Authentication data synchronization method, device, medium, product and authentication cluster system

Abstract

The invention discloses an authentication data synchronization method and device, a medium, a product and an authentication cluster system, the system comprises a plurality of authentication clusters, and the authentication clusters are divided into a central authentication cluster and at least one sub-authentication cluster; the method comprises the steps that the central authentication cluster initiates proposals to all the sub-authentication clusters, and globally unified target authentication data is negotiated with the sub-authentication clusters; and the sub-authentication clusters initiate data verification to the central authentication cluster, so that the local authentication data of each authentication cluster is consistent with the target authentication data. By adopting the method and the device, the consistency of the authentication data in each authentication cluster can be determined, so that the accuracy of an authentication result is improved.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to an authentication data synchronization method, device, medium, product, and authentication cluster system. Background Technology

[0002] With the rapid development of cloud computing technology, large-scale deployment and cross-regional collaboration of cloud resources have become the norm. Large cloud platforms such as mobile cloud need to support distributed architectures with multiple resource pools and clusters nationwide to meet the resource access and permission management needs of massive numbers of users. Access control (RAM), as a core security capability of cloud platforms, is responsible for managing user identities and resource access permissions. The accuracy and consistency of its authentication results directly determine the access security and service availability of cloud resources.

[0003] The core of the authentication process relies on the consistency of authentication metadata. However, in multi-cluster distributed deployment scenarios, ensuring the consistency of metadata faces many challenges. Existing cloud platform authentication solutions for multiple clusters only use simple synchronization mechanisms to distribute changed authentication data, which is insufficient to truly ensure the consistency of metadata between clusters and affects the accuracy of authentication results. Summary of the Invention

[0004] The purpose of this invention is to provide an authentication data synchronization method, device, medium, product, and authentication cluster system that can determine the consistency of authentication data in each authentication cluster, thereby improving the accuracy of authentication results.

[0005] To achieve the above objectives, embodiments of the present invention provide an authentication data synchronization method applied to an authentication cluster system. The system includes several authentication clusters, each divided into a central authentication cluster and at least one sub-authentication cluster. The method includes: The central authentication cluster initiates a proposal to all the sub-authentication clusters and negotiates globally unified target authentication data with the sub-authentication clusters. The sub-authentication clusters initiate data verification to the central authentication cluster to ensure that the authentication data in each authentication cluster is consistent with the target authentication data.

[0006] As an improvement to the above scheme, the authentication cluster in the resource pool where the management console is located is used as the central authentication cluster; wherein, the management console refers to the user's operating platform.

[0007] As an improvement to the above scheme, the step of the central authentication cluster initiating a proposal to all the sub-authentication clusters and negotiating globally unified target authentication data with the sub-authentication clusters specifically involves: The central authentication cluster sends a proposal request to all the sub-authentication clusters; wherein, the proposal request includes a proposal number, which is globally unique and increments; When the sub-authentication cluster has not received any historical proposal requests, or determines that the proposal number is greater than the historical proposal number, it returns a commitment response to the central authentication cluster. The commitment response is used to promise not to receive proposal requests with smaller proposal numbers, and includes the historical proposal value corresponding to the largest historical proposal number, where the historical proposal value is the hash value of the historical authentication data. Alternatively, when it determines that the proposal number is not greater than the historical proposal number, it does not return a response. When the number of commitment responses received by the central authentication cluster exceeds half of the total number of clusters, if none of the commitment responses are accompanied by a historical proposal value, the central authentication cluster calculates a hash value from the local authentication data and uses it as the proposal value; if at least one of the commitment responses is accompanied by a historical proposal value, the historical proposal value corresponding to the largest proposal number is selected as the proposal value; a formal proposal is generated based on the proposal value, and the formal proposal is broadcast to all the sub-authentication clusters. After receiving the formal proposal, the sub-authentication cluster compares the proposal value with the hash value of the local authentication data. If the comparison results match, it returns a receive response; if the comparison results do not match, it returns a rejection response. When the number of accepted responses received by the central authentication cluster exceeds half of the total number of clusters, the central authentication cluster determines that the formal proposal has been achieved and uses the authentication data corresponding to the proposal value in the formal proposal as the target authentication data; otherwise, it re-initiates a proposal request to all the sub-authentication clusters.

