation authentication information and the preset time interval corresponding to the plurality of sharded Bloom filters, and store the first revocation authentication information into the first sharded Bloom filter.

[0011] The service instance is configured to clear all revocation authentication information stored in the first sharded Bloom filter in response to the fact that all revocation authentication information stored in the first sharded Bloom filter has expired.

[0012] Thirdly, this disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the method described in the first aspect.

[0013] Fourthly, this disclosure provides an electronic device, comprising:

[0014] A storage device on which computer programs are stored;

[0015] A processing device for executing the computer program in the storage device to implement the steps of the method in the first aspect.

[0016] Fifthly, this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0017] Through the above technical solution, the service instances of the cluster can determine the first sharded Bloom filter based on the effective expiration time of the first revocation authentication information and the preset time intervals corresponding to multiple sharded Bloom filters. The first revocation authentication information is then stored in the first sharded Bloom filter, and all revocation authentication information stored in the first sharded Bloom filter can be cleared if all revocation authentication information stored in the first sharded Bloom filter has expired. Using this method, by using sharded Bloom filters corresponding to different preset time intervals, revocation authentication information can be sharded and stored according to its effective expiration time. This allows for direct clearing of the sharded Bloom filter to achieve the deletion of expired revocation authentication information, providing a guarantee for local authentication revocation checks on large datasets in edge computing scenarios. It reduces the performance impact caused by network latency, saves storage space, and ensures the accuracy and reliability of authentication revocation checks.

[0018] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0019] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale. In the drawings:

[0020] Figure 1 This is a flowchart illustrating an authentication information storage method for an edge computing device according to an exemplary embodiment of the present disclosure;

[0021] Figure 2 This is a schematic diagram illustrating a segmented Bloom filter according to an exemplary embodiment of the present disclosure;

[0022] Figure 3 This is a schematic diagram illustrating an authentication information storage architecture for an edge computing device according to an exemplary embodiment of the present disclosure;

[0023] Figure 4 This is an interactive schematic diagram illustrating an authentication information storage architecture for an edge computing device according to an exemplary embodiment of the present disclosure;

[0024] Figure 5 This is a schematic diagram illustrating the interaction process between a service instance and a mirror center according to an exemplary embodiment of this disclosure;

[0025] Figure 6 This is a schematic diagram illustrating a mirror center backup and compression process according to an exemplary embodiment of the present disclosure;

[0026] Figure 7 This is a schematic diagram illustrating a mirror center backup process according to an exemplary embodiment of the present disclosure;

[0027] Figure 8 This is a schematic diagram illustrating a certification revocation inspection process according to an exemplary embodiment of the present disclosure;

[0028] Figure 9 This is a schematic diagram illustrating the structure of an authentication information storage system for an edge computing device according to an exemplary embodiment of the present disclosure;

[0029] Figure 10 This is a schematic diagram of the structure of an electronic device according to an exemplary embodiment of the present disclosure. Detailed Implementation

[0030] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0031] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0032] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0033] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0034] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0035] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0036] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0037] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0038] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0039] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0040] Meanwhile, it is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0041] Edge computing is a distributed computing architecture that moves data processing and analysis from the cloud or data center to the network edge, closer to the data source or user device. In edge computing scenarios, edge computing devices need to verify their legitimacy and permissions through device authentication information to ensure that only authorized edge computing devices can access the network, access resources, or communicate with other edge computing devices.

[0042] Taking a zero-trust architecture as an example, the authentication information of edge computing devices typically uses standard structures such as certificates, and the unique identifiers are usually unordered. To improve security, authentication information requires complete lifecycle management. In some scenarios, it is necessary to revoke authentication information that has not yet expired. Revoked authentication information cannot be used again to prevent malicious exploitation.

[0043] In related technologies, revocation checks for zero-trust architectures can request third-party data sources over the network. However, this method suffers from slow response times and low performance. In-memory local revocation check solutions include hot data caching and Bloom filters.

[0044] Hot data caching schemes, such as LRU (Least Recently Used) and LFU (Least Frequently Used), consume too much memory and are usually used in scenarios with small datasets or frequent access to hot data. They cannot be used in edge computing scenarios with large data volumes.

[0045] The Bloom filter scheme, by sacrificing some accuracy and using bitwise operations, can cache large amounts of data with less memory. Its required storage space can be determined through calculation:

[0046]

[0047] Where n represents the number of revoked authentication information entries, p represents the false positive rate, and m represents the required memory. If the false positive rate is 1%, storing 100 million revoked authentication entries only requires 480MB, approximately 1 / 20th of the memory required by LRU and other similar solutions, resulting in minimal space consumption. However, this solution still has drawbacks: firstly, the inability to delete data leads to a continuous accumulation of revoked authentication information, resulting in increasingly lower accuracy; secondly, initial loading is slow, requiring the retrieval of all revoked authentication information and the reconstruction of the Bloom filter, leading to slow service cold starts and poor timeliness.

