Method for reducing adaptation cost of national secret load balancing architecture
By encapsulating the national cryptographic component library and load balancing software using Docker technology, and providing standardized image packaging and deployment, the high adaptation cost and complexity of deploying national cryptographic SSL certificates are solved, enabling fast and smooth national cryptographic applications, reducing technical barriers and resource waste, and meeting national security compliance requirements.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA ASEAN INFORMATION PORT CO LTD
- Filing Date
- 2025-12-24
- Publication Date
- 2026-05-15
AI Technical Summary
When enterprises deploy domestically produced cryptographic SSL certificates, they face the challenge of incomplete native support for cryptographic algorithms in mainstream server software and browser ecosystems. This results in a large amount of underlying adaptation work and high adaptation costs, increasing the complexity of certificate management and browser compatibility, and raising the technical threshold.
By encapsulating the national cryptographic component library and load balancing software using Docker technology, we provide standardized image packaging and deployment methods, use Dockerfile to encapsulate environment variables, achieve "out-of-the-box" functionality, and run the national cryptographic load balancing service in containers, isolating the host machine from other services.
It significantly reduces the initial technical threshold and time cost of national cryptographic standard transformation, improves operation and maintenance efficiency, ensures the stability and consistency of national cryptographic standard applications, avoids resource waste and complexity, and meets national security compliance requirements.
Smart Images
Figure CN122044743A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of operation and maintenance, and in particular to a method for reducing the adaptation cost of national cryptographic load balancing architecture. Background Technology
[0002] Currently, the vast majority of internet websites use reverse proxy servers (such as Nginx) and deploy SSL certificates based on international algorithms (such as RSA / ECC) to build secure HTTPS encrypted channels. On this basis, in order to meet national cybersecurity and cryptographic application compliance requirements and enhance the independent controllability of critical information infrastructure, more and more government, financial and key industry websites are beginning to adopt domestically produced national cryptographic SSL certificates.
[0003] However, enterprises face a core challenge in this process: the native support for Chinese cryptographic algorithms by mainstream server software, operating systems, and internationally accepted browser ecosystems is still incomplete. This means that to successfully deploy Chinese cryptographic certificates, enterprises often need to perform a significant amount of low-level adaptation work, such as integrating Chinese cryptographic support modules into Nginx and ensuring seamless integration with existing application architectures. Simultaneously, to ensure that traditional clients incompatible with Chinese cryptographic algorithms (such as Chrome and Safari) can access the site normally, it is usually necessary to consider deploying an SM2 / RSA dual-certificate solution, which undoubtedly increases the complexity of certificate management, synchronization updates, and browser automatic identification and switching logic. All these factors combined result in high adaptation costs and technical barriers for enterprises in technology selection, testing and verification, and subsequent maintenance. Summary of the Invention
[0004] To address the aforementioned issues, this invention provides a method for reducing the adaptation cost of national cryptographic load balancing architectures. This method avoids resource waste for different teams and projects with the same technical requirements, and minimizes the technical research costs, environment adaptation costs, and deployment and maintenance complexity of national cryptographic applications. This enables enterprises to quickly, smoothly, and consistently meet national security compliance requirements, allowing them to focus their core R&D efforts on business innovation itself.
[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0006] A method for reducing the adaptation cost of national cryptographic load balancing architecture includes the following steps:
[0007] S1. Prepare the environment and personalized compilation components, including setting up the base image, preparing the GMSSL national cryptographic component library compilation and installation package, preparing the load balancing software, and preparing the personalized component template;
[0008] S2. Compile the GMSSL national cryptographic component library, and combine the compiled GMSSL national cryptographic component library with the load balancer to compile the load balancer software;
[0009] S3. Package the compiled GMSSL national cryptographic component library, the load balancing software, and the personalized compilation component into the server via Dcokerfile, and push the corresponding image to the harbor repository;
[0010] S4. Pull the image from the Harbor repository using `docker pull` and configure the image accordingly.
[0011] Furthermore, in the environment preparation step S1, multiple operating system build environments are prepared, the base image for package management is set up, multiple versions of GMSSL national cryptographic component library compilation and installation packages are prepared, and multiple versions of load balancing software are prepared; in the personalized compilation component preparation step S1, the folders and files corresponding to the personalized compilation components are prepared to start and dynamically generate personalized configuration files.
[0012] Furthermore, in step S2, the compilation of the GMSSL national cryptographic component library is verified to determine whether the compilation is complete.