[0008] As an improvement to the above scheme, the step of initiating data verification from the sub-authentication cluster to the central authentication cluster to ensure that the authentication data locally in each authentication cluster is consistent with the target authentication data includes: The sub-authentication cluster sends a data verification request to the central authentication cluster; wherein the data verification request includes the hash value of the local authentication data; The central authentication cluster compares the hash value in the data verification request with the hash value of the target authentication data. If the comparison results match, a verification response indicating successful verification is returned. If the comparison results do not match, a verification failure response and a verification response for the target authentication data are returned. When the sub-authentication cluster receives a successful authentication response, it keeps its local authentication data unchanged; or when it receives a failed authentication response, it overwrites its local authentication data with the target authentication data and resends the data verification request to the central authentication cluster.

[0009] As an improvement to the above solution, the method further includes: The sub-authentication cluster compares the hash value of the local authentication data with the hash value of the target authentication data according to a first preset period to obtain a comparison result; If the comparison results for the first preset number of consecutive times are inconsistent, the sub-authentication cluster is determined to be abnormal, the sub-authentication cluster is removed from the authentication cluster system, and a preset optimal path selection method is used to select other nearby clusters as authentication sub-clusters and add them to the authentication cluster system.

[0010] As an improvement to the above solution, the method further includes: The central authentication cluster sends a first liveness detection request to all the sub-authentication clusters according to a second preset period. If the sub-authentication cluster fails to return a liveness detection response for a second consecutive preset number of times, the sub-authentication cluster is determined to be abnormal, and the sub-authentication cluster is removed from the authentication cluster system. A preset optimal path selection method is used to select other nearby clusters as authentication sub-clusters and add them to the authentication cluster system. As an improvement to the above scheme, the sub-authentication cluster sends a second liveness detection request to the central authentication cluster according to a third preset period. If the central authentication cluster fails to return a liveness detection response for the third consecutive preset number of times, the central authentication cluster is determined to be abnormal, and the central authentication cluster is removed from the authentication cluster system, and a new central authentication cluster is designated.

[0011] This invention also provides an authentication cluster system, which includes several authentication clusters, and the authentication clusters are divided into a central authentication cluster and at least one sub-authentication cluster. The central authentication cluster initiates a proposal to all the sub-authentication clusters and negotiates globally unified target authentication data with the sub-authentication clusters. The sub-authentication clusters initiate data verification to the central authentication cluster to ensure that the authentication data of each authentication cluster is consistent with the target authentication data.

[0012] This invention also provides an authentication data synchronization device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the authentication data synchronization method as described in any of the above embodiments.

[0013] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the authentication data synchronization method as described in any of the above embodiments.

[0014] This invention also provides a computer program product, which includes a computer program or computer instructions. When the computer program or computer instructions are executed by a processor, they implement the authentication data synchronization method as described in any of the above embodiments.

[0015] Compared with existing technologies, the authentication data synchronization method, device, medium, product, and authentication cluster system disclosed in this invention, compared with traditional solutions that only distribute authentication data through a simple synchronization mechanism, introduce authentication data synchronization functionality in each authentication cluster. An authentication cluster is selected as the central authentication cluster, and the other authentication clusters are designated as sub-authentication clusters. The central authentication cluster initiates proposals to the sub-authentication clusters, and globally unified target authentication data is determined through negotiation between the clusters. Data verification ensures that all resource pool clusters use the same target authentication data, guaranteeing the synchronization of authentication data between clusters. This also avoids livelock problems caused by multiple proposers, reduces invalid negotiation interactions, and improves the efficiency of authentication data negotiation. This invention addresses the issue of inconsistent authentication data caused by network packet loss, network attacks, node failures, etc., for authentication systems deployed across multiple resource pools and clusters nationwide. It helps ensure the consistency of authentication data across multiple authentication clusters, thereby improving the accuracy of authentication results. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an authentication data synchronization method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of an authentication cluster system provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a preferred authentication cluster system in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] In the description of this application, it should be understood that the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0019] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0020] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0021] See Figure 1 and Figure 2 , Figure 1 This is a flowchart illustrating an authentication data synchronization method provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of an authentication cluster system provided in an embodiment of the present invention. The embodiment of the present invention provides an authentication data synchronization method, which is applied to an authentication cluster system 10. The system 10 includes several authentication clusters, and the authentication clusters are divided into a central authentication cluster 11 and at least one sub-authentication cluster 12.