[0048] In view of this, this disclosure provides a method, system, device, and product for storing authentication information of edge computing devices to solve the aforementioned technical problems. It can be applied to authentication revocation checks in the aforementioned edge computing scenarios or zero-trust architectures, particularly for zero-trust architectures with hundreds of millions of users. It can also be used for authentication revocation checks with other architectures, and this disclosure does not limit its application.

[0049] The embodiments of this disclosure will be further explained below with reference to the accompanying drawings.

[0050] Figure 1 This is a flowchart illustrating an authentication information storage method for an edge computing device according to an exemplary embodiment of the present disclosure, with reference to... Figure 1 The authentication information storage method includes:

[0051] S101: In response to the cluster's service instance receiving the first revocation authentication information, based on the effective expiration time of the first revocation authentication information and the preset time interval corresponding to the multiple sharded Bloom filters of the service instance, the first sharded Bloom filter is determined from the multiple sharded Bloom filters, and the first revocation authentication information is stored in the first sharded Bloom filter.

[0052] One of the blombroid filters is used to store revocation certification information whose effective expiration time falls within the corresponding preset time interval.

[0053] It should be noted that the authentication information of edge computing devices is the unique identifier of edge computing devices. For example, it can be a digital certificate, which is an important credential used to verify the device. The revocation of authentication information refers to the authentication information of the revoked device. For example, when a digital certificate is revoked, the corresponding device will lose its corresponding authentication qualification, etc. This disclosure does not impose any restrictions on this.

[0054] S102: In response to the fact that all revocation authentication information stored in the first shard Bloom filter has expired, the service instance clears all revocation authentication information stored in the first shard Bloom filter.

[0055] For example, sharded Bloom filters can be built based on the distribution of the certification validity period of edge computing devices. Taking the distribution of the certification information validity period of edge computing devices within 60 days as an example, multiple sharded Bloom filters can be created according to different time intervals as needed. For example, if sharded by day, at least 60 sharded Bloom filters can be created, and the revoked certification information that expires on the same day can be stored in the same sharded Bloom filter.

[0056] For example, if sharding is done every 10 days, at least 6 sharded Bloom filters would be created. For instance, shard 1 is used to store revocation certification information with a valid expiration date of 1-10 days, and shard 2 is used to store revocation certification information with a valid expiration date of 11-20 days. In this way, the upper limit of the time interval can be used as the validity period of each sharded Bloom filter, and a countdown timer can be set to trigger clearing. For example, if shard 1 expires in 10 days, all revocation certification information in shard 1 will expire and be cleared.

[0057] For example, a preset time interval can also be set according to a specific time. For instance, shard 1 is used to store revocation certification information with a valid expiration date between January 1, 2025 and January 10, 2025, and so on. This disclosure will not elaborate further here. Similarly, the upper limit of the time interval can be used as the validity period of each shard Bloom filter, and a countdown to trigger clearing can be set. For example, if shard 1 expires after January 10, 2025, then all revocation certification information in shard 1 will expire and be cleared.

[0058] In this way, over time, all the revocation certification information stored in the fragmented Bloom filter will expire. By clearing the fragmented Bloom filter, the problem of the Bloom filter being unable to delete data is solved.

[0059] By using the above method, fragmented Bloom filters corresponding to different preset time intervals can be used to store revocation certification information in fragments according to the effective expiration time. This allows for the direct clearing of fragmented Bloom filters to delete expired revocation certification information, providing a guarantee for local certification revocation checks on large data volumes in edge computing scenarios. It also reduces the performance impact caused by network latency, saving storage space and ensuring the accuracy and reliability of certification revocation checks.

[0060] In one possible manner, in response to the expiration of all revocation authentication information stored in the first shard Bloom filter, the service instance clears all revocation authentication information stored in the first shard Bloom filter, including: in response to the expiration of all revocation authentication information stored in the first shard Bloom filter, marking the first shard Bloom filter as a shard Bloom filter to be cleared, and enabling an idle shard Bloom filter, the idle shard Bloom filter corresponding to a new preset time interval; and clearing all revocation authentication information stored in the first shard Bloom filter through the service instance. This authentication information storage method further includes: marking the cleared first shard Bloom filter as an idle shard Bloom filter through the service instance.

[0061] For example, to implement a Bloom filter with sharded rolling distribution, a Bloom filter with more sharded intervals than the number of time intervals can be created. Continuing with the example of creating a day-level sharded Bloom filter where the validity period of the authentication information for edge computing devices is distributed over 60 days, such as... Figure 2 As shown, 62 fragmented Bloom filters can be created, including 60 fragmented Bloom filters 1 to 60 used to store revoked certification information that expires within 60 days, as well as fragmented Bloom filter 0 to be emptied and idle fragmented Bloom filter 61 to be enabled.

