A communication method based on a cloud service system and a cloud service system

Abstract

The application discloses a communication method based on a cloud service system and the cloud service system, which can improve the security of cross-domain communication between computing nodes. The method of the application comprises the following steps: a first computing node in a first region can encrypt a first message based on information of the first computing node and a key associated with the first region, obtain a second message, and send the second message to a first gateway. Then, the first gateway can decrypt the second message to obtain the first message, encrypt the first message by using information of the first gateway and a key associated with the first region and a second region, obtain a third message, and send the third message to a second gateway. Subsequently, the second gateway can decrypt the third message to obtain the first message, encrypt the first message by using information of the second gateway and a key associated with the second region, obtain a fourth message, and send the fourth message to a second computing node in the second region. After that, the second computing node can decrypt the fourth message to obtain the first message.

Description

[0001] This application claims priority to Chinese Patent Application No. 202510308939.2, filed on March 14, 2025, entitled "A Communication Method Based on a Cloud Management Platform and a Cloud Management Platform", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of cloud technology, and in particular to a communication method and a cloud service system based on a cloud service system. Background Technology

[0003] With the rapid development of cloud technology, more and more tenants are choosing compute node clusters provided by cloud vendors to complete their business. When tenants have business needs, the compute nodes providing cloud services to tenants often need to transmit messages. This process usually involves message security issues, so the messages need to be encrypted.

[0004] In related technologies, a cloud service system may include multiple computing nodes that provide cloud services to tenants. When a tenant has business needs, the source computing node can encrypt its message to obtain an encrypted message, and then send the encrypted message to the destination computing node. The destination computing node can then decrypt the encrypted message to obtain the original message, which it can then process to meet the tenant's business needs.

[0005] In the above process, encryption of messages is usually limited to the source and destination computing nodes within the same region. If these two computing nodes are located in different regions, the encryption process of the entire message transmission chain across domains cannot be achieved, resulting in certain security risks in message transmission. Summary of the Invention

[0006] This application provides a communication method and a cloud service system based on a cloud service system, which can realize the encryption process of the entire message transmission chain across domains from end to end, so as to avoid security risks in the message transmission process and improve the security of cross-domain communication between computing nodes.

[0007] The first aspect of this application provides a communication method based on a cloud service system. The cloud service system implementing the method includes a first computing node located in a first region, a first gateway located in the first region, a second gateway located in a second region, and a second computing node located in the second region. The method includes:

[0008] When the first computing node needs to send the first message to the second computing node, the first computing node can obtain the information of the first computing node and the key associated with the first area, and use the information of the first computing node and the key associated with the first area to encrypt the first message, thereby obtaining the second message.

[0009] After receiving the second message, the first gateway can decrypt the second message to obtain the first message, and obtain the information of the first gateway and the key associated with the first area and the second area. Based on the information of the first gateway and the key associated with the first area and the second area, the first gateway can encrypt the first message to obtain the third message, and send the third message to the second gateway.

[0010] After receiving the third message, the second gateway can decrypt the third message to obtain the first message, and obtain the information of the second gateway and the key associated with the second area. Based on the information of the second gateway and the key associated with the second area, the first message is encrypted to obtain the fourth message, and the fourth message is sent to the second computing node.

[0011] After receiving the fourth message, the second computing node can decrypt the fourth message to obtain the first message, which can then be processed in subsequent steps to complete the communication between the first and second computing nodes.

[0012] As can be seen from the above method, when the first computing node located in the first region needs to transmit the first message to the second computing node located in the second region, the first computing node can encrypt the first message and transmit the resulting second message to the first gateway. The first gateway can encrypt the first message and transmit the resulting third message to the second gateway. The second gateway can encrypt the first message and transmit the resulting fourth message to the second computing node. Thus, even if the first computing node and the second computing node are located in the first region and the second region, respectively, with the cooperation of the gateways in these two regions (i.e., the first gateway and the second gateway), the two computing nodes can achieve encryption of the entire transmission process of the first message, that is, to achieve encryption of the entire message transmission chain across domains from end to end, so as to avoid potential security risks in the message transmission process and improve the security of cross-domain communication between computing nodes.

[0013] In one possible implementation, the key associated with the first region includes a first key and a second key. The first computing node, based on its information and the key associated with the first region, encrypts a first message to obtain a second message. This process includes: the first computing node calculating a third key using the first and second keys; the first computing node calculating a fourth key using the third key; the first computing node calculating a fifth key using the third and fourth keys; and the first computing node obtaining a sixth key based on the fifth key, and encrypting the first message using the sixth key and its information to obtain the second message. In this implementation, since the key associated with the first region includes a first key and a second key, after obtaining the first and second keys, the first computing node can perform an XOR operation on the first and second keys to obtain the third key. Then, the first computing node can calculate the third key to obtain the fourth key. Finally, the first computing node can calculate the third and fourth keys to obtain the fifth key. Subsequently, the first computing node can use the fifth key to obtain the sixth key, and use the sixth key and the information of the first computing node to encrypt the first message, thereby obtaining the second message. It is evident that the first computing node can support line-rate derivation for key generation, a high-speed key derivation technique. This allows for sufficiently fast key derivation without the need for pre-computing and storing large amounts of key data, thus avoiding the consumption of excessive computing and storage resources on the device (first computing node), thereby improving resource utilization.