[0022] The method includes steps S11 and S12: S11. The central authentication cluster initiates a proposal to all the sub-authentication clusters and negotiates globally unified target authentication data with the sub-authentication clusters. S12. The sub-authentication cluster initiates data verification to the central authentication cluster so that the authentication data of each authentication cluster is consistent with the target authentication data.

[0023] In this embodiment of the invention, the authentication cluster system 10 includes multiple authentication clusters, which are deployed in a resource pool. Among the multiple authentication clusters, one authentication cluster is elected as the central authentication cluster, and the other authentication clusters are designated as sub-authentication clusters.

[0024] The central authentication cluster is an authentication cluster within an independent resource pool. As the globally unique master proposer, it is responsible for initiating consensus negotiation and managing global authentication data. The sub-authentication clusters are authentication clusters distributed across multiple resource pools in various regions. Each resource pool corresponds to one or more sub-authentication clusters, which act as receivers, responding to negotiation requests from the central authentication cluster and participating in authentication data verification. At least one authentication cluster is deployed within each resource pool; this can be either a central cluster or a sub-authentication cluster.

[0025] To ensure consistency of authentication data across all authentication clusters, after determining the central authentication cluster and sub-authentication clusters, the central authentication cluster initiates a proposal to all sub-authentication clusters. The central authentication cluster then negotiates globally unified target authentication data with each sub-authentication cluster. Next, each sub-authentication cluster initiates data verification with the central authentication cluster to check if its local authentication data matches the target authentication data. If discrepancies are found, authentication data synchronization is performed to ensure consistency between the local and target authentication data.

[0026] To avoid the livelock problem caused by multiple proposers, this embodiment of the invention allows only one central authentication cluster to be elected in the authentication cluster system. The central authentication cluster acts as the sole primary proposer, while other clusters act as acceptors and do not have the right to initiate proposals. Acceptors do not need to choose among multiple proposals; they only need to respond to the request of the sole proposer. The negotiation process proceeds unidirectionally, thereby avoiding the situation where multiple proposals cause conflicts and prevent the global consensus protocol from being reached, thus ensuring negotiation efficiency.

[0027] Compared to traditional solutions that distribute authentication data solely through a simple synchronization mechanism, this invention introduces authentication data synchronization functionality across various authentication clusters. It selects one authentication cluster as the central cluster and the others as sub-clusters. The central cluster initiates proposals to the sub-clusters, negotiating to determine globally unified target authentication data. Data verification ensures that all resource pool clusters use the same target authentication data, avoiding livelock issues caused by multiple proposers, reducing ineffective negotiation interactions, and improving authentication data negotiation efficiency. This invention addresses the issue of inconsistent authentication data caused by network packet loss, network attacks, and node failures in authentication systems deployed across multiple resource pools and clusters nationwide. It helps ensure the consistency of authentication data across multiple authentication clusters, thereby improving the accuracy of authentication results.

[0028] As a preferred embodiment, this invention further implements the above embodiments, using the authentication cluster in the resource pool where the management console is located as the central authentication cluster; wherein, the management console refers to the user's operating platform.

[0029] In this embodiment of the invention, the management console serves as the interactive entry point for users to initiate metadata change operations. It is responsible for receiving user-input authentication data change requests and synchronizing the changed authentication data to each authentication cluster. Data synchronization methods include, but are not limited to, broadcasting, API calls, and semaphores.

[0030] Since the authentication cluster of the resource pool where the management console is located and the data operated by users are in the same cluster, the data reliability is the highest. Therefore, the authentication cluster in the resource pool where the management console is located is set as the central authentication cluster.

[0031] By employing the technical means of this invention, and using the authentication cluster in the resource pool where the management console is located as the sole central authentication cluster, it is beneficial to improve data reliability and data accuracy.

