Dual-computer hot standby data synchronization method and system based on national secret algorithm

Abstract

The invention discloses a dual-computer hot standby data synchronization method and system based on a cryptographic algorithm, and relates to the technical field of computer network security. According to the method, a double-master mode is adopted, servers at the two ends operate as independent master nodes, TCP services are established, and a peer-to-peer network is formed. Different from the traditional one-way copy of a master-slave mode, the method provided by the invention ensures that the other party takes over seamlessly when any party fails by realizing bidirectional synchronization. And synchronization is only responsible for one thread, so that the system complexity is greatly reduced. Certificates and key data needing to be synchronized are persisted to a local synchronization file and then transmitted through an encrypted TCP channel. External dependence (such as a database or middleware) is avoided, pure code implementation is achieved, and deployment is convenient.

Description

Technical Field

[0001] This invention discloses a dual-machine hot standby data synchronization method and system based on national cryptographic algorithms, which relates to the field of computer network security technology. Background Technology

[0002] In distributed systems, dual-machine hot standby is a core mechanism for ensuring high availability and data consistency, especially in the financial, government, and security sectors, where the management of certificates (such as digital certificates) and keys (such as encryption keys) requires extremely high security and reliability. Certificates typically include a public key, signature, and validity information, used for authentication; keys are used for encryption / decryption operations. The loss or inconsistency of this data can lead to system paralysis, security vulnerabilities, or compliance violations.

[0003] Existing dual-machine hot standby solutions mostly employ a master-slave model, where the master node handles primary data operations, while the slave node passively replicates data. While simple, this model has significant drawbacks: when the master node fails, manual or automatic failover to the slave node becomes the new master is required, potentially leading to brief service interruptions (typically a few seconds to a few minutes) and data inconsistencies (e.g., loss of write operations during failover). Furthermore, existing solutions often rely on multi-threaded synchronization mechanisms for data transmission, increasing thread management overhead, potential deadlock risks, and system instability. For example, multi-threading can cause synchronization delays or crashes due to resource contention, particularly pronounced in high-concurrency scenarios.

[0004] Regarding data format, traditional solutions often use simple database logs (such as MySQL Binlog) or JSON / XML files to store synchronized data. This lack of efficient indexing mechanisms means that finding synchronized / unsynchronized data requires a full scan, resulting in low efficiency and an inability to support rapid recovery (for example, querying the synchronization status of a specific certificate may require traversing the entire file). While open-source message queues like Kafka offer log-style storage (Kafka's Partition Log), these formats are not optimized for the structured characteristics of certificates / keys (such as nested certificate structures or binary key representations) and do not integrate national cryptographic algorithms, making them non-compliant in environments with high localization requirements.

[0005] In terms of transmission security, existing technologies mostly rely on international encryption standards (such as TLS based on RSA / AES). However, in scenarios requiring localized encryption (such as Chinese national standards), Chinese cryptographic algorithms (SM2, SM3, SM4) must be used to ensure compliance. However, key negotiation in current solutions is often embedded in the TLS protocol, without providing a custom lightweight Chinese cryptographic negotiation, leading to compatibility issues and additional overhead (such as the computational burden of certificate chain verification).

[0006] The offline recovery mechanism is also a pain point: existing systems often require full synchronization or manual intervention after a node goes offline for a short time, and cannot automatically catch up, especially under high-frequency CRUD operations, which can easily lead to data backlog. For example, in a certificate management system, if a new certificate is issued during a node downtime, the entire dataset may need to be transmitted during recovery, causing network burden and time delay.