[0062] Subsequently, one day later, fragmented Bloom filter 0 is cleared, fragmented Bloom filter 1 is marked as a new fragmented Bloom filter to be cleared, idle fragmented Bloom filter 61 is enabled, and a new idle fragmented Bloom filter 62 is created to be enabled. Of course, the cleared fragmented Bloom filter 0 can also be used as the idle fragmented Bloom filter 62; this disclosure does not limit this. This allows for the rotation of fragmented Bloom filters, resolving the issue of Bloom filters being unable to delete revoked certification information.

[0063] In other possible implementations, fragmented Bloom filter 0 can be deleted directly after one day, and then a new idle fragmented Bloom filter 62 can be created to be enabled. The specific method can be chosen according to requirements, and this disclosure does not impose any restrictions.

[0064] It should be understood that fragmented Bloom filter 0 can prevent the insertion of new revocation certification information during the clearing process, and fragmented Bloom filter 61 can prevent the insertion of new revocation certification information during the creation process. Therefore, creating more fragmented Bloom filters than the number of time intervals can ensure the rotation of fragmented Bloom filters. The specific number can be set according to needs, for example, setting (number of time intervals + 2) fragmented Bloom filters. This disclosure does not limit this.

[0065] Figure 3 This is a schematic diagram of the authentication information storage architecture of the edge computing device provided in the embodiments of this disclosure, such as... Figure 3As shown, users can configure the edge computing devices to be revoked on the device revocation platform. Based on the authentication information of these edge computing devices, a device revocation request is generated. Upon receiving the device revocation request, the controller identifies the device authentication information carried in the request as the revocation authentication information. This revocation authentication information can be broadcast to subscribed sharded Bloom filters and mirror centers. The broadcast revocation authentication information can also be consumed in the form of a message queue; this disclosure does not impose any restrictions on this. The revocation authentication information can also be written to a first storage space and a second storage space. The first storage space is used to cache the full revocation authentication information and can be a key-value store database, such as Redis. The second storage space is used to persistently store the full revocation authentication information.

[0066] The following is based on, Figure 3 The authentication information storage architecture of the edge computing device shown herein is used to illustrate the authentication information storage method of the edge computing device according to the embodiments of this disclosure.

[0067] During the architecture's construction phase, each service instance that needs to perform authentication revocation checks will have a built-in sharded Bloom filter. When a user performs device authentication revocation, such as... Figure 4 As shown, the controller will incrementally write the revocation authentication information to the Bloom filter, mirror center, first storage space and second storage space of each service instance. In addition, the mirror center will periodically compress the currently built Bloom filter and store it in the third storage space.

[0068] During the service instance startup phase, the authentication information storage method may further include, in some possible ways: in response to the startup of the service instance, obtaining a target authentication information queue and a target image Bloom filter from the image center through the service instance, wherein the target authentication information queue is used to store the revocation authentication information received after the target image Bloom filter is built; and constructing a sharded Bloom filter for the service instance based on the target authentication information queue and the target image Bloom filter through the service instance.

[0069] For example, the sharded Bloom filter does not need to be built from scratch at startup; it can directly pull a pre-built mirror Bloom filter from the image center. Since the image center builds mirror Bloom filters periodically, it also needs to pull the revocation authentication information received after the target mirror Bloom filter is built—that is, the revocation authentication information in the target authentication information queue. The service instance writes the revocation authentication information from the target authentication information queue into the sharded Bloom filter obtained based on the target mirror Bloom filter, thus obtaining a sharded Bloom filter with complete data. This ensures the integrity of the revocation authentication information in the built sharded Bloom filter.

[0070] Furthermore, such as Figure 5As shown, in addition to pulling the image Bloom filter and the revocation authentication information from the incremental target authentication information queue from the image center, the service instance can also continuously receive the revocation authentication information broadcast by the controller and store it in the message queue (MQ). The service instance can then incrementally complete the subsequent revocation authentication information based on the message queue, ensuring that the data real-time performance can reach the second level.

[0071] Through the mirror center, sharded Bloom filters can achieve fast cold loading, solving the problem of slow loading during cold starts when there is a large amount of historical revocation authentication information. This reduces the construction time of sharded Bloom filters in service instances and the service startup time. Furthermore, by combining existing and incremental loading caching schemes, the real-time performance of revocation authentication information is improved.

[0072] In one possible manner, the authentication information storage method further includes: in response to an update of the service instance, obtaining a target authentication information queue and a target image Bloom filter from the image center through the service instance, wherein the target authentication information queue is used to store the revocation authentication information received after the target image Bloom filter is constructed; and updating the sharded Bloom filter of the service instance based on the target authentication information queue and the target image Bloom filter through the service instance.