[0013] After the GMSSL national cryptographic component library is compiled, the library files of the GMSSL national cryptographic component library are linked to the system library directory, and the source code of the load balancing software is modified to replace the openssl library of the load balancing software with the gmssl library that has completed the compilation of the GMSSL national cryptographic component library, and the corresponding load balancing compilation configuration is added, so as to combine the GMSSL national cryptographic component library with the load balancer to compile the load balancing software.
[0014] The compiled load balancing software is then verified to determine the availability of the national cryptographic load balancing.
[0015] Further, in step S2, the verification of the compiled GMSSL national cryptographic component library includes the following steps:
[0016] S2.1.1 Create a symbolic link for the executable file of the GMSSL national cryptographic component library and verify whether the compiled national cryptographic component library can be used normally;
[0017] S2.1.2 Use the commands gmssl version -a and gmssl help to check whether the GMSSL national cryptographic component library has been compiled and whether it supports national cryptographic algorithms.
[0018] S2.1.3 If both steps S2.1.1 and S2.1.2 pass, the GMSSL national cryptographic component library is compiled. Otherwise, the compilation of the GMSSL national cryptographic component library is performed again.
[0019] Further, in step S2, the verification of the load balancing software includes the following steps:
[0020] S2.2.1 Issue and test certificates supporting national cryptographic algorithms using the GMSSL national cryptographic component library, and configure the certificates;
[0021] S2.2.2 Verify using a national cryptographic browser by opening the national cryptographic browser to test whether it supports national cryptographic session access;
[0022] S2.2.3 When the national cryptographic browser supports national cryptographic session access, the load balancing software completes compilation; otherwise, the load balancing software is compiled again.
[0023] Further, in step S3, multiple Dcokerfiles are written, and the compiled GMSSL national cryptographic component library is packaged into the Dcokerfile using the COPY and ADD commands. The folders and files corresponding to the compiled load balancing software and personalized compiled components are also added to the Dcokerfile. The Dcokerfile is then packaged using a batch packaging script, and the corresponding image is pushed to the harbor repository.
[0024] Furthermore, in step S4, the image of the Harbor repository is pulled using the docker pull command, and the load balancer server of the image is run using the docker run command, or it is deployed in Kubernetes.
[0025] Furthermore, in step S4, the folders and files corresponding to the personalized compilation components in the image are configured, and certificates and auxiliary components are adjusted by writing a Dockerfile.
[0026] The beneficial effects of this invention are:
[0027] Leveraging Docker's features, complex environment variables and adaptation processes are encapsulated to achieve a "ready-to-use" experience for users. Technical teams no longer need to "reinvent the wheel" in every new project or environment, avoiding time-consuming national cryptographic standard adaptation and compatibility testing. This transforms the application of national cryptographic technology from a technical challenge requiring deep expertise into a standardized infrastructure acquisition process, significantly reducing the initial technical threshold and time cost of national cryptographic standard transformation. Due to the scalability of national cryptographic infrastructure component images, if end-users need to add customized components, they can use configuration templates and modify Dockerfiles for configuration. High customizability and simplified adaptation operations significantly improve operational efficiency. The national cryptographic load balancing service runs in an independent container, isolated from the host machine and other services (such as databases and application servers). Even if a component encounters problems due to configuration errors or security vulnerabilities, its impact is confined within the container and will not affect other critical services, thereby improving the overall architecture's stability. Attached Figure Description
[0028] Figure 1 This is a flowchart of a preferred embodiment of the present invention for a method to reduce the adaptation cost of a national cryptographic load balancing architecture.
[0029] Figure 2 This is a compilation flowchart of a preferred embodiment of the present invention for a method to reduce the adaptation cost of national cryptographic load balancing architecture.
[0030] Figure 3 This is a user image diagram illustrating a preferred embodiment of the method for reducing the adaptation cost of national cryptographic load balancing architecture according to the present invention. Detailed Implementation
[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the specification of this invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.
[0033] Please also see Figures 1 to 3 A preferred embodiment of the present invention provides a method for reducing the adaptation cost of a national cryptographic load balancing architecture, comprising the following steps:
[0034] S1. Prepare the environment and personalized compilation components, including setting up the base image, preparing the GMSSL national cryptographic component library compilation and installation package, preparing the load balancing software, and preparing personalized component templates.
[0035] In step S1, the environment preparation involves preparing build environments for multiple operating systems, setting up the base image for package management, preparing compilation and installation packages for multiple versions of the GMSSL national cryptographic component library, and preparing load balancing software for multiple versions. In step S1, the personalized compilation component preparation involves preparing folders and files corresponding to the personalized compilation components to enable startup and dynamic generation of personalized configuration files.