[0007] Furthermore, the synchronization of CRUD operations is often achieved through database replication (such as PostgreSQL Streaming Replication) in existing solutions. However, this approach is not optimized for handling unstructured data such as certificates / keys, resulting in insufficient stability and an inability to guarantee zero data loss in extreme scenarios (such as power failures or network jitter). Summary of the Invention

[0008] This invention addresses the problems of existing technologies by providing a dual-machine hot standby data synchronization method and system based on national cryptographic algorithms. The technical solution adopted is as follows: Firstly, a dual-machine hot standby data synchronization method based on national cryptographic algorithms includes: S1, Obtain the client's connection request data, and perform connection establishment processing through TCP three-way handshake operation based on the connection request data to obtain a connected TCP socket object; S2, Based on the TCP socket object, perform connection verification processing through port listening and handshake confirmation to obtain a TCP communication channel; S3, based on the server's public key certificate, perform negotiation request processing through the key exchange initialization operation of the SM2 algorithm to obtain the temporary key pair data generated by the client; S4. Based on the temporary key pair data, perform shared key calculation processing using elliptic curves to obtain preliminary shared secret data; S5, based on the temporary key pair data, key material exchange processing is performed through encrypted transmission to obtain the key negotiation packet received by the server; S6. Based on the key negotiation packet, perform integrity verification processing using the SM3 hash function, and obtain key material data through verification; S7. Based on the preliminary secret sharing data, the symmetric session key is obtained by processing it through the SM4 key derivation function; S8. Based on the symmetric session key, key enhancement processing is performed through random number injection to obtain secure session key data; S9. Based on the secure session key data, a negotiation and confirmation process is performed through the cryptographic challenge response to obtain the consistency verification result between the server and the client; S10, based on the verification result, an abnormal reset is performed to obtain a complete key negotiation completion status.

[0009] In some implementations, S2 includes: S21, Based on the server and client, establish a TCP service in dual-master mode, and use a single synchronization thread to synchronize the public key certificate and key data; S22, based on the data format, integrate national cryptographic verification and status as extended by setting synchronization files and index files to perform CRUD synchronization.

[0010] In some implementations, S3 includes: S31, Based on the synchronization file and index file, the temporary key is used to distinguish between synchronized and unsynchronized data by using the synchronization status bit; S32, perform a binary search based on the index entries in the index file to obtain a time complexity of O(log n).

[0011] In some implementations, S9 includes querying the other party's offset, extracting local incremental data, and detecting based on the secure session key data by setting up intelligent recovery.

[0012] Secondly, embodiments of the present invention provide a dual-machine hot standby data synchronization system based on national cryptographic algorithms, comprising: The communication connection module is used to obtain the client's connection request data, and to perform connection establishment processing through TCP three-way handshake operation based on the connection request data to obtain a connected TCP socket object. The channel establishment module is used to perform connection verification processing through port listening and handshake confirmation based on the TCP socket object to obtain a TCP communication channel; The request processing module is used to process the negotiation request based on the server's public key certificate and the key exchange initialization operation of the SM2 algorithm to obtain the temporary key pair data generated by the client. The key processing module is used to perform shared key calculation processing on the temporary key pair data using elliptic curves to obtain preliminary shared secret data. The key conversion module is used to perform key material exchange processing based on the temporary key pair data through encrypted transmission to obtain the key negotiation packet received by the server; The key verification module is used to perform integrity verification processing on the key negotiation packet using the SM3 hash function, and obtain the key material data through verification. Key encryption processing is used to process the initial secret sharing data using the SM4 key derivation function to obtain a symmetric session key; The key optimization module is used to perform key enhancement processing by random number injection based on the symmetric session key to obtain secure session key data; The verification processing module is used to perform negotiation and confirmation processing based on the secure session key data through the cryptographic challenge response, and obtain the consistency verification result between the server and the client; The synchronization optimization module is used to process the verification results through an abnormal reset to obtain a complete key negotiation completion status.

[0013] In some implementations, the channel construction module includes: The data processing unit is used to establish a TCP service in a dual-master mode based on the server and the client, and to synchronize the public key certificate and key data using a single synchronization thread; The data synchronization unit is used to perform CRUD synchronization by integrating national cryptographic verification and status into the synchronization file and index file according to the data format.