[0073] For example, service instances can also be configured to update periodically. Similarly, the target authentication information queue and the target image Bloom filter are obtained from the image center to update the shard filters of the service instances, further improving the accuracy of revocation authentication information in the service instances.

[0074] In one possible manner, the target mirror Bloom filter is constructed by the mirror center as follows: in response to receiving second revocation authentication information, the second revocation authentication information is written into a first authentication information queue, which is used to store revocation authentication information received after the first mirror Bloom filter stored in the mirror center is constructed; the first mirror Bloom filter is copied to obtain a second mirror Bloom filter; and the revocation authentication information in the first authentication information queue is written into the second mirror Bloom filter to obtain the target mirror Bloom filter.

[0075] For example, in such Figure 3 In the storage architecture shown, the mirror center periodically backs up the mirror Bloom filter. This can be configured as needed, for example, every 10 minutes; this disclosure does not impose any restrictions on this. The backup process of the mirror Bloom filter in the mirror center is as follows: Figure 6As shown, after startup, the mirror center periodically persists its data to the third storage space. The mirror center mainly includes the mirror Bloom filter that completed the last persistent backup and the revocation authentication information (MQ message) for newly revoked data since the last backup. The newly revoked revocation authentication information can be written to the first authentication information queue.

[0076] In one possible approach, the authentication information storage method further includes: constructing a second authentication information queue through a mirror center and stopping the writing of received revocation authentication information into the first authentication information queue, wherein the second authentication information queue is used to store the revocation authentication information received after the second mirror Bloom filter is copied; and deleting the first authentication information queue and the first mirror Bloom filter.

[0077] For example, such as Figure 7 As shown, when backing up the image Bloom filter, the mirror center can first build and replicate the first image Bloom filter to obtain the second image Bloom filter. Then, it can build an empty second authentication information queue to receive subsequent revocation authentication information. At this point, the first authentication information queue stops writing revocation authentication information. Then, the revocation authentication information in the first authentication information queue is written to the replicated second image Bloom filter to obtain the target image Bloom filter. A pointer can then be set to the target image Bloom filter and the second authentication information queue, so that when a service instance performs a pull operation, it will obtain the target image Bloom filter and the second authentication information queue.

[0078] For example, to avoid data redundancy in the mirror center, the first authentication information queue and the first mirror Bloom filter can be deleted when their reference counts are 0. In other words, the mirror center only needs to retain the latest mirror Bloom filter and authentication information queue.

[0079] Furthermore, after obtaining the target mirror Bloom filter, such as Figure 6 As shown, a compressed target image Bloom filter can be stored in a third storage space.

[0080] In one possible approach, obtaining the target authentication information queue and the target mirror Bloom filter from the mirror center via a service instance includes: when the mirror center includes a first authentication information queue, a second authentication information queue, a first mirror Bloom filter, and a second mirror Bloom filter, obtaining the first authentication information queue, the second authentication information queue, and the first mirror Bloom filter from the mirror center via the service instance; wherein the second mirror Bloom filter is obtained by replicating the first mirror Bloom filter, the first authentication information queue is used to store revocation authentication information received after the first mirror Bloom filter is constructed and before the second mirror Bloom filter is replicated, and the second authentication information queue is used to store revocation authentication information received after the second mirror Bloom filter is replicated. Constructing a sharded Bloom filter for the service instance based on the target authentication information queue and the target mirror Bloom filter via the service instance includes: constructing a sharded Bloom filter for the service instance based on the first authentication information queue, the second authentication information queue, and the first mirror Bloom filter via the service instance.

[0081] For example, such as Figure 7 As shown, before the backup is complete, the mirror center may have two authentication information queues and two mirror Bloom filters. At this time, the service instance obtains the first authentication information queue, the second authentication information queue, and the first mirror Bloom filter, and writes the revocation authentication information in the first authentication information queue and the second authentication information queue into the sharded Bloom filter obtained based on the first mirror Bloom filter to obtain its own sharded Bloom filter. This can avoid the incomplete incremental revocation authentication information obtained during the backup process.

[0082] When the mirror center starts up for the first time, the mirror center does not have the mirror Bloom filter from the last backup. Therefore, in the possible way, the target mirror Bloom filter is constructed by the mirror center in the following manner: in response to the initial startup of the mirror center, the unexpired third revocation authentication information is obtained from the second storage space, which is used to persistently store the full amount of revocation authentication information; the target mirror Bloom filter is constructed based on the third revocation authentication information.

[0083] For example, the full set of revocation certification information can be retrieved from the second storage space to build a Bloom filter for the target image. Since the Bloom filter stores unexpired revocation certification information, this unexpired information can be used to build the target image Bloom filter. Correspondingly, a compressed target image Bloom filter can be stored in the third storage space for use on the next startup.