[0036] During environment preparation, operations and maintenance personnel prepare the compilation environment and related components, such as basic compilation environments like CentOS, Ubuntu, and Debian, and set up domestic package management mirror sources for compilation and construction; they also prepare compilation and installation packages for multiple versions of GMSSL components and multiple versions of load balancing software such as Nginx for use in the compilation and use of load balancing software.
[0037] The personalized compilation components are being prepared. Taking Nginx as an example, a docker-start-bash folder is prepared, which contains files such as docker-entrypoint.sh and docker-entrypoint.d. These are used to start and dynamically generate personalized Nginx configuration files, making it convenient for users to configure personalized templates and providing highly customizable configuration files.
[0038] S2. Compile the GMSSL national cryptographic component library, and combine the compiled GMSSL national cryptographic component library with the load balancer to compile the load balancing software. The compilation process in this embodiment is as follows: Figure 2 As shown.
[0039] In step S2, the GMSSL national cryptographic component library is compiled and then verified to determine whether the compilation is complete.
[0040] In step S2, the verification of the compiled GMSSL national cryptographic component library includes the following steps:
[0041] S2.1.1 Create a symbolic link for the executable file of the GMSSL national cryptographic component library and verify whether the compiled national cryptographic component library can be used normally;
[0042] S2.1.2 Use the commands `gmssl version -a` and `gmssl help` to check whether the GMSSL national cryptographic component library has been compiled and to confirm whether it supports national cryptographic algorithms.
[0043] S2.1.3 If both steps S2.1.1 and S2.1.2 pass, the GMSSL national cryptographic component library will be compiled. Otherwise, the GMSSL national cryptographic component library will be compiled again.
[0044] This embodiment takes the CentOS environment as an example to compile multiple versions of GMSSL, create a symbolic link for the GMSSL executable file, and verify whether the compiled national cryptographic component library can be used normally. The gmssl version-a and gmssl help commands are used to check whether the compilation is successful and to confirm whether it supports national cryptographic algorithms such as sm2 and sm3.
[0045] After the GMSSL national cryptographic component library is compiled, link the library files of the GMSSL national cryptographic component library to the system library directory, and modify the source code of the load balancing software to replace the openssl library of the load balancing software with the gmssl library that has completed the compilation of the GMSSL national cryptographic component library, and add the corresponding load balancing compilation configuration, so as to combine the GMSSL national cryptographic component library with the load balancing software to compile the load balancing software.
[0046] This embodiment uses Nginx as an example to compile the load balancing software. Pre-compiled library files such as libssl and libcrypto are linked to the system library directory / usr / lib64 / using symbolic links. The Nginx source code is modified to replace the default openssl library with the compiled gmssl library to support Chinese cryptographic algorithms. Appropriate load balancing compilation configurations, such as http_ssl_module, are added as needed, and the load balancing software is then compiled and installed.
[0047] After compiling the load balancing software, we will verify it to determine the availability of the national cryptographic load balancing.
[0048] In step S2, the verification of the load balancing software includes the following steps:
[0049] S2.2.1 Issue and test certificates that support Chinese cryptographic algorithms using the GMSSL Chinese Cryptographic Component Library, and configure the certificates accordingly;
[0050] S2.2.2 Use a Chinese cryptographic browser for verification. Test whether the Chinese cryptographic session access is supported by opening the Chinese cryptographic browser.
[0051] S2.2.3 When the national cryptographic browser supports national cryptographic session access, the load balancing software completes compilation; otherwise, the load balancing software is compiled again.
[0052] In this embodiment, a certificate supporting the national cryptographic algorithm is issued and verified using GMSSSL. It is configured as required and verified using a national cryptographic browser. The national cryptographic browser is opened to test whether it supports national cryptographic session access.
[0053] S3. Package the compiled GMSSL national cryptographic component library, load balancing software, and customized compiled components into the server using Dcokerfile, and push the corresponding image to the harbor repository.
[0054] In step S3, multiple Dcokerfiles are written. The compiled GMSSL national cryptographic component library is packaged into the Dcokerfile using the COPY and ADD commands. The folders and files corresponding to the compiled load balancing software and personalized compiled components are also added to the Dcokerfile. The Dcokerfile is then packaged using a batch packaging script, and the corresponding image is pushed to the harbor repository.