[0014] In some implementations, the request processing module includes: An index building unit is used to distinguish whether the data of the temporary key is synchronized or not based on the synchronization file and the index file, using a synchronization status bit. The index optimization unit is used to perform a binary search based on the index entries in the index file, resulting in a time complexity of O(log n).

[0015] In some implementations, the verification processing module is further configured to query the other party's offset, extract local incremental data, and perform detection based on the secure session key data by setting up intelligent recovery.

[0016] Thirdly, embodiments of the present invention provide an electronic device, including a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein when the one or more computer instructions are executed by the processor, they implement the method described in the first aspect above.

[0017] Fourthly, embodiments of the present invention provide a computer storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, it implements the method described in the first aspect.

[0018] One or more embodiments of the present invention can bring at least the following beneficial effects: The beneficial effects of this invention are as follows: The method employs a dual-master mode, with both servers operating as independent master nodes, establishing a TCP service and forming a peer-to-peer network. Unlike the unidirectional replication of traditional master-slave modes, this invention achieves bidirectional synchronization, ensuring seamless takeover by the other party in the event of a failure on either side. Synchronization is handled by a single thread, significantly reducing system complexity. Certificate and key data requiring synchronization are first persisted to a local synchronization file and then transmitted via an encrypted TCP channel. It has no external dependencies (such as databases or middleware), is implemented purely in code, and is easy to deploy. This invention utilizes a peer-to-peer architecture, single-threaded simplification, and deep integration with national cryptographic standards, rather than relying on traditional master-slave or multi-threaded modes. Its innovation lies in dual-master peer-to-peer, single-threaded batch processing, and incremental recovery, significantly reducing complexity and risk. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the architecture of a dual-machine hot standby data synchronization system based on national cryptographic algorithms provided by an embodiment of the present invention; Figure 2 This is a schematic diagram of the data format provided in the embodiments of the present invention; Figure 3 This is a schematic diagram of the synchronization recovery process provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the key negotiation timing verification process provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the status bit management process provided in an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0022] Example 1: Figure 1 A flowchart of a dual-machine hot standby data synchronization method based on Chinese cryptographic algorithms is shown, as follows: Figure 1 As shown, the dual-machine hot standby data synchronization method based on national cryptographic algorithms provided in this embodiment includes: S1, Obtain the client's connection request data, and perform connection establishment processing through TCP three-way handshake operation based on the connection request data to obtain a connected TCP socket object; S2, Based on the TCP socket object, perform connection verification processing through port listening and handshake confirmation to obtain a TCP communication channel; S3, based on the server's public key certificate, perform negotiation request processing through the key exchange initialization operation of the SM2 algorithm to obtain the temporary key pair data generated by the client; S4. Based on the temporary key pair data, perform shared key calculation processing using elliptic curves to obtain preliminary shared secret data; S5, based on the temporary key pair data, key material exchange processing is performed through encrypted transmission to obtain the key negotiation packet received by the server; S6. Based on the key negotiation packet, perform integrity verification processing using the SM3 hash function, and obtain key material data through verification; S7. Based on the preliminary secret sharing data, the symmetric session key is obtained by processing it through the SM4 key derivation function; S8. Based on the symmetric session key, key enhancement processing is performed through random number injection to obtain secure session key data; S9. Based on the secure session key data, a negotiation and confirmation process is performed through the cryptographic challenge response to obtain the consistency verification result between the server and the client; S10, based on the verification result, an abnormal reset is performed to obtain a complete key negotiation completion status.

[0023] Furthermore, S2 includes: S21, Based on the server and client, establish a TCP service in dual-master mode, and use a single synchronization thread to synchronize the public key certificate and key data; S22, based on the data format, integrate national cryptographic verification and status as extended by setting synchronization files and index files to perform CRUD synchronization.