[0084] In one possible manner, the target mirror Bloom filter is constructed by the mirror center as follows: In response to a mirror center restart, the latest compressed mirror Bloom filter is loaded from a third storage space, which is used to store compressed mirror Bloom filters corresponding to mirror Bloom filters historically constructed by the mirror center; based on the timestamp corresponding to the latest compressed mirror Bloom filter, the fourth revocation certification information that has not expired and is stored after the timestamp is obtained from a second storage space, which is used to persistently store the full amount of revocation certification information; the target mirror Bloom filter is constructed based on the latest compressed mirror Bloom filter and the fourth revocation certification information.

[0085] For example, continue to refer to Figure 6 When the mirror center restarts, it can load the latest compressed mirror Bloom filter from the third storage space. Then, based on the timestamp of the mirror Bloom filter backup corresponding to the compressed mirror Bloom filter, it can obtain the incremental revocation certification information after the timestamp from the second storage space. Here, it can also obtain the revocation certification information that has not expired. By combining the compressed mirror Bloom filter and the fourth revocation certification information to construct the target mirror Bloom filter of the mirror center, it can avoid losing the revocation certification information. While ensuring the data integrity of the target mirror Bloom filter, it can also reduce the cold start time of the mirror center.

[0086] In other possible methods, the persistent storage mirrored Bloom filter can record the time A of the last revocation authentication information. After the mirror is pulled, it can continue to consume the latest revocation authentication information in the MQ and record the time B of the first consumption record. In this way, the revocation authentication information stored in the A-B interval can be pulled from the second storage space. In addition, to prevent errors in the times A and B, the revocation authentication information in the time interval (Ax) to (B+x) can be pulled. x can be set according to requirements, and this disclosure does not impose any restrictions on it.

[0087] In one possible manner, the authentication information storage method further includes: receiving a device authentication verification request through a service instance; if the authentication information to be verified carried in the device authentication verification request is revoked authentication information, sending the authentication information to be verified to a first storage space for verification; the first storage space is a key-value storage database used to cache all revoked authentication information; and receiving the verification result returned by the first storage space.

[0088] For example, during certification revocation checks, a secondary verification of the device certification information is required because Bloom filters sacrifice some accuracy. Figure 8As shown, the service provider and the service instance are the same device. To distinguish the timing of the verification steps, the service provider, upon receiving the authentication verification request, checks the sharded Bloom filter for corresponding revoked authentication information based on the device authentication information carried in the request. If no revocation information is found, the device authentication information has not been revoked, and the authentication verification passes. If corresponding revoked authentication information is found, the device authentication information is further sent to the first storage space for accuracy verification. If revoked authentication information corresponding to the device authentication information is found in the first storage space, a verification result indicating that the device authentication information has been revoked is returned. This further improves the accuracy of authentication revocation checks.

[0089] In the aforementioned storage architecture, by building sharded Bloom filters in each service instance, large-scale revocation authentication information in edge computing scenarios is cached with relatively small memory space. Expired revocation authentication information is automatically deleted, achieving a memory caching solution with an authentication revocation check interception rate exceeding 99%. This significantly reduces the number of network requests, improves service performance, and ensures stable accuracy of authentication revocation checks without decreasing reliability over time. Furthermore, the mirror center design greatly shortens the startup time of the sharded Bloom filters. After the sharded Bloom filters in the mirror center are fully loaded, incremental sharded Bloom filters are continuously built in real-time via message queue (MQ) broadcasting, improving the timeliness of authentication revocation checks.

[0090] Based on the same inventive concept, embodiments of this disclosure provide an authentication information storage system for an edge computing device, such as... Figure 9 As shown, the authentication information storage system 900 includes:

[0091] Controller 901 is used to receive device revocation requests, determine first revocation authentication information based on the device authentication information carried in the device revocation request, and send the first revocation authentication information to the service instance of the cluster. The service instance includes multiple sharded Bloom filters, and one sharded Bloom filter is used to store revocation authentication information with valid expiration times within the corresponding preset time interval.

[0092] Service instance 902 is used to respond to receiving the first revocation authentication information, determine the first fragmented Bloom filter from the multiple fragmented Bloom filters according to the valid expiration time of the first revocation authentication information and the preset time interval corresponding to the multiple fragmented Bloom filters, and store the first revocation authentication information into the first fragmented Bloom filter.

[0093] Service instance 902 is used to clear all revocation authentication information stored in the first shard Bloom filter in response to the fact that all revocation authentication information stored in the first shard Bloom filter has expired.

[0094] Optionally, the service instance 902 is used for:

[0095] In response to the expiration of all revocation certification information stored in the first sharded Bloom filter, the first sharded Bloom filter is marked as a sharded Bloom filter to be cleared, and an idle sharded Bloom filter is enabled, the idle sharded Bloom filter corresponding to a new preset time interval.