[0014] In one possible implementation, the first computing node obtaining the sixth key based on the fifth key includes: the first computing node using the fifth key as the sixth key. In the aforementioned implementation, after obtaining the fifth key, the first computing node can directly determine the fifth key as the sixth key, so as to successfully use the sixth key to encrypt the first message in the subsequent process, thereby obtaining the second message.

[0015] In one possible implementation, the method further includes: the first computing node calculating a seventh key using the third and fourth keys; the first computing node obtaining a sixth key based on the fifth key includes: the first computing node calculating the sixth key using the fifth and seventh keys. In the aforementioned implementation, after obtaining the fourth key, the first computing node can also calculate the seventh key using the third and fourth keys. Then, after obtaining the seventh key, the first computing node can calculate the sixth key using the fifth and seventh keys to obtain the second key, thereby successfully encrypting the first message using the sixth key in a subsequent process.

[0016] In one possible implementation, the method further includes: a first computing node acquiring a first key identity document (ID), a second key ID, and a key version; the first computing node concatenating the ID of the first region and the first key ID to obtain a third key ID; the first computing node concatenating the ID of the first region and the second key ID to obtain a fourth key ID; the first computing node determining multiple candidate keys corresponding to the third key ID from a preset key set, and determining the candidate key corresponding to the key version from the multiple candidate keys corresponding to the third key ID as the first key; the first computing node determining multiple candidate keys corresponding to the fourth key ID from the key set, and determining the candidate key corresponding to the key version from the multiple candidate keys corresponding to the fourth key ID as the second key. In the aforementioned implementation, after determining that the first message needs to be encrypted, the first computing node can first acquire the ID of the first region, the first key ID, the second key ID, and the current key version. Then, the first computing node can concatenate the ID of the first region and the first key ID to obtain the third key ID, and concatenate the ID of the first region and the second key ID to obtain the fourth key ID. Then, the first computing node can determine multiple candidate keys corresponding to the third key ID from the key set, and from these candidate keys, determine the candidate key corresponding to the current key version as the first key. Simultaneously, the first computing node can also determine multiple candidate keys corresponding to the fourth key ID from the key set, and from these candidate keys, determine the candidate key corresponding to the key version as the second key. In this way, the first computing node can successfully obtain the first key and second key specific to the first area, which can then be used in subsequent line-rate derivation to obtain the key (sixth key) used to encrypt the first message.

[0017] In one possible implementation, the information of the first computing node includes: the ID of the first computing node or the ID of the session between the first computing node and the second computing node. In the aforementioned implementation, the ID of the first computing node or the ID of the session between the first computing node and the second computing node can be used to construct the first and second inputs required for the subsequent line-rate derivation by the first computing node, in order to successfully obtain the key (sixth key) used to encrypt the first message.

[0018] In one possible implementation, the first gateway decrypts the second message to obtain the first message, which includes: the first gateway obtaining information about the first computing node and a key associated with the first region based on the second message; and the first gateway decrypting the second message based on the information about the first computing node and the key associated with the first region to obtain the first message. In the aforementioned implementation, after obtaining the second message, the first gateway can obtain information about the first computing node and a key associated with the first region based on the information carried in the second message. Then, the first gateway can use the information about the first computing node and the key associated with the first region to obtain a seventh key, and then use the seventh key to decrypt the second message, thereby successfully obtaining the first message.

[0019] In one possible implementation, the first compute node includes: a physical server, a virtual machine, a container, a microvirtual machine, or a bare metal server.

[0020] A second aspect of this application provides a cloud service system, comprising a first computing node located in a first region, a first gateway located in the first region, a second gateway located in a second region, and a second computing node located in the second region. The first computing node is configured to: encrypt a first message based on information of the first computing node and a key associated with the first region to obtain a second message, and send the second message to the first gateway; the first gateway is configured to: decrypt the second message to obtain the first message, and encrypt the first message based on information of the first gateway and a key associated with the first and second regions to obtain a third message, and send the third message to the second gateway; the second gateway is configured to: decrypt the third message to obtain the first message, and encrypt the first message based on information of the second gateway and a key associated with the second region to obtain a fourth message, and send the fourth message to the second computing node; the second computing node is configured to: decrypt the fourth message to obtain the first message.

[0021] In one possible implementation, the key associated with the first region includes a first key and a second key. A first computing node is used to: calculate the first key and the second key to obtain a third key; calculate the third key to obtain a fourth key; calculate the third key and the fourth key to obtain a fifth key; obtain a sixth key based on the fifth key; and encrypt the first message based on the sixth key and the information of the first computing node to obtain a second message.

[0022] In one possible implementation, the first computing node is used to use the fifth key as the sixth key.

[0023] In one possible implementation, the first computing node is also used to: calculate the third key and the fourth key to obtain the seventh key; and to calculate the fifth key and the seventh key to obtain the sixth key.

[0024] In one possible implementation, the first computing node is further configured to: obtain a first key identity number ID, a second key ID, and a key version; concatenate the ID of the first region and the first key ID to obtain a third key ID; concatenate the ID of the first region and the second key ID to obtain a fourth key ID; determine multiple candidate keys corresponding to the third key ID from a preset key set, and determine the candidate key corresponding to the key version from the multiple candidate keys corresponding to the third key ID as the first key; determine multiple candidate keys corresponding to the fourth key ID from the key set, and determine the candidate key corresponding to the key version from the multiple candidate keys corresponding to the fourth key ID as the second key.