[0024] Furthermore, S3 includes: S31, Based on the synchronization file and index file, the temporary key is used to distinguish between synchronized and unsynchronized data by using the synchronization status bit; S32, perform a binary search based on the index entries in the index file to achieve a time complexity of O(log n), specifically: The primary index uses timestamps for binary search to ensure stable throughput; the secondary index uses ID hashes for binary search to ensure accurate queries and merging, covering all scenarios.

[0025] When S32 performs a binary search using timestamps, to avoid losing accurate queries, it maintains a sparse table in memory with ID → latest offset. Upon restart, a sequential scan allows for rapid reconstruction, or the table can be persisted to id_map.bin. When the priority is to maintain synchronous stability and throughput, prioritize the timeline index; if there are many "search by ID" requests in the system, add an ID hash secondary index.

[0026] Furthermore, S9 includes, based on the secure session key data, querying the other party's offset, extracting local incremental data, and detecting by setting up intelligent recovery.

[0027] Example 2: Based on Example 1, the data format is designed using the method of this invention: The data format has been specifically optimized: it integrates national cryptographic verification and status bit extension, and is designed specifically for certificate / key structured data, supporting fast CRUD synchronization. Files use a binary format to ensure efficient read and write operations. This invention employs two key files: a synchronization file (stores complete data) and an index file (providing fast lookup). The method of this invention enables local synchronization of the file (sync_log.bin). Synchronization files are log files that use append-only writing to ensure atomicity (forced flushing to disk using fsync). They contain all data records that need to be synchronized and are the system's primary data storage.

[0028] For example: - **File header (fixed 64 bytes)**: - Version number (4 bytes): Used for compatibility upgrades, such as 0x00000001 indicating version 1. - Current file offset (8 bytes): Records the last written position, used to quickly locate the end of the file. - Total record count (8 bytes): Used for quick statistics to avoid full file scanning. - Last synchronization timestamp (8 bytes): A Unix nanosecond-level timestamp that records the most recent synchronization time. - File checksum (32 bytes): SM3 hash value, used for integrity verification to prevent file corruption. - **Record Body (Variable Length):** Each record includes the following fields: - Operation type (1 byte): - 0: Add operation (includes complete data, such as the PEM code of the new certificate) - 1: Delete operation (includes only ID, e.g., delete expired key) - 2: Modification operations (including ID and new data, such as updating certificate validity) - 3: Query operations (including ID and query summary, used for audit logs, such as query key usage records) - Data ID (16 bytes): A unique identifier generated using SM3 hashing to ensure tamper-proof protection (e.g., a hash of certificate serial number + timestamp). - Timestamp (8 bytes): Nanosecond-level precision time used for sorting and conflict resolution. - Data length (4 bytes): Records the size of the data body; supports variable-length data. - Data body: The Protobuf serialized content of the certificate / key (supports nested structures, such as certificate chains or key pairs), which can be several KB in size. Protobuf was chosen because of its efficient compression and cross-language support. - **Synchronization Status (1 byte):** This is the key field that distinguishes between synchronized and unsynchronized data. - 0: Not synchronized (default value, indicating a new record pending transmission) - 1: Synchronized (Updated upon confirmation, indicating successful transmission) - 2: Retry on failure (marked when transmission fails, waiting for retransmission) - 3: Conflicts (used in dual-master merging scenarios, such as records with older timestamps) - Checksum (32 bytes): The hash value of the entire record using SM3, ensuring the integrity of a single record. - **File Management**: When a file reaches 1GB in size, new files are created automatically, and old files are archived and saved.

[0029] The index file is created using the method of this invention: The index file is designed to improve search efficiency. It does not store complete data, but rather stores index information pointing to the synchronized file.