[0096] Clear all revocation certification information stored in the first segmented Bloom filter;

[0097] The service instance 902 is also used for:

[0098] Mark the first blob filter that has been cleared as an empty blob filter.

[0099] Optionally, the authentication information storage system 900 further includes a first storage space, which is a key-value storage database used to cache all revocation authentication information. The service instance 902 is also used for:

[0100] If a device authentication verification request is received, and the authentication information to be verified carried in the device authentication verification request is revoked authentication information, the authentication information to be verified is sent to the first storage space for verification.

[0101] Receive the verification result returned by the first storage space.

[0102] Optionally, the authentication information storage system 900 further includes a mirror center;

[0103] The mirror center is used to store the target authentication information queue and the target mirror Bloom filter. The target authentication information queue is used to store the revocation authentication information received after the target mirror Bloom filter is built.

[0104] The service instance 902 is also used to, in response to the startup of the service instance, obtain the target authentication information queue and the target image Bloom filter from the image center, and construct the sharded Bloom filter of the service instance based on the target authentication information queue and the target image Bloom filter.

[0105] Optionally, the service instance 902 is used for:

[0106] In the case that the mirror center includes a first authentication information queue, a second authentication information queue, a first mirror Bloom filter, and a second mirror Bloom filter, the first authentication information queue, the second authentication information queue, and the first mirror Bloom filter are obtained from the mirror center;

[0107] The second mirrored Bloom filter is obtained by copying the first mirrored Bloom filter. The first authentication information queue is used to store the revocation authentication information received after the first mirrored Bloom filter is constructed and before the second mirrored Bloom filter is copied. The second authentication information queue is used to store the revocation authentication information received after the second mirrored Bloom filter is copied.

[0108] Service instance 902 is used for:

[0109] Based on the first authentication information queue, the second authentication information queue, and the first mirrored Bloom filter, a sharded Bloom filter for the service instance is constructed.

[0110] Optionally, the mirror center is used for:

[0111] In response to receiving the second revocation authentication information, the second revocation authentication information is written into the first authentication information queue, which is used to store the revocation authentication information received after constructing the first mirror Bloom filter of the mirror center storage;

[0112] Duplicate the first mirrored Bloom filter to obtain the second mirrored Bloom filter;

[0113] The revocation authentication information in the first authentication information queue is written into the second mirrored Bloom filter to obtain the target mirrored Bloom filter.

[0114] Optionally, the mirror center is used for:

[0115] Construct a second authentication information queue and stop writing the received revocation authentication information into the first authentication information queue. The second authentication information queue is used to store the revocation authentication information received after copying the second mirror Bloom filter.

[0116] Delete the first authentication information queue and the first mirrored Bloom filter.

[0117] Optionally, the authentication information storage system 900 further includes a second storage space, which is used to persistently store the full set of revocation authentication information. The mirror center is used for:

[0118] In response to the initial startup of the mirror center, the third revocation authentication information that has not expired is obtained from the second storage space;

[0119] The target mirror Bloom filter is constructed based on the third revocation authentication information.

[0120] Optionally, the authentication information storage system 900 further includes a second storage space and a third storage space. The second storage space is used to persistently store the full amount of revocation authentication information, and the third storage space is used to store compressed mirror Bloom filters corresponding to the mirror Bloom filters historically built by the mirror center. The mirror center is used for:

[0121] In response to the restart of the mirror center, the latest compressed image Bloom filter is loaded from the third storage space;

[0122] Based on the timestamp corresponding to the latest compressed mirror Bloom filter, retrieve the fourth revocation certification information that has not expired and is stored after the timestamp from the second storage space;

[0123] The target mirror Bloom filter is constructed based on the latest compressed mirror Bloom filter and the fourth revocation authentication information.

[0124] Optionally, the service instance 902 is further configured to:

[0125] In response to the update of the service instance, a target authentication information queue and a target image Bloom filter are obtained from the image center. The target authentication information queue is used to store the revocation authentication information received after the target image Bloom filter is constructed.

[0126] Update the sharded Bloom filter of the service instance based on the target authentication information queue and the target image Bloom filter.

[0127] The interaction process between the controller, service instance, mirror center, first storage space, second storage space and third storage space in the above-mentioned device authentication information storage system can be referred to the embodiments of the above-mentioned edge computing device authentication information storage method, and will not be repeated here.

[0128] Based on the same concept, embodiments of this disclosure also provide a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the above-described method for storing authentication information of an edge computing device.

[0129] Based on the same concept, this disclosure also provides an electronic device that may include:

[0130] A storage device on which computer programs are stored;

[0131] A processing device is configured to execute the computer program in the storage device to implement the steps of the above-described method for storing authentication information of an edge computing device.

[0132] Based on the same concept, this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described edge computing device authentication information storage method.