[0025] In one possible implementation, the information of the first computing node includes: the ID of the first computing node or the ID of the session between the first computing node and the second computing node.

[0026] In one possible implementation, the first gateway is configured to: obtain information about the first computing node and a key associated with the first region based on the second message; and decrypt the second message based on the information about the first computing node and the key associated with the first region to obtain the first message.

[0027] In one possible implementation, the first compute node includes: a physical server, a virtual machine, a container, a microvirtual machine, or a bare metal server.

[0028] A third aspect of this application provides a computing device cluster, the computing device cluster including at least one computing device, each computing device including a processor and a memory: the memory is used to store instructions; the processor is used to cause the computing device cluster to perform the method described in the first aspect or any possible implementation of the first aspect according to the instructions.

[0029] A fourth aspect of this application provides a computer storage medium storing one or more instructions that, when executed by one or more computers, cause the one or more computers to perform the method described in the first aspect or any possible implementation of the first aspect.

[0030] A fifth aspect of this application provides a computer program product storing instructions that, when executed by a computer, cause the computer to perform the method described in the first aspect or any possible implementation of the first aspect.

[0031] In this embodiment, a first computing node in the first region can encrypt a first message based on its information and a key associated with the first region, thereby obtaining a second message and sending it to a first gateway in the first region. Then, the first gateway can decrypt the second message to obtain the first message, and encrypt it again using its information and a key associated with both the first and second regions, thereby obtaining a third message and sending it to a second gateway in the second region. Subsequently, the second gateway can decrypt the third message to obtain the first message, and encrypt it again using its information and a key associated with the second region, thereby obtaining a fourth message and sending it to a second computing node. The second computing node can then decrypt the fourth message to obtain the first message. In the aforementioned process, when the first computing node located in the first region needs to transmit the first message to the second computing node located in the second region, the first computing node can encrypt the first message and transmit the resulting second message to the first gateway. The first gateway can encrypt the first message and transmit the resulting third message to the second gateway. The second gateway can encrypt the first message and transmit the resulting fourth message to the second computing node. Thus, even if the first computing node and the second computing node are located in the first region and the second region, respectively, with the cooperation of the gateways in these two regions (i.e., the first gateway and the second gateway), the two computing nodes can achieve encryption of the entire transmission process of the first message, that is, to achieve encryption of the entire message transmission chain across domains from end to end, so as to avoid potential security risks in the message transmission process and improve the security of cross-domain communication between computing nodes. Attached Figure Description

[0032] Figure 1 A schematic diagram of the structure of the cloud service system provided in the embodiments of this application;

[0033] Figure 2 A schematic diagram of an encrypted message generated based on TCP / IP, provided as an embodiment of this application;

[0034] Figure 3 A schematic diagram of an encrypted message generated based on UBoE, provided in an embodiment of this application;

[0035] Figure 4a A schematic diagram of an encrypted message generated based on RoCE, provided in an embodiment of this application;

[0036] Figure 4b Another schematic diagram of the encrypted message generated based on RoCE provided in this application embodiment;

[0037] Figure 5 This is a flowchart illustrating a communication method based on a cloud service system.

[0038] Figure 6 A schematic diagram of the communication process provided in an embodiment of this application;

[0039] Figure 7 A schematic diagram of linear velocity derivation provided in an embodiment of this application;

[0040] Figure 8 Another schematic diagram of linear velocity derivation provided in the embodiments of this application;

[0041] Figure 9 A schematic diagram of the structure of the first computing node provided in an embodiment of this application;

[0042] Figure 10 A schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0043] Figure 11 A schematic diagram of the structure of a computing device cluster provided in an embodiment of this application;

[0044] Figure 12 This is a schematic diagram illustrating the network connection of computer devices in a computer cluster provided in an embodiment of this application. Detailed Implementation

[0045] This application provides a communication method and a cloud service system based on a cloud service system, which can realize the encryption process of the entire message transmission chain across domains from end to end, so as to avoid security risks in the message transmission process and improve the security of cross-domain communication between computing nodes.

[0046] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0047] With the rapid development of cloud technology, more and more tenants are choosing compute node clusters provided by cloud vendors to complete their business. When tenants have business needs, the compute nodes providing cloud services to tenants often need to transmit messages. This process usually involves message security issues, so the messages need to be encrypted.

[0048] In related technologies, a cloud service system may include multiple computing nodes that provide cloud services to tenants. When a tenant has business needs, they can trigger communication between two computing nodes located in the same area. Within this area, the source computing node encrypts the message it needs to send, obtaining an encrypted message, and then sends the encrypted message to the destination computing node. The destination computing node then decrypts the encrypted message to obtain the original message, which it then processes to meet the tenant's business needs.

[0049] In the above process, cloud providers typically enable encrypted transmission of messages only for the source and destination computing nodes within the same region. If these two computing nodes are located in different regions, the encryption process of the entire message transmission chain across domains cannot be achieved (for example, cloud providers often cannot enable encrypted transmission of messages in inter-regional communication), which leads to certain security risks in the message transmission process.