[0030] For example: - **File header (fixed 32 bytes)**: - Version number (4 bytes): corresponds to the synchronization file - Number of index entries (8 bytes): Records the current number of index entries. - Last update timestamp (8 bytes): Records the last update time of the index. - Checksum (12 bytes): SM3 hash truncated, used for integrity verification. - **Index Entries (fixed 32 bytes each):** Each index entry contains: - Record offset (8 bytes): Points to the starting position of the corresponding record in sync_log.bin - ID Hash (16 bytes): The hash value of the data ID, used for fast matching and lookup. - **Status bit (1 byte)**: Maintains consistency with the synchronization status in the synchronization file, used for quick filtering. - 0: Not synchronized - 1: Synchronized - 2: Retry on failure - 3: Conflict - Reserved fields (7 bytes): for future expansion, such as version number, priority, etc. - **Index Organization**: Index entries are sorted by ID hash or timestamp, supporting binary search (time complexity O(log n)). For example, querying out-of-sync data only requires scanning the status bit array, without accessing the main data file.

[0031] The present invention establishes a status bit storage and synchronization mechanism. To clarify, the status bit (used to distinguish between synchronized and unsynchronized data) in the method of this invention is stored in two locations simultaneously: For example: 1. **Status bits in the synchronization file:** Each record contains a synchronization status byte, recording the synchronization status of the data. This is the original status record of the data.

[0032] 2. **Status bits in the index file:** Each index entry also contains a copy of the status bits for the corresponding record. This is designed for fast lookups, avoiding reading the main data file.

[0033] **Status bit synchronization mechanism**: - When new data is written, the status bit is set to 0 (not synchronized) in both the synchronization file and the index file. - Once the data is successfully synchronized, the synchronization thread will: 1. First, update the status bit in the synchronization file to 1 (synchronized). 2. Update the status bit of the corresponding index entry in the index file to 1. 3. Use fsync to ensure that updates in both locations are persisted to disk. This dual-recording mechanism ensures that even in the event of a system crash, the unsynchronized data can be quickly located through the index file after a restart, without having to scan the entire synchronization file.

[0034] The present invention establishes a fast search mechanism. The fast search mechanism of this invention is based on an index file. For example: 1. **Binary Search**: The index entries in the index file are ordered by ID hash or timestamp, supporting efficient binary search. The process of finding a specific ID is as follows: - Calculate the hash value of the target ID - Use a binary search algorithm in the index file to locate the matching index item (time complexity O(log n)). - By using the record offset in the index entry, jump directly to the synchronization file to read the complete record. 2. **Status Bit Filtering**: When searching for unsynchronized data, only the status bits in the index file need to be scanned. - The synchronization thread scans the index file every 500ms. - Only read the index entries with status bit = 0 to obtain the corresponding record offset. - Read unsynchronized records in batches from the synchronized file based on these offsets This method avoids full file scanning, significantly improving efficiency. 3. **Performance Optimization**: - Memory caching: Recently accessed index pages are cached in memory, reducing disk I / O. - Batch read: Read multiple index items at once, reducing the number of I / O operations. - Prefetching mechanism: Predicts and prefetches index pages that may be needed based on access patterns. 4. **Search performance:** With 1 million records (N=1e6): - Single ID lookup time <10ms (including disk I / O) - Status bit scan (find all unsynchronized records) time <1ms - Compared to traditional linear scanning methods (second-level latency), performance is improved by 10-100 times. 5. **Find an example:** - Scenario: Find the certificate record with ID "cert123" - Steps: 1. Calculate the SM3 hash value of "cert123". 2. Perform a binary search in the index file to find a matching hash value. 3. After finding a match, read its record offset (e.g., offset = 1024). 4. Jump directly to position 1024 of the synchronized file to read the complete record. - The entire process does not require scanning the entire sync file, greatly improving search efficiency. The index file of this invention adds a status bit field and is optimized for certificate / key data characteristics, supporting more efficient synchronous status management and querying.

[0035] The index file of this invention adds a status bit field and is optimized for certificate / key data characteristics, supporting more efficient synchronous status management and querying.