[0133] The following is for reference. Figure 10 The diagram illustrates a structural schematic of an electronic device 1000 suitable for implementing embodiments of the present disclosure. The terminal devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 10 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0134] like Figure 10 As shown, the electronic device 1000 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1008 into a random access memory (RAM) 1003. The RAM 1003 also stores various programs and data required for the operation of the electronic device 1000. The processing unit 1001, ROM 1002, and RAM 1003 are interconnected via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0135] Typically, the following devices can be connected to the I / O interface 1005: input devices 1006 including, for example, a touchscreen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; output devices 1007 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1008 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows electronic device 1000 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 10 An electronic device 1000 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0136] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 1009, or installed from storage device 1008, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of embodiments of this disclosure.

[0137] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0138] In some implementations, communication can be conducted using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol), and can be interconnected with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0139] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0140] The aforementioned computer-readable medium carries one or more programs. When the electronic device executes the one or more programs, the electronic device causes the following: In response to a service instance of the cluster receiving first revocation authentication information, the electronic device determines a first shard Bloom filter from the multiple shard Bloom filters based on the effective expiration time of the first revocation authentication information and a preset time interval corresponding to multiple shard Bloom filters of the service instance, and stores the first revocation authentication information in the first shard Bloom filter, wherein a shard Bloom filter is used to store revocation authentication information whose effective expiration time is within the corresponding preset time interval; and in response to the service instance that all revocation authentication information stored in the first shard Bloom filter has expired, the electronic device clears all revocation authentication information stored in the first shard Bloom filter.

[0141] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0142] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0143] The modules described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules are not, in some cases, intended to limit the functionality of the module itself.

[0144] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0145] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0146] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0147] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0148] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative forms of implementing the claims. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

Claims

1. A method for storing authentication information of an edge computing device, characterized in that, The authentication information storage method includes: In response to a service instance in the cluster receiving first revocation authentication information sent by the controller, the first shard Bloom filter is determined from the multiple shard Bloom filters based on the effective expiration time of the first revocation authentication information and the preset time intervals corresponding to the multiple shard Bloom filters of the service instance. The first shard Bloom filter is then stored in the first shard Bloom filter. The first shard Bloom filter is used to store revocation authentication information whose effective expiration time is within the corresponding preset time interval. Different shard Bloom filters store different revocation authentication information. The controller is used to receive the revocation authentication information and send it to the mirror center, the first storage space, and the service instance in the cluster. The mirror center is used to construct a mirror Bloom filter based on the received revocation authentication information. The first storage space is a key-value storage database used to cache all revocation authentication information and to verify the revocation authentication information carried by the device authentication verification request. The service instance responds to the fact that all revocation authentication information stored in the first sharded Bloom filter has expired, and clears all revocation authentication information stored in the first sharded Bloom filter. The authentication information storage method further includes: In response to the startup of the service instance, the target authentication information queue and the target image Bloom filter are obtained from the image center through the service instance. The target authentication information queue is used to store the revocation authentication information received after the target image Bloom filter is built. The service instance constructs a sharded Bloom filter based on the target authentication information queue and the target image Bloom filter. The mirror center is used to periodically construct the target authentication information queue and the target mirror Bloom filter in the following manner: In response to receiving the second revocation authentication information, the second revocation authentication information is written into the first authentication information queue, which is used to store the revocation authentication information received after the first mirror Bloom filter of the mirror center storage is constructed. Duplicate the first mirrored Bloom filter to obtain the second mirrored Bloom filter; Write the revoked authentication information in the first authentication information queue into the second mirrored Bloom filter to obtain the target mirrored Bloom filter; A second authentication information queue is constructed through the mirror center as the target authentication information queue, and the writing of received revocation authentication information into the first authentication information queue is stopped; the first authentication information queue and the first mirror Bloom filter are deleted.

2. The authentication information storage method for edge computing devices according to claim 1, characterized in that, The step of clearing all revocation authentication information stored in the first sharded Bloom filter by the service instance in response to the expiration of all such information includes: In response to the fact that all revocation authentication information stored in the first sharded Bloom filter has expired, the service instance marks the first sharded Bloom filter as a sharded Bloom filter to be cleared and enables an idle sharded Bloom filter, which corresponds to a new preset time interval. The service instance clears all revocation authentication information stored in the first sharded Bloom filter. The authentication information storage method further includes: The service instance marks the first sharded Bloom filter, which has been cleared, as an idle sharded Bloom filter.

3. The authentication information storage method for edge computing devices according to claim 1, characterized in that, The authentication information storage method further includes: The service instance receives a device authentication verification request. If the authentication information to be verified carried in the device authentication verification request is revoked authentication information, the authentication information to be verified is sent to the first storage space for verification. Receive the verification result returned by the first storage space.