[0055] In this embodiment, the compiled GMSSL national cryptographic component library is packaged into the Dockerfile using commands such as COPY and ADD. The compiled Nginx, nginx.conf, and docker-start-bash files are added to the Dockerfile. A batch packaging script (.bat or .sh) is also written to package multiple versions of the Dockerfile and push them to the corresponding image's Harbor repository for easy user retrieval.
[0056] S4. Pull the image from the Harbor repository using `docker pull` and customize the image. The user image acquisition process in this embodiment is as follows: Figure 3 As shown.
[0057] In step S4, the image from the Harbor repository is pulled using the `docker pull` command, and the image's load balancer is run using the `docker run` command, or it is deployed in Kubernetes.
[0058] In this embodiment, users can use the `docker pull` command to pull the image of the national cryptographic infrastructure component that has been built in the above steps. Because Docker is "out-of-the-box," users can directly use the `docker run` command to run the pre-adapted image load balancer that supports the national cryptographic algorithm, or deploy it in Kubernetes.
[0059] In step S4, the folders and files corresponding to the personalized compilation components in the image are configured, and certificates and auxiliary components are adjusted by writing a Dockerfile.
[0060] In this embodiment, after obtaining the image of the pre-built national cryptographic infrastructure component in the above steps, users can customize it by writing a Dockerfile, flexibly adjust the configuration, certificate and auxiliary components, and thus quickly adapt to specific business scenarios.
[0061] This embodiment allows you to copy a customized nginx.conf file into the image to override the default configuration, such as copying it to the / usr / local / nginx / conf / or / etc / nginx / directory. If you need to use Chinese cryptographic components, you can copy the Chinese cryptographic SSL certificate, such as the .crt and .key files, into the image, apply it to the configuration file, and reference it in the configuration file. For cases where dynamic configuration generation is required, you can copy the .template template file. Subsequently, when the container starts, the variables in the template are replaced by environment variables to generate the final configuration file. If there are custom binary files, such as specific monitoring components or custom modules, they should also be copied to a suitable location within the image using the COPY command, such as / usr / local / bin / .
[0062] This embodiment of the method for rapidly deploying a reverse proxy server for Chinese cryptographic algorithms by reducing the adaptation cost of the Chinese cryptographic load balancing architecture includes the following steps:
[0063] A1. The operations and maintenance department has prepared a multi-operating system building environment including Debian and CentOS, and used the GMSSL V2 version of the national cryptographic component library and the Nginx 1.22.1 version of the load balancing software as a blueprint.
[0064] A2. Compile the GMSSL V2 version national cryptographic component library. Use the commands `gmssl version -a` and `gmssl help` to check if the compilation is successful and to confirm whether it supports national cryptographic algorithms such as SM2 and SM3. After confirming that everything is correct, modify the Nginx source code, replace the default OpenSSL library with the compiled GMSSL library, reference different lib libraries to support national cryptographic components, and then compile and install it.
[0065] A3. After compilation and installation, write the test.com.conf file, upload the national cryptographic certificates encrypt and sign for testing, and write configurations such as ssl_certificate and ssl_ciphers to complete the national cryptographic certificate configuration. Finally, start Nginx, configure local host resolution, and use a national cryptographic browser to access the relevant pages to test whether the national cryptographic certificate is supported.
[0066] A4. After the test is completed, write a Dockerfile to package the compiled and installed national cryptographic component library and Nginx software into the server and push it to the Harbor repository.
[0067] A5. Use the `docker pull` command to pull the image, and use the `docker run` command to test whether the container is running normally.
[0068] A6. Create a Dockerfile, referencing the previously pulled image via FROM. Write a customized nginx.conf file, overwriting the existing nginx.conf. Add the purchased national cryptographic certificate files (xxx._.encrypt.crt, xxx._.encrypt.key, xxx._.sign.crt, xxx._.sign.key) into the container directory using the ADD command in the Dockerfile. Write a customized domain.conf.template reverse proxy template, placing the relevant national cryptographic configurations in the specified directory to meet research, adaptation, and debugging needs. Finally, package the above configuration into a new Docker image using the docker build command, and deploy it using docker run.
[0069] This embodiment demonstrates how Docker container technology simplifies the extensive work involved in researching and adapting to national cryptographic load balancing algorithms. It uses Dockerfiles to uniformly compile and package the system into a Docker image, which is then uploaded to the Harbor repository. Leveraging Docker's convenient delivery, rapid deployment, and cross-platform capabilities, a highly standardized, ready-to-use national cryptographic infrastructure component is encapsulated and delivered. This not only fundamentally avoids the waste of resources caused by different teams and projects "reinventing the wheel" for the same technical requirements, but also minimizes the costs of technical research, environment adaptation, and deployment and maintenance for national cryptographic applications. It also solves the problem of excessively high costs associated with user research and adaptation to national cryptographic load balancing algorithms, enabling enterprises to quickly, smoothly, and consistently meet national security compliance requirements, allowing them to focus their core R&D efforts on business innovation itself.