[0036] **Features and Differences:** This design integrates national cryptographic verification (SM3) and status bits, supporting rapid scanning of unsynchronized data (read-only status bits, no need to parse the entire record); it adds conflict detection for certificates / keys (e.g., version number comparison) to prevent data loss during concurrent dual-master modifications; unlike traditional database logs, it requires no SQL parsing, resulting in lower overhead (read and write speeds are increased by 2 times). For example, in 1 million records, finding a specific ID takes less than 10ms, while a full scan takes seconds.

[0037] The method of this invention establishes a synchronization process. 1. **Local Operations:** External requests (such as adding certificates) are first executed locally, appended to the synchronized file, and the status is set to 0. Unlike direct network synchronization, local persistence ensures zero data loss (files can be recovered even if the node crashes).

[0038] 2. **Synchronization thread execution**: Scans the index file every 500ms, extracts unsynchronized records in batches (limited to 100 records / batch to prevent memory overflow), and packages them into frames (the frame header contains batch ID, total length, and batch verification).

[0039] 3. **TCP Connection and Key Negotiation**: - After connecting, negotiate immediately: A sends the SM2 public key (elliptic curve point), B responds with the public key, both parties calculate the shared key (using SM2 ECDH), and then derive the session key (128-bit SM4 key) and authentication key using SM3.

[0040] - Features: Custom negotiation independent of TLS, lightweight (<1ms), ensuring full coverage of national cryptographic standards. Unlike existing TLS, it has no certificate chain verification overhead and is optimized for internal hot standby. Retry 3 times if negotiation fails, otherwise disconnect.

[0041] 4. **Data Transmission**: - The sender encrypts the batch with SM4 (CBC mode, with IV appended) and transmits it; the receiver decrypts, verifies SM3, performs local operations (e.g., application addition, deletion, and modification), and updates the file status.

[0042] - Send ACK (including batch ID and SM3 hash), and the sender updates the status to 1 after verification.

[0043] 5. **Disconnect Recovery**: - Heartbeat is detected every 5 seconds; after disconnection, reconnect and query the other party's head offset (via a dedicated query frame), and only transmit the data after the offset (incremental synchronization).

[0044] - **Intelligent catch-up mechanism**: When disconnected, the local machine continues to record new data (state = 0). After reconnection: (1) Send a query frame to obtain the current offset of the other party (e.g., the last recorded offset = 1000 bytes); (2) Extract records from the part of the local sync_log offset > 1000 (only incremental, e.g., adding 500 bytes of data); (3) Batch transmit the incremental data, and the receiver sends an ACK after applying it; (4) If there is a conflict (e.g., different versions with the same ID), use the timestamp + version number algorithm to merge (prioritize the newer timestamp, and record the older one in the conflict log). Features: The transmission volume is only incremental (can be <1% of the full volume), unlike the existing full synchronization, it supports automatic recovery in high-frequency scenarios without intervention. For example, after 10 minutes of disconnection (assuming 100 new records are added), recovery only requires transmitting these 100 records, which takes <5 seconds; the intelligence is reflected in the offset comparison and automatic merging of conflicts, avoiding manual intervention.

[0045] 6. **Stability Mechanism**: - Single-threaded + circular buffer processing queue to avoid blocking (buffer size is dynamically adjusted, default is 10MB).

[0046] - Retry: Exponential backoff (1s, 2s, 4s...), with an upper limit of 3 attempts before an alarm is triggered and the record is isolated.

[0047] - Conflict resolution: In a dual-master system, if the same ID is modified, merge the changes using timestamp + version number (prioritizing the newer one) and record the conflict log.

[0048] - Unlike existing solutions: This design achieves extreme stability, with zero data loss after 100 disconnections in testing; while multi-threaded solutions are prone to crashing, this invention avoids this risk. Atomicity is ensured through Write-Ahead Logging (WAL).

[0049] The method of this invention enables supported operations and extensions. - **CRUD Synchronization**: Add / modify with complete data, delete / query with summary; all operations are atomically appended, and transactions (batch commit) are supported.

[0050] - **Extended Features**: Supports batch operations and data compression (snappy algorithm, compression rate >50%), further reducing bandwidth; scalable to multiple nodes (future versions).