4. The method for storing authentication information of an edge computing device according to any one of claims 1-3, characterized in that, The step of obtaining the target authentication information queue and the target image Bloom filter from the image center through the service instance includes: In the case where the mirror center includes the first authentication information queue, the second authentication information queue, the first mirror Bloom filter, and the second mirror Bloom filter, the first authentication information queue, the second authentication information queue, and the first mirror Bloom filter are obtained from the mirror center through the service instance; The first authentication information queue is used to store the revocation authentication information received after the first mirrored Bloom filter is constructed and before the second mirrored Bloom filter is copied; the second authentication information queue is used to store the revocation authentication information received after the second mirrored Bloom filter is copied. The step of constructing a sharded Bloom filter for the service instance based on the target authentication information queue and the target image Bloom filter includes: The service instance constructs a sharded Bloom filter based on the first authentication information queue, the second authentication information queue, and the first mirrored Bloom filter.

5. The method for storing authentication information of an edge computing device according to any one of claims 1-3, characterized in that, The authentication information storage method further includes: In response to the initial startup of the mirror center, the third revocation authentication information that has not expired is obtained from the second storage space, and the second storage space is used to persistently store the full amount of revocation authentication information; The target mirror Bloom filter is constructed based on the third revocation authentication information.

6. The authentication information storage method for an edge computing device according to claim 4, characterized in that, The authentication information storage method further includes: In response to the restart of the mirror center, the latest compressed mirror Bloom filter is loaded from the third storage space, which is used to store the compressed mirror Bloom filters corresponding to the mirror Bloom filters historically built by the mirror center. Based on the timestamp corresponding to the latest compressed image Bloom filter, the fourth revocation authentication information that has not expired and is stored after the timestamp is obtained from the second storage space. The second storage space is used to persistently store the full amount of revocation authentication information. The target mirror Bloom filter is constructed based on the latest compressed mirror Bloom filter and the fourth revocation authentication information.

7. The method for storing authentication information of an edge computing device according to any one of claims 1-3, characterized in that, The authentication information storage method further includes: In response to the update of the service instance, the target authentication information queue and the target image Bloom filter are obtained from the image center through the service instance. The target authentication information queue is used to store the revocation authentication information received after the target image Bloom filter is constructed. The service instance updates its sharded Bloom filter based on the target authentication information queue and the target image Bloom filter.

8. An authentication information storage system for an edge computing device, characterized in that, The authentication information storage system includes: The controller is used to receive device revocation requests, determine first revocation authentication information based on the device authentication information carried in the device revocation request, and send the first revocation authentication information to the mirror center, the first storage space, and the service instance of the cluster. The service instance includes multiple sharded Bloom filters. The first sharded Bloom filter is used to store revocation authentication information with a valid expiration time within a corresponding preset time interval. Different sharded Bloom filters store different revocation authentication information. The first storage space is a key-value storage database used to cache all revocation authentication information and to verify the revocation authentication information carried in the device authentication verification request. The service instance is configured to respond to receiving the first revocation authentication information, determine the first sharded Bloom filter from the plurality of sharded Bloom filters according to the effective expiration time of the first revocation authentication information and the preset time interval corresponding to the plurality of sharded Bloom filters, and store the first revocation authentication information into the first sharded Bloom filter. The service instance is configured to clear all revocation authentication information stored in the first sharded Bloom filter in response to the fact that all revocation authentication information stored in the first sharded Bloom filter has expired. The mirror center is used to store the target authentication information queue and the target mirror Bloom filter. The target authentication information queue is used to store the revocation authentication information received after the target mirror Bloom filter is constructed. The service instance is also configured to, in response to the startup of the service instance, obtain the target authentication information queue and the target image Bloom filter from the image center, and construct the sharded Bloom filter of the service instance based on the target authentication information queue and the target image Bloom filter. The mirror center is used to periodically construct the target authentication information queue and the target mirror Bloom filter in the following manner: In response to receiving second revocation authentication information, the second revocation authentication information is written into a first authentication information queue, which is used to store revocation authentication information received after the first mirror Bloom filter stored in the mirror center is constructed; the first mirror Bloom filter is copied to obtain a second mirror Bloom filter; the revocation authentication information in the first authentication information queue is written into the second mirror Bloom filter to obtain the target mirror Bloom filter; a second authentication information queue is constructed as the target authentication information queue, and the writing of received revocation authentication information into the first authentication information queue is stopped; the first authentication information queue and the first mirror Bloom filter are deleted.

9. A computer-readable medium having a computer program stored thereon, characterized in that, When executed by a processing device, the computer program performs the steps of the method according to any one of claims 1-7.

10. An electronic device, characterized in that, include: A storage device on which computer programs are stored; A processing device for executing the computer program in the storage device to implement the steps of the method according to any one of claims 1-7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-7.

Images