[0032] As a preferred embodiment, this invention further implements the above embodiments. Step S11, namely, the central authentication cluster initiating a proposal to all the sub-authentication clusters and negotiating globally unified target authentication data with the sub-authentication clusters, specifically involves: The central authentication cluster sends a proposal request to all the sub-authentication clusters; wherein, the proposal request includes a proposal number, which is globally unique and increments; When the sub-authentication cluster has not received any historical proposal requests, or determines that the proposal number is greater than the historical proposal number, it returns a commitment response to the central authentication cluster. The commitment response is used to promise not to receive proposal requests with smaller proposal numbers, and includes the historical proposal value corresponding to the largest historical proposal number, where the historical proposal value is the hash value of the historical authentication data. Alternatively, when it determines that the proposal number is not greater than the historical proposal number, it does not return a response. When the number of commitment responses received by the central authentication cluster exceeds half of the total number of clusters, if none of the commitment responses are accompanied by a historical proposal value, the central authentication cluster calculates a hash value from the local authentication data and uses it as the proposal value; if at least one of the commitment responses is accompanied by a historical proposal value, the historical proposal value corresponding to the largest proposal number is selected as the proposal value; a formal proposal is generated based on the proposal value, and the formal proposal is broadcast to all the sub-authentication clusters. After receiving the formal proposal, the sub-authentication cluster compares the proposal value with the hash value of the local authentication data. If the comparison results match, it returns a receive response; if the comparison results do not match, it returns a rejection response. When the number of accepted responses received by the central authentication cluster exceeds half of the total number of clusters, the central authentication cluster determines that the formal proposal has been achieved and uses the authentication data corresponding to the proposal value in the formal proposal as the target authentication data; otherwise, it re-initiates a proposal request to all the sub-authentication clusters.

[0033] See Figure 3 This is a schematic diagram of the structure of a preferred authentication cluster system in an embodiment of the present invention. Each authentication cluster includes an authentication module and a data consistency detection module. The authentication module is used to perform authentication operations, and specific details can be found in the relevant prior art, which will not be elaborated here. The data consistency detection module is responsible for performing the relevant steps of the authentication data synchronization method in the embodiment of the present invention, such as periodically detecting the consistency between local metadata and the central cluster, participating in authentication data verification, identifying and removing faulty nodes, etc.

[0034] In this embodiment of the invention, users can perform operations such as creating, updating, or deleting authentication data through the mobile cloud management console, for example, adding RAM user permissions, modifying resource access policies, and deleting expired authorization rules. After receiving the authentication data change request, the management console will synchronize the changed metadata to the authentication clusters of all resource pools nationwide, including the central authentication cluster and all non-central authentication clusters, through broadcasting, interface calls, or semaphores, to ensure that each cluster initially obtains the latest authentication data candidate values.

[0035] The consistency detection module of the central authentication cluster initiates the negotiation process and generates a globally unique proposal number n. Optionally, the proposal number generation rule can adopt a combination of "timestamp + cluster identifier" to ensure that the number is unique and monotonically increasing. The module then broadcasts a proposal request to all sub-authentication clusters. The request content includes the proposal number n, but does not contain any specific authentication data value.

[0036] After receiving a proposal request, each sub-authentication cluster processes it using its local consistency detection module: if the proposal number n is greater than all proposal request numbers previously received by the cluster, it returns a commitment response to the central authentication cluster, promising not to accept proposals with numbers less than n in the future, and attaching the hash value of the authentication data corresponding to the largest proposal number less than n among the proposals previously accepted by the cluster; if no proposals have been accepted, it returns an empty value; if the proposal number n is not greater than the largest number received in history, it ignores the request and does not return any response.

[0037] The central authentication cluster collects commitment responses from each sub-authentication cluster within a preset timeout period. When it receives commitment responses from a majority of clusters (more than 50% of the total number of clusters), it performs the following processing: If none of the responses include a hash value of the authentication data (i.e., no cluster has accepted the previous proposal), the central authentication cluster uses a secure hash algorithm such as SHA-256 to calculate a hash value for the locally synchronized authentication data, uses this hash value as the proposal value, keeps the proposal number n unchanged, and broadcasts the formal proposal to all clusters; If some responses include a hash value of the authentication data, the hash value with the largest corresponding proposal number is selected from these hash values ​​as the proposal value, keeps the proposal number n unchanged, and broadcasts the formal proposal to all clusters. The formal proposal includes the proposal number n and the hash value of the authentication data used as the proposal value.

[0038] After receiving the formal proposal, each sub-authentication cluster calculates the hash value of its local authentication data using the consistency detection module and compares it with the hash value in the formal proposal. If they match, an acceptance response is returned; otherwise, a rejection response is returned.

[0039] The central authentication cluster counts the number of responses received within a preset timeout period. If the number of responses exceeds half of the total number of clusters, the formal proposal is deemed to have been achieved, and the authentication data corresponding to the hash value in the formal proposal is the globally unified target authentication data. If the number of responses does not reach half, a new proposal request is initiated, with the proposal number incremented.