[0051] Example 3: This invention provides a dual-machine hot standby data synchronization system based on national cryptographic algorithms, comprising: The communication connection module is used to obtain the client's connection request data, and to perform connection establishment processing through TCP three-way handshake operation based on the connection request data to obtain a connected TCP socket object. The channel establishment module is used to perform connection verification processing through port listening and handshake confirmation based on the TCP socket object to obtain a TCP communication channel; The request processing module is used to process the negotiation request based on the server's public key certificate and the key exchange initialization operation of the SM2 algorithm to obtain the temporary key pair data generated by the client. The key processing module is used to perform shared key calculation processing on the temporary key pair data using elliptic curves to obtain preliminary shared secret data. The key conversion module is used to perform key material exchange processing based on the temporary key pair data through encrypted transmission to obtain the key negotiation packet received by the server; The key verification module is used to perform integrity verification processing on the key negotiation packet using the SM3 hash function, and obtain the key material data through verification. Key encryption processing is used to process the initial secret sharing data using the SM4 key derivation function to obtain a symmetric session key; The key optimization module is used to perform key enhancement processing by random number injection based on the symmetric session key to obtain secure session key data; The verification processing module is used to perform negotiation and confirmation processing based on the secure session key data through the cryptographic challenge response, and obtain the consistency verification result between the server and the client; The synchronization optimization module is used to process the verification results through an abnormal reset to obtain a complete key negotiation completion status.

[0052] Furthermore, the channel construction module includes: The data processing unit is used to establish a TCP service in a dual-master mode based on the server and the client, and to synchronize the public key certificate and key data using a single synchronization thread; The data synchronization unit is used to perform CRUD synchronization by integrating national cryptographic verification and status into the synchronization file and index file according to the data format.

[0053] Furthermore, the request processing module includes: An index building unit is used to distinguish whether the data of the temporary key is synchronized or not based on the synchronization file and the index file, using a synchronization status bit. The index optimization unit is used to perform a binary search based on the index entries in the index file, resulting in a time complexity of O(log n).

[0054] Furthermore, the verification processing module is also used to query the other party's offset, extract local incremental data, and perform detection based on the secure session key data by setting intelligent recovery.

[0055] Example 4: This embodiment also provides an electronic device, including a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method of Embodiment 1; In practical applications, the processor can be implemented as an Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), controller, microcontroller unit (MCU), microprocessor, or other electronic components to execute the methods described in the above embodiments.

[0056] The method implemented in this embodiment is as described in Embodiment 1.

[0057] Example 5: This embodiment also provides a computer storage medium, in which a computer program is stored, and when the computer program is executed by one or more processors, it implements the method of embodiment one. The computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0058] The method implemented in this embodiment is as described in Embodiment 1.

[0059] In the several embodiments provided in this invention, it should be understood that the disclosed systems and methods can also be implemented in other ways. The system and method embodiments described above are merely illustrative.

[0060] It should be noted that, in this document, the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0061] While the embodiments disclosed in this invention are as described above, the content is merely for the purpose of facilitating understanding of the invention and is not intended to limit the invention. Any person skilled in the art to which this invention pertains may make any modifications and variations in form and detail of the implementation without departing from the spirit and scope disclosed herein; however, the scope of patent protection for this invention shall still be determined by the scope defined in the appended claims.