[0050] To address the aforementioned problems, this application provides a communication method based on a cloud service system, which can be implemented through the cloud service system. Figure 1 A schematic diagram of the cloud service system provided in the embodiments of this application is shown below. Figure 1 As shown, a cloud service system includes the infrastructure that provides cloud services and a cloud management platform that manages this infrastructure. The cloud management platform and the infrastructure are described separately below:

[0051] A cloud management platform can centrally manage the infrastructure of the entire cloud service system (for example, according to a tenant's instructions, multiple compute nodes can be created within the infrastructure; these compute nodes can run applications specified by the tenant, and these applications trigger communication between compute nodes during runtime to meet the tenant's business needs, etc.). The cloud management platform can also be open to tenants outside the cloud service system and respond to their requests. For example, the cloud management platform can provide various interfaces such as login and instance creation interfaces for tenant clients (e.g., the terminal devices used by the tenant or the browsers on those devices) to access. Specifically, the cloud management platform can authenticate a tenant's client through the login interface, allowing the tenant's client to log in after successful authentication. Similarly, the cloud management platform can also allow the tenant's client to send an instance creation request to the cloud management platform through the instance creation interface. Since the instance creation request indicates the multiple compute nodes required by the tenant, the cloud management platform can create multiple dedicated compute nodes for the tenant based on this request and deploy the tenant's specified applications on these compute nodes. When a tenant has business needs, they can trigger these applications to run, which in turn enables communication between multiple computing nodes running these applications, thereby meeting the tenant's business needs.

[0052] The infrastructure comprises multiple computing nodes created by the cloud management platform. Each of these nodes occupies a certain amount of computing resources (e.g., central processing unit (CPU) and graphics processing unit (GPU), storage resources (e.g., memory and disk), and network resources (e.g., network interface cards). Therefore, these computing nodes as a whole possess a large number of resources, enabling them to work collaboratively to provide high-quality remote services to tenants.

[0053] For any two computing nodes located in different regions among these multiple computing nodes, when these two computing nodes need to communicate, the source computing node can encrypt its original message based on its own information and the key associated with the source region (i.e., the region where the source computing node is located), and send the encrypted message to the gateway in the source region. Then, the gateway can decrypt the encrypted message to obtain the original message, and re-encrypt the original message using its own information and the key associated with both the source and destination regions (i.e., the region where the destination computing node is located), and send the re-encrypted message to the gateway in the destination region. Subsequently, the gateway can decrypt the re-encrypted message to obtain the original message, and re-encrypt the original message again using its own information and the key associated with the destination region, and send the re-encrypted message to the destination computing node. In this way, the destination computing node can decrypt the re-encrypted message to obtain the original message.

[0054] Since communication between source and destination computing nodes can be based on protocols such as Transmission Control Protocol (TCP) / Internet Protocol (IP), Remote Direct Memory Access over Converged Ethernet (RoCE), and Unified Bus over Ethernet (UBoE), the format of the raw messages obtained by the computing nodes differs depending on the protocol used. This difference leads to variations in the encrypted messages. The following is a brief introduction to the encrypted messages generated by these three communication protocols:

[0055] Figure 2 A schematic diagram of an encrypted message generated based on TCP / IP provided in an embodiment of this application, as shown below. Figure 2As shown, the encrypted message mainly consists of two parts: Additional Authentication Data (AAD) and the encrypted portion (i.e., the original message in ciphertext). The AAD includes a CAE (User Datagram Protocol, UDP) header and a CAE header. The CAE header contains information such as userkey-ver, syskey-ver, region-ID, userkey-ID, device-ID, random, and counter. This information can be used to decrypt the encrypted message later to obtain the original message in plaintext, which will not be elaborated on here. The encrypted portion includes the UDP port number and Virtual Extensible Local Area Network (VxLAN) messages.

[0056] Figure 3 A schematic diagram of an encrypted message generated based on UBoE provided in an embodiment of this application, as shown below. Figure 3 As shown, the encrypted message mainly consists of two parts: the AAD (Access Adapter) and the encrypted part (i.e., the original message in ciphertext state). The AAD contains a CAE-UDP header and a CAE header. The CAE header contains information such as userkey-ver, syskey-ver, region-ID, userkey-ID, device-ID, random, and counter. This information can be used to decrypt the encrypted message later to obtain the original message in plaintext state; this will not be elaborated on here. The encrypted part contains the UDP port number (4792) and the UBoE message.

[0057] Figure 4a A schematic diagram of an encrypted message generated based on RoCE, provided in an embodiment of this application, is shown below. Figure 4aAs shown, the encrypted message mainly consists of two parts: an AAD (Access Advisory) and an encrypted portion (the original message in ciphertext). The AAD contains a CAE-UDP header and a CAE header. The CAE header includes information such as userkey-ver, syskey-ver, region-ID, userkey-ID, device-ID, random, and counter. This information can be used to decrypt the encrypted message later to obtain the original message in plaintext; this will not be elaborated on here. The encrypted portion contains the UDP port number (4789) and a VxLAN message. The VxLAN message contains the inner UDP port number (4791) and a standard-mode RoCE message.