[0040] In a preferred implementation, step S12, namely, the process of the sub-authentication cluster initiating data verification to the central authentication cluster to ensure that the authentication data locally of each authentication cluster is consistent with the target authentication data, includes: The sub-authentication cluster sends a data verification request to the central authentication cluster; wherein the data verification request includes the hash value of the local authentication data; The central authentication cluster compares the hash value in the data verification request with the hash value of the target authentication data. If the comparison results match, a verification response indicating successful verification is returned. If the comparison results do not match, a verification failure response and a verification response for the target authentication data are returned. When the sub-authentication cluster receives a successful authentication response, it keeps its local authentication data unchanged; or when it receives a failed authentication response, it overwrites its local authentication data with the target authentication data and resends the data verification request to the central authentication cluster.

[0041] In this embodiment of the invention, all sub-authentication clusters send a data verification request to the central authentication cluster, carrying the hash value of their local authentication data, for final verification. The central authentication cluster compares the hash value sent by the sub-authentication clusters with the globally unified hash value. If the comparison matches, the central authentication cluster returns a verification passed response. Upon receiving the verification passed response, the sub-authentication clusters keep their local data unchanged and provide authentication services normally. If the comparison does not match, the central authentication cluster returns a verification failed response along with the complete target authentication data (or data acquisition channel) corresponding to the globally unified hash value. After receiving the target authentication data, the sub-authentication clusters overwrite the erroneous local data and resend the data verification request to ensure that the authentication data is synchronized and consistent.

[0042] By employing the technical means of this invention, a negotiation mechanism between the central authentication cluster and each sub-authentication cluster is used. Through a three-stage process of proposal, commitment, and confirmation, this ensures that a majority of clusters reach metadata consensus, preventing data errors from a single node from affecting the entire system. A globally unique and monotonically increasing proposal numbering rule ensures unidirectional progress in the negotiation process, significantly improving consistency detection efficiency. Furthermore, a hash value is used to verify the integrity of authentication metadata, preventing tampering during transmission or storage and ensuring the accuracy of the authentication basis.

[0043] As a preferred embodiment, the present invention is further implemented based on any of the above embodiments, and the method further includes steps S13 and S14: S13. The sub-authentication cluster compares the hash value of the local authentication data with the hash value of the target authentication data according to a first preset period to obtain a comparison result. S14. If the comparison results of the first preset number of consecutive times are inconsistent, the sub-authentication cluster is determined to be abnormal, the sub-authentication cluster is removed from the authentication cluster system, and other neighboring clusters are selected as authentication sub-clusters and added to the authentication cluster system using a preset optimal path selection method.

[0044] In this embodiment of the invention, the authentication data synchronization method also introduces a timed consistency detection mechanism. The consistency detection module of each sub-authentication cluster performs detection at a fixed period (e.g., 1 minute), calculates the hash value of the local authentication data, and compares it with the globally unified hash value of the central authentication cluster. If the detection results are inconsistent for multiple consecutive times (e.g., 3 times), the sub-authentication cluster is determined to be abnormal and is automatically removed from the authentication cluster system.

[0045] When some clusters fail and are removed, authentication requests from that resource pool are routed to the nearest, geographically adjacent, and least latency-lacking normal cluster using an optimal path selection method to provide auxiliary authentication services, ensuring uninterrupted user access. For example, if a resource pool cluster in a certain region fails, the system automatically routes authentication requests from that region to a normal cluster in a neighboring region, completing authentication based on globally unified metadata.

[0046] Optionally, abnormal information can also be reported to the operation and maintenance platform. This abnormal information alarm includes cluster ID, abnormal time, hash value differences, etc. The operation and maintenance platform is used to receive cluster abnormality reports and supports operation and maintenance personnel in handling faulty nodes.

[0047] Optionally, after the abnormal cluster is repaired, the hash value of the authentication data needs to be recalculated and a verification request needs to be sent to the central authentication cluster. Only after the verification is passed can the data be rejoined to the authentication cluster system.