Claims

1. A dual-machine hot standby data synchronization method based on national cryptographic algorithms, characterized in that, include: S1, Obtain the client's connection request data, and perform connection establishment processing through TCP three-way handshake operation based on the connection request data to obtain a connected TCP socket object; S2, Based on the TCP socket object, perform connection verification processing through port listening and handshake confirmation to obtain a TCP communication channel; S3, based on the server's public key certificate, perform negotiation request processing through the key exchange initialization operation of the SM2 algorithm to obtain the temporary key pair data generated by the client; S4. Based on the temporary key pair data, perform shared key calculation processing using elliptic curves to obtain preliminary shared secret data; S5, based on the temporary key pair data, key material exchange processing is performed through encrypted transmission to obtain the key negotiation packet received by the server; S6. Based on the key negotiation packet, perform integrity verification processing using the SM3 hash function, and obtain key material data through verification; S7. Based on the preliminary secret sharing data, the symmetric session key is obtained by processing it through the SM4 key derivation function; S8. Based on the symmetric session key, key enhancement processing is performed through random number injection to obtain secure session key data; S9. Based on the secure session key data, a negotiation and confirmation process is performed through the cryptographic challenge response to obtain the consistency verification result between the server and the client; S10, based on the verification result, an abnormal reset is performed to obtain a complete key negotiation completion status.

2. The method according to claim 1, characterized in that, S2 includes: S21, Based on the server and client, establish a TCP service in dual-master mode, and use a single synchronization thread to synchronize the public key certificate and key data; S22, based on the data format, integrate national cryptographic verification and status as extended by setting synchronization files and index files to perform CRUD synchronization.

3. The method according to claim 2, characterized in that, S3 includes: S31, Based on the synchronization file and index file, the temporary key is used to distinguish between synchronized and unsynchronized data by using the synchronization status bit; S32, perform a binary search based on the index entries in the index file to obtain a time complexity of O(log n).

4. The method according to claim 3, characterized in that, S9 includes querying the other party's offset, extracting local incremental data, and detecting based on the secure session key data by setting up intelligent recovery.

5. A dual-machine hot standby data synchronization system based on national cryptographic algorithms, characterized in that, include: The communication connection module is used to obtain the client's connection request data, and to perform connection establishment processing through TCP three-way handshake operation based on the connection request data to obtain a connected TCP socket object. The channel establishment module is used to perform connection verification processing through port listening and handshake confirmation based on the TCP socket object to obtain a TCP communication channel; The request processing module is used to process the negotiation request based on the server's public key certificate and the key exchange initialization operation of the SM2 algorithm to obtain the temporary key pair data generated by the client. The key processing module is used to perform shared key calculation processing on the temporary key pair data using elliptic curves to obtain preliminary shared secret data. The key conversion module is used to perform key material exchange processing based on the temporary key pair data through encrypted transmission to obtain the key negotiation packet received by the server; The key verification module is used to perform integrity verification processing on the key negotiation packet using the SM3 hash function, and obtain the key material data through verification. Key encryption processing is used to process the initial secret sharing data using the SM4 key derivation function to obtain a symmetric session key; The key optimization module is used to perform key enhancement processing by random number injection based on the symmetric session key to obtain secure session key data; The verification processing module is used to perform negotiation and confirmation processing based on the secure session key data through the cryptographic challenge response, and obtain the consistency verification result between the server and the client; The synchronization optimization module is used to process the verification results through an abnormal reset to obtain a complete key negotiation completion status.

6. The system according to claim 5, characterized in that, The channel construction module includes: The data processing unit is used to establish a TCP service in a dual-master mode based on the server and the client, and to synchronize the public key certificate and key data using a single synchronization thread; The data synchronization unit is used to perform CRUD synchronization by integrating national cryptographic verification and status into the synchronization file and index file according to the data format.

7. The system according to claim 6, characterized in that, The request processing module includes: An index building unit is used to distinguish whether the data of the temporary key is synchronized or not based on the synchronization file and the index file, using a synchronization status bit. The index optimization unit is used to perform a binary search based on the index entries in the index file, resulting in a time complexity of O(log n).

8. The system according to claim 7, characterized in that, The verification processing module is also used to query the other party's offset, extract local incremental data, and perform detection based on the secure session key data by setting up intelligent recovery.

9. An electronic device, characterized in that, The system includes a memory and a processor, the memory being used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the method as described in any one of claims 1-4.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, is used to implement the method as described in any one of claims 1-4.

Images