[0058] Figure 4b Another schematic diagram of the encrypted message generated based on RoCE provided in this application embodiment is shown below. Figure 4b As shown, the encrypted message mainly consists of two parts: the AAD (Access Advisory) and the encrypted part (i.e., the original message in ciphertext state). The AAD includes a CAE-UDP header and a CAE header. The CAE header contains information such as userkey-ver, syskey-ver, region-ID, userkey-ID, device-ID, random, and counter. This information can be used to decrypt the encrypted message later to obtain the original message in plaintext state; this will not be elaborated on here. The encrypted part includes the UDP port number (4790) and VxLAN messages. The VxLAN messages include the inner UDP port number (4791) and simplified RoCE messages.

[0059] It should be noted that the above example introduces the format of the encrypted message. The format of the re-encrypted message generated by the gateway and the message after further re-encryption can also refer to the format of the encrypted message described above, and will not be repeated here.

[0060] Furthermore, multiple compute nodes serving a tenant can be used to run applications specified by the tenant. These applications can be either applications provided to the tenant by the cloud management platform (also known as cloud-native applications or cloud services, etc.) or applications owned by the tenant, etc., without specific restrictions here.

[0061] Furthermore, multiple computing nodes in the infrastructure can be presented in various ways. For example, these multiple computing nodes can be physical servers selected by the cloud management platform in the infrastructure; they can also be bare metal servers (BMS) selected by the cloud management platform in the infrastructure; they can also be virtual machines (VMs) created by the cloud management platform on physical servers using virtualization technology; they can also be containers created by the cloud management platform on physical servers using virtualization technology; they can also be micro virtual machines (microVMs) created by the cloud management platform on physical servers using virtualization technology, and so on.

[0062] Furthermore, gateways that provide packet forwarding capabilities for multiple computing nodes can also be presented in various ways. For example, these gateways can be physical servers selected by the cloud management platform in the infrastructure; they can also be BMS selected by the cloud management platform in the infrastructure; they can also be VMs created by the cloud management platform on physical servers using virtualization technology; they can also be containers created by the cloud management platform on physical servers using virtualization technology; they can also be microVMs created by the cloud management platform on physical servers using virtualization technology, and so on.

[0063] Furthermore, for multiple computing nodes in the infrastructure, these nodes can be deployed in the same site or different sites. These sites can be presented in various forms, such as one or more regions in the infrastructure, one or more availability zones (AZs) in the infrastructure, one or more data centers (DCs) in the infrastructure, one or more server rooms in the infrastructure, or one or more racks in the infrastructure.

[0064] Based on the aforementioned cloud service system, it is known that a source computing node can encrypt its original message using its own information and a key associated with the source region (i.e., the region where the source computing node is located), and send the encrypted message to a gateway in the source region. The gateway then decrypts the encrypted message to obtain the original message, and re-encrypts it using its own information and the key associated with both the source and destination regions (i.e., the region where the destination computing node is located), before sending the re-encrypted message to the gateway in the destination region. Subsequently, the gateway decrypts the re-encrypted message to obtain the original message, and re-encrypts it again using its own information and the key associated with the destination region, before sending the re-encrypted message to the destination computing node. The destination computing node can then decrypt the re-encrypted message to obtain the original message. In the aforementioned process, when a computing node in the source region needs to transmit an original message to a computing node in the destination region, the source computing node can encrypt the original message and transmit the encrypted message to the gateway in the source region. The gateway in the source region can encrypt the original message and transmit the re-encrypted message to the gateway in the destination region. The gateway in the destination region can encrypt the original message and transmit the re-encrypted message to the destination computing node. Therefore, even if the source and destination computing nodes are located in different regions (source and destination regions respectively), with the cooperation of the gateways in these two regions, encryption of the entire transmission process of the original message can be achieved. This means encryption of the entire end-to-end message transmission chain across domains, avoiding potential security risks during message transmission and improving the security of cross-domain communication between computing nodes. To further understand the workflow of the cloud service system, the following section combines... Figure 5 This workflow will be described. Figure 5 This is a flowchart illustrating a communication method based on a cloud service system, such as... Figure 5 As shown, this method can be achieved through, as Figure 1 The cloud service system implementation shown includes a first computing node (i.e., the source computing node) located in a first region (i.e., the source region), a first gateway (i.e., the gateway in the source region) located in the first region, a second gateway (i.e., the gateway in the destination region) located in a second region (i.e., the destination region), and a second computing node (i.e., the destination computing node) located in the second region. The method includes:

[0065] 501. The first computing node encrypts the first message based on the information of the first computing node and the key associated with the first area to obtain the second message, and sends the second message to the first gateway.

[0066] In this embodiment, when the first computing node needs to send a first message (i.e., the original message) to the second computing node, the first computing node can use its information and the key associated with the first region to encrypt the first message, thereby obtaining the second message (i.e., the encrypted message).

[0067] After receiving the second message, the first computing node can send the second message to the first gateway.

[0068] Specifically, the key associated with the first zone may include a first key and a second key. The first key is the user key associated with the first zone, and the second key is the system key. It is worth noting that the first key is usually a key exclusive to the first zone, while the second key is a globally shared key, meaning that the second key can be used within the first zone, between the first and second zones, and within the second zone itself.