[0048] In a preferred embodiment, the method further includes steps S15 and S16: S15. The central authentication cluster sends a first liveness detection request to all the sub-authentication clusters according to a second preset period. S16. If the sub-authentication cluster fails to return a liveness detection response for a second consecutive preset number of times, the sub-authentication cluster is determined to be abnormal. The sub-authentication cluster is removed from the authentication cluster system, and a preset optimal path selection method is used to select other nearby clusters as authentication sub-clusters and add them to the authentication cluster system. In this embodiment of the invention, a cluster liveness detection and switching mechanism is also introduced. The central authentication cluster sends liveness detection requests to all sub-clusters at a fixed period (e.g., 30 seconds). If a sub-cluster fails to respond multiple times (e.g., 3 times) consecutively, it is determined to be a faulty node and removed from the authentication cluster system. Subsequent negotiation processes ignore this node. Similarly, a preset optimal path selection method is used to select other nearby clusters to submit authentication requests. These clusters are selected as authentication sub-clusters and added to the authentication cluster system.

[0049] In a preferred embodiment, the method further includes steps S17 and S18: S17. The sub-authentication cluster sends a second liveness detection request to the central authentication cluster according to a third preset period. S18. If the central authentication cluster fails to return a liveness detection response for the third consecutive preset number of times, the central authentication cluster is determined to be abnormal, the central authentication cluster is removed from the authentication cluster system, and a new central authentication cluster is designated.

[0050] In this embodiment of the invention, each sub-authentication cluster also sends a liveness detection request to the central authentication cluster at a fixed period. If no response is received from the central authentication cluster for several consecutive times (e.g., 3 times), the central authentication cluster is determined to be faulty.

[0051] When the central cluster fails, the system automatically designates the next operational cluster as the new central authentication cluster, following the ascending order of resource pool numbers. Simultaneously, the central node configurations of all clusters are updated, and the consistency negotiation process is restarted. This message also needs to be reported to the operations and maintenance system platform.

[0052] By employing the technical means of this invention, timely consistency detection and dynamic synchronization calibration are used to promptly detect and correct metadata deviations in a few clusters, ensuring real-time consistency of all cluster data. The bidirectional liveness detection mechanism between the central authentication cluster and sub-authentication clusters enables rapid identification and removal of faulty nodes, preventing fault propagation. Furthermore, in the event of a failure in the central authentication cluster, a new central cluster is automatically elected, and requests from the faulty resource pool are routed to the normal cluster via the optimal path, achieving seamless switching and ensuring uninterrupted authentication services, thus improving the cloud platform user experience. After repair, abnormal clusters can be automatically rejoined to the cluster group without manual intervention, reducing operational costs.

[0053] See Figure 2 This invention provides an authentication cluster system 10, which includes several authentication clusters, and the authentication clusters are divided into a central authentication cluster 11 and at least one sub-authentication cluster 12.

[0054] The central authentication cluster 11 initiates a proposal to all the sub-authentication clusters 12 and negotiates globally unified target authentication data with the sub-authentication clusters. The sub-authentication cluster 12 initiates data verification to the central authentication cluster 11 to ensure that the authentication data of each authentication cluster is consistent with the target authentication data.

[0055] It should be noted that the authentication cluster system provided in this embodiment of the invention is used to execute all the process steps of the authentication data synchronization method in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0056] This invention also provides an authentication data synchronization device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the authentication data synchronization method as described in any of the above embodiments.

[0057] It should be noted that the authentication data synchronization device provided in this embodiment of the invention is used to execute all the process steps of the authentication data synchronization method in the above embodiment. The working principle and beneficial effect of the two are one-to-one, so they will not be described again.

[0058] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the authentication data synchronization method as described in any of the above embodiments.

[0059] This invention also provides a computer program product, which includes a computer program or computer instructions. When the computer program or computer instructions are executed by a processor, they implement the authentication data synchronization method as described in any of the above embodiments.

[0060] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0061] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for synchronizing authentication data, characterized in that, The method is applied to an authentication cluster system, the system comprising several authentication clusters, the authentication clusters being divided into a central authentication cluster and at least one sub-authentication cluster; the method includes: The central authentication cluster initiates a proposal to all the sub-authentication clusters and negotiates globally unified target authentication data with the sub-authentication clusters. The sub-authentication clusters initiate data verification to the central authentication cluster to ensure that the authentication data in each authentication cluster is consistent with the target authentication data.

2. The authentication data synchronization method as described in claim 1, characterized in that, The central authentication cluster is the authentication cluster located in the resource pool where the management console is located; wherein, the management console refers to the user's operating platform.