Claims
1. A method for reducing the adaptation cost of national cryptographic load balancing architecture, characterized in that, Includes the following steps: S1. Prepare the environment and personalized compilation components, including setting up the base image, preparing the GMSSL national cryptographic component library compilation and installation package, preparing the load balancing software, and preparing the personalized component template; S2. Compile the GMSSL national cryptographic component library, and combine the compiled GMSSL national cryptographic component library with the load balancer to compile the load balancer software; S3. Package the compiled GMSSL national cryptographic component library, the load balancing software, and the personalized compilation component into the server via Dcokerfile, and push the corresponding image to the harbor repository; S4. Pull the image from the Harbor repository using `docker pull` and configure the image accordingly.
2. The method for reducing the adaptation cost of national cryptographic load balancing architecture according to claim 1, characterized in that: In step S1, the environment preparation involves preparing build environments for multiple operating systems, setting up the base image for package management, preparing compilation and installation packages for multiple versions of the GMSSL national cryptographic component library, and preparing load balancing software for multiple versions. In step S1, the personalized compilation component preparation involves preparing the folder and files corresponding to the personalized compilation component to enable and dynamically generate personalized configuration files.
3. The method for reducing the adaptation cost of national cryptographic load balancing architecture according to claim 1, characterized in that: In step S2, the compilation of the GMSSL national cryptographic component library is verified to determine whether the compilation is complete. After the GMSSL national cryptographic component library is compiled, the library files of the GMSSL national cryptographic component library are linked to the system library directory, and the source code of the load balancing software is modified to replace the openssl library of the load balancing software with the gmssl library that has completed the compilation of the GMSSL national cryptographic component library, and the corresponding load balancing compilation configuration is added, so as to combine the GMSSL national cryptographic component library with the load balancer to compile the load balancing software. The compiled load balancing software is then verified to determine the availability of the national cryptographic load balancing.
4. The method for reducing the adaptation cost of national cryptographic load balancing architecture according to claim 3, characterized in that: In step S2, the verification of the compiled GMSSL national cryptographic component library includes the following steps: S2.1.1 Create a symbolic link for the executable file of the GMSSL national cryptographic component library and verify whether the compiled national cryptographic component library can be used normally; S2.1.2 Use the commands gmssl version -a and gmssl help to check whether the GMSSL national cryptographic component library has been compiled and whether it supports national cryptographic algorithms. S2.1.3 If both steps S2.1.1 and S2.1.2 pass, the GMSSL national cryptographic component library is compiled; otherwise, the compilation of the GMSSL national cryptographic component library is performed again.
5. A method for reducing the adaptation cost of national cryptographic load balancing architecture according to claim 3, characterized in that: In step S2, the verification of the load balancing software includes the following steps: S2.2.1 Issue and test certificates supporting national cryptographic algorithms using the GMSSL national cryptographic component library, and configure the certificates; S2.2.2 Verify using a national cryptographic browser by opening the national cryptographic browser to test whether it supports national cryptographic session access; S2.2.3 When the national cryptographic browser supports national cryptographic session access, the load balancing software completes compilation; otherwise, the load balancing software is compiled again.
6. The method for reducing the adaptation cost of national cryptographic load balancing architecture according to claim 2, characterized in that: In step S3, multiple Dcokerfiles are written. The compiled GMSSL national cryptographic component library is packaged into the Dcokerfile using the COPY and ADD commands. The folders and files corresponding to the compiled load balancing software and personalized compiled components are also added to the Dcokerfile. The Dcokerfile is then packaged using a batch packaging script, and the corresponding image is pushed to the harbor repository.
7. The method for reducing the adaptation cost of national cryptographic load balancing architecture according to claim 1, characterized in that: In step S4, the image of the Harbor repository is pulled using the docker pull command, and the load balancer server of the image is run using the docker run command, or it is deployed in Kubernetes.
8. A method for reducing the adaptation cost of a national cryptographic load balancing architecture according to claim 6, characterized in that: In step S4, a Dockerfile is written to configure the folders and files corresponding to the personalized compilation components in the image, and to adjust the certificates and auxiliary components.