[0069] More specifically, the first computing node can obtain the first key and the second key in the following ways:

[0070] After determining that the first message needs to be encrypted, the first compute node can first obtain the identity document (ID) of the first region, the first key ID, the second key ID, and the current key version. It should be noted that the ID of the first region, the first key ID, and the second key ID are usually set in the first compute node after it is created by the cloud management platform. The current key version can be provided to the first compute node by the cloud management platform in real time or in advance; there is no restriction here.

[0071] Next, the first computing node can concatenate the ID of the first region and the ID of the first key to obtain the third key ID, and concatenate the ID of the first region and the ID of the second key to obtain the fourth key ID.

[0072] After obtaining the third key ID and the fourth key ID, the first computing node can obtain a preset key set. This key set contains a large number of candidate keys provided by the cloud management platform to the first computing node. These candidate keys correspond to a large number of key IDs. For any given key ID, the key ID corresponds to multiple candidate keys. The multiple candidate keys corresponding to the key ID are usually candidate keys of different key versions.

[0073] Based on this, the first computing node can determine multiple candidate keys corresponding to the third key ID from the key set, and determine the candidate key corresponding to the current key version from the multiple candidate keys corresponding to the third key ID as the first key.

[0074] At the same time, the first computing node can also determine multiple candidate keys corresponding to the fourth key ID from the key set, and determine the candidate key corresponding to the key version from the multiple candidate keys corresponding to the fourth key ID as the second key.

[0075] For example, such as Figure 6 As shown ( Figure 6 (This is a schematic diagram of the communication process provided in an embodiment of this application). Suppose that computing node 1 in region1 needs to send an original message (first message) to computing node 2 in region2. Computing node 1 can determine that the original message needs to be encrypted. Therefore, computing node 1 can first obtain region1-ID (ID of the first region), userkey1-ID (first key ID), all-zero key-ID (that is, the ID is zero, which is the aforementioned second key ID) and the current key version. The current key version includes userkey1-ver-cur (let it be key version 1) and syskey-ver-cur (let it be key version 1).

[0076] Next, compute node 1 can concatenate region1-ID with userkey1-ID to obtain key1-ID (third key ID), and concatenate region1-ID with all-zero key-ID to obtain key2-ID (fourth key ID).

[0077] Then, compute node 1 can obtain a key set, which may include a series of candidate keys such as userkey_11 (corresponding to key1-ID and being a userkey of key version 1), userkey_12 (corresponding to key1-ID and being a userkey of key version 2), ..., userkey_1m (corresponding to key1-ID and being a userkey of key version m), and syskey_11 (corresponding to key2-ID and being a syskey of key version 1), syskey_12 (corresponding to key2-ID and being a syskey of key version 2), ..., syskey_1n (corresponding to key2-ID and being a syskey of key version n).

[0078] Subsequently, computing node 1 can determine userkey_11, userkey_12, ..., userkey_1m corresponding to key1-ID from the key set. Since the current key version is userkey1-ver-cur, computing node 1 can determine userkey_11 (the first key) corresponding to userkey1-ver-cur from userkey_11, userkey_12, ..., userkey_1m.

[0079] Similarly, computing node 1 can determine syskey_11, syskey_12, ..., syskey_1n corresponding to key2-ID from this key set. Since the current key version is syskey-ver-cur, computing node 1 can determine syskey_11 (the second key) corresponding to syskey-ver-cur from syskey_11, syskey_12, ..., syskey_1n.

[0080] More specifically, the first computing node can encrypt the first message using the following various line-rate derivation methods to obtain the second message:

[0081] (1) After obtaining the first key and the second key, the first computing node can perform calculations on the first key and the second key to obtain the third key.

[0082] After obtaining the third key, the first computing node can perform calculations on the third key to obtain the fourth key.

[0083] After obtaining the fourth key, the first computing node can perform a series of calculations on the third and fourth keys to obtain the fifth key.

[0084] After obtaining the fifth key, the first computing node can directly use the fifth key as the sixth key, and use the sixth key and the information of the first computing node (such as the ID of the first computing node or the ID of the session between the first computing node and the second computing node, etc.) to encrypt the first message, thereby obtaining the second message.

[0085] As in the example above, such as Figure 7 As shown ( Figure 7 (This is a schematic diagram of line-rate derivation provided in an embodiment of this application). After obtaining userkey_11 and syskey_11, computing node 1 can first calculate userkey_11 and syskey_11 to obtain masterKey_1 (the third key), which is 32 bytes in size.

[0086] Next, computing node 1 can compute masterKey_1 to obtain maskKey_1 (the fourth key).

[0087] Then, computing node 1 can perform a series of calculations on masterKey_1 and maskKey_1, and its output (the fifth key) can be directly used as datakey_1 (the sixth key) with a size of 128 bits.

[0088] Based on this, compute node 1 can calculate a random number nonce1 = unique1-ID || random1 || counter1, where unique1-ID is 4 bytes in size and can be the last 4 bytes of device1-ID (the ID of the first compute node) or Conn1-ID (the ID of the session between the first and second compute nodes). random1 and Counter1 can be pre-set data for compute node 1, with random1 being 1 byte in size and Counter1 being 7 bytes in size.