3. The authentication data synchronization method as described in claim 1, characterized in that, The process of the central authentication cluster proposing to all the sub-authentication clusters and negotiating globally unified target authentication data with the sub-authentication clusters specifically involves: The central authentication cluster sends a proposal request to all the sub-authentication clusters; wherein, the proposal request includes a proposal number, which is globally unique and increments; When the sub-authentication cluster has not received any historical proposal requests, or determines that the proposal number is greater than the historical proposal number, it returns a commitment response to the central authentication cluster. The commitment response is used to promise not to receive proposal requests with smaller proposal numbers, and includes the historical proposal value corresponding to the largest historical proposal number, where the historical proposal value is the hash value of the historical authentication data. Alternatively, when it determines that the proposal number is not greater than the historical proposal number, it does not return a response. When the number of commitment responses received by the central authentication cluster exceeds half of the total number of clusters, if none of the commitment responses are accompanied by a historical proposal value, the central authentication cluster calculates a hash value from the local authentication data and uses it as the proposal value; if at least one of the commitment responses is accompanied by a historical proposal value, the historical proposal value corresponding to the largest proposal number is selected as the proposal value; a formal proposal is generated based on the proposal value, and the formal proposal is broadcast to all the sub-authentication clusters. After receiving the formal proposal, the sub-authentication cluster compares the proposal value with the hash value of the local authentication data. If the comparison results match, it returns a receive response; if the comparison results do not match, it returns a rejection response. When the number of accepted responses received by the central authentication cluster exceeds half of the total number of clusters, the central authentication cluster determines that the formal proposal has been achieved and uses the authentication data corresponding to the proposal value in the formal proposal as the target authentication data; otherwise, it re-initiates a proposal request to all the sub-authentication clusters.

4. The authentication data synchronization method as described in claim 1, characterized in that, The step of initiating data verification from the sub-authentication cluster to the central authentication cluster to ensure that the authentication data locally in each authentication cluster is consistent with the target authentication data includes: The sub-authentication cluster sends a data verification request to the central authentication cluster; wherein the data verification request includes the hash value of the local authentication data; The central authentication cluster compares the hash value in the data verification request with the hash value of the target authentication data. If the comparison results match, a verification response indicating successful verification is returned. If the comparison results do not match, a verification failure response and a verification response for the target authentication data are returned. When the sub-authentication cluster receives a successful authentication response, it keeps its local authentication data unchanged; or when it receives a failed authentication response, it overwrites its local authentication data with the target authentication data and resends the data verification request to the central authentication cluster.

5. The authentication data synchronization method as described in any one of claims 1 to 4, characterized in that, The method further includes: The sub-authentication cluster compares the hash value of the local authentication data with the hash value of the target authentication data according to a first preset period to obtain a comparison result; If the comparison results for the first preset number of consecutive times are inconsistent, the sub-authentication cluster is determined to be abnormal, the sub-authentication cluster is removed from the authentication cluster system, and a preset optimal path selection method is used to select other nearby clusters as authentication sub-clusters and add them to the authentication cluster system.

6. The authentication data synchronization method as described in any one of claims 1 to 4, characterized in that, The method further includes: The central authentication cluster sends a first liveness detection request to all the sub-authentication clusters according to a second preset period. If the sub-authentication cluster fails to return a liveness detection response for a second consecutive preset number of times, the sub-authentication cluster is determined to be abnormal, and the sub-authentication cluster is removed from the authentication cluster system. A preset optimal path selection method is used to select other nearby clusters as authentication sub-clusters and add them to the authentication cluster system. And / or, The sub-authentication cluster sends a second liveness detection request to the central authentication cluster according to a third preset period; If the central authentication cluster fails to return a liveness detection response for the third consecutive preset number of times, the central authentication cluster is determined to be abnormal, and the central authentication cluster is removed from the authentication cluster system, and a new central authentication cluster is designated.

7. An authentication cluster system, characterized in that, The system includes several authentication clusters, which are divided into a central authentication cluster and at least one sub-authentication cluster. The central authentication cluster initiates a proposal to all the sub-authentication clusters and negotiates globally unified target authentication data with the sub-authentication clusters. The sub-authentication clusters initiate data verification to the central authentication cluster to ensure that the authentication data of each authentication cluster is consistent with the target authentication data.

8. An authentication data synchronization device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the authentication data synchronization method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the authentication data synchronization method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program or computer instructions, which, when executed by a processor, implement the authentication data synchronization method as described in any one of claims 1 to 6.

Images