[0089] Then, compute node 1 can encrypt the original plaintext message plaintext to obtain the original ciphertext message: ciphertext1 = AES-256-GCM(dataKey_1, nonce1, plaintext, AAD). The AAD contains information such as userkey1-ver-cur, syskey-ver-cur, region1-ID, userkey1-ID, device1-ID (or Conn1-ID), random1, and counter1.

[0090] Finally, compute node 1 can use ciphertext1 as the encrypted part of the encrypted message, add AAD to the encrypted message, and add the remaining parts required for the encrypted message to construct the encrypted message (second message), and send the encrypted message to gateway 1 of region 1.

[0091] (2) After obtaining the first key and the second key, the first computing node can perform calculations on the first key and the second key to obtain the third key.

[0092] After obtaining the third key, the first computing node can perform calculations on the third key to obtain the fourth key.

[0093] After obtaining the fourth key, the first computing node can perform a series of calculations on the third and fourth keys to obtain the fifth key.

[0094] After obtaining the fourth key, the first computing node can also calculate the third and fourth keys again to obtain the seventh key;

[0095] After obtaining the fifth and seventh keys, the first computing node can calculate the sixth key using the fifth and seventh keys to obtain the sixth key. Then, it can use the sixth key and the information of the first computing node (e.g., the ID of the first computing node or the ID of the session between the first computing node and the second computing node, etc.) to encrypt the first message to obtain the second message.

[0096] As in the example above, such as Figure 8 As shown ( Figure 8 (This is another schematic diagram of line-rate derivation provided in an embodiment of this application). After obtaining userkey_11 and syskey_11, computing node 1 can first calculate userkey_11 and syskey_11 to obtain masterKey_1.

[0097] Next, compute node 1 can compute masterKey_1 to obtain maskKey_1.

[0098] Subsequently, computing node 1 can perform a series of operations on masterKey_1 and maskKey_1, and the resulting output (the fifth key) can be recorded as output 1. At the same time, computing node 1 can perform another series of operations on masterKey_1 and maskKey_1, and the resulting output (the seventh key) can be recorded as output 2.

[0099] In this way, the computing node can perform calculations on output 1 and output 2 to obtain datakey_1 (the sixth key) with a size of 256 bits.

[0100] Next, computing node 1 can calculate the random number nonce1 = unique1 - ID||random1||counter1.

[0101] Then, compute node 1 can encrypt the original plaintext message plaintext to obtain the original ciphertext message: ciphertext1 = AES-256-GCM(dataKey_1, nonce1, plaintext, AAD). The AAD contains information such as userkey1-ver-cur, syskey-ver-cur, region1-ID, userkey1-ID, device1-ID (or Conn1-ID), random1, and counter1.

[0102] Finally, compute node 1 can use ciphertext1 as the encrypted part of the encrypted message, add AAD to the encrypted message, and add the remaining parts required for the encrypted message to construct the encrypted message, and send the encrypted message to gateway 1 of region 1.

[0103] 502. The first gateway decrypts the second message to obtain the first message, and encrypts the first message based on the information of the first gateway and the key associated with the first area and the second area to obtain the third message, and sends the third message to the second gateway.

[0104] After receiving the second message, the first gateway can decrypt the second message to obtain the first message. Based on the information of the first gateway and the key associated with the first and second areas, the first message is encrypted to obtain the third message (the re-encrypted message), and then the third message is sent to the second gateway.

[0105] Specifically, the first gateway can decrypt the second message to obtain the first message in the following way:

[0106] Upon receiving the second message, the first gateway can obtain the information of the first computing node and the key associated with the first area based on the information carried in the second message. Then, the first gateway can use the information of the first computing node and the key associated with the first area to obtain the sixth key, and then use the sixth key to decrypt the second message, thereby obtaining the first message. It should be noted that the process by which the first gateway obtains the sixth key is similar to the process by which the first computing node obtains the sixth key, and will not be elaborated here.

[0107] As in the example above, after obtaining the encrypted message, Gateway 1 can obtain information such as userkey1-ver-cur, syskey-ver-cur, region1-ID, userkey1-ID, device1-ID (or Conn1-ID), random1, and counter1 from the AAD of the encrypted message. Therefore, Gateway 1 can use the information such as userkey1-ver-cur, syskey-ver-cur, region1-ID, userkey1-ID, device1-ID (or Conn1-ID) to derive datakey_1 online, and then use the information such as device1-ID (or Conn1-ID), random1, and counter1 to calculate nonce1.

[0108] Then, Gateway 1 can obtain the encrypted part from the encrypted message, which is the original message ciphertext1 in the ciphertext state, and decrypt it to obtain the original message in the plaintext state: plaintext = AES-256-GCM(datakey_1,nonce1,ciphertext1,AAD).

[0109] More specifically, the keys associated with the first and second regions may include an eighth key and a ninth key. The eighth key is the user key associated with the first and second regions, and the ninth key is the system key (syskey). It is worth noting that the eighth key is usually a key shared between the first and second regions, while the ninth key is a globally shared key. That is, the ninth key can be used within the first region, between the first and second regions, and within the second region. Therefore, the ninth key and the aforementioned second key are usually the same key.

[0110] More specifically, the first gateway can obtain the eighth and ninth keys in the following ways.

[0111] After determining that the first message needs to be encrypted, the first gateway can first obtain the global zone ID (i.e., an ID that can be shared between the first and second zones; the ID of the first zone is a unique ID within the first zone, and the ID of the second zone is a unique ID within the second zone), the fifth key ID, the sixth key ID, and the current key version. It should be noted that the global zone ID, the fifth key ID, and the second key ID are usually set in the first gateway by the cloud management platform after its creation. The current key version can be provided to the first gateway by the cloud management platform in real time or in advance; there is no restriction on this.

[0112] Next, the first gateway can concatenate the global region ID and the fifth key ID to obtain the seventh key ID, and concatenate the global region ID and the sixth key ID to obtain the eighth key ID.

[0113] After obtaining the seventh key ID and the eighth key ID, the first gateway can obtain a preset key set. This key set contains a large number of candidate keys provided by the cloud management platform to the first gateway. These candidate keys correspond to a large number of key IDs. For any given key ID, the key ID corresponds to multiple candidate keys. The multiple candidate keys corresponding to the key ID are usually candidate keys of different key versions.

[0114] Based on this, the first gateway can determine multiple candidate keys corresponding to the sixth key ID from the key set, and determine the candidate key corresponding to the current key version as the eighth key from the multiple candidate keys corresponding to the seventh key ID.

[0115] At the same time, the first gateway can also determine multiple candidate keys corresponding to the eighth key ID from the key set, and determine the candidate key corresponding to the key version from the multiple candidate keys corresponding to the eighth key ID as the ninth key.

[0116] As in the example above, Gateway 1 needs to send the original message (first message) to Gateway 2 in Region 2. Gateway 1 can determine that the original message needs to be encrypted. Therefore, Gateway 1 can first obtain the regionS-ID (the ID of the global region), userkey2-ID (the fifth key ID), all-zero key-ID (that is, the ID is zero, which is the aforementioned sixth key ID), and the current key version. The current key version includes userkey2-ver-cur (let it be key version 1) and syskey-ver-cur (let it be key version 1).

[0117] Next, Gateway 1 can concatenate regionS-ID with userkey2-ID to obtain key3-ID (seventh key ID), and concatenate regionS-ID with all-zero key-ID to obtain key4-ID (eighth key ID).

[0118] Then, Gateway 1 can obtain a set of keys, which may include a series of candidate keys such as userkey_21 (corresponding to key3-ID and being a userkey of key version 1), userkey_22 (corresponding to key3-ID and being a userkey of key version 2), ..., userkey_2m (corresponding to key3-ID and being a userkey of key version m), and syskey_11 (corresponding to key4-ID and being a syskey of key version 1), syskey_12 (corresponding to key4-ID and being a syskey of key version w), ..., syskey_1n (corresponding to key4-ID and being a syskey of key version n).

[0119] Subsequently, Gateway 1 can determine userkey_21, userkey_22, ..., userkey_2m corresponding to key3-ID from the key set. Since the current key version is userkey2-ver-cur, Gateway 1 can determine userkey_21 (the eighth key) corresponding to userkey2-ver-cur from userkey_21, userkey_22, ..., userkey_2m.

[0120] Similarly, Gateway 1 can determine syskey_11, syskey_12, ..., syskey_1n corresponding to key4-ID from this key set. Since the current key version is syskey-ver-cur, Gateway 1 can determine syskey_11 (the ninth key) corresponding to syskey-ver-cur from syskey_11, syskey_12, ..., syskey_1n.

[0121] More specifically, the first gateway can encrypt the first message using the following various line-rate derivation methods to obtain the third message:

[0122] (1) After obtaining the eighth key and the ninth key, the first gateway can calculate the eighth key and the ninth key to obtain the tenth key.

[0123] After obtaining the tenth key, the first gateway can calculate the eleventh key.

[0124] After obtaining the eleventh key, the first gateway can calculate the twelfth key by combining the tenth and eleventh keys.

[0125] After obtaining the twelfth key, the first gateway can directly use the twelfth key as the thirteenth key, and use the thirteenth key and the information of the first gateway (such as the ID of the first gateway or the ID of the session between the first gateway and the second gateway, etc.) to encrypt the first message, thereby obtaining the third message.

[0126] As in the example above, after obtaining userkey_21 and syskey_11, gateway 1 can first calculate userkey_21 and syskey_11 to obtain masterKey_2 (the tenth key), which is 32 bytes in size.

[0127] Next, gateway 1 can calculate masterKey_2 to obtain maskKey_2 (the eleventh key).

[0128] Subsequently, Gateway 1 can perform operations on masterKey_2 and maskKey_2, and the output (the twelfth key) can be directly used as datakey_2 (the thirteenth key) with a size of 128 bits.

[0129] Based on this, Gateway 1 can calculate a random number nonce2 = unique2-ID || random2 || counter2, where Unique2-ID is 4 bytes in size and can be the last 4 bytes of device2-ID (the ID of the first gateway) or Conn2-ID (the ID of the session between the first and second gateways). Random2 and Counter2 can be pre-set data from Gateway 1, with random2 being 1 byte in size and Counter2 being 7 bytes in size.

[0130] Then, gateway 1 can encrypt the original plaintext message to obtain the original ciphertext message: ciphertext2 = AES-256-GCM(dataKey_2,nonce2,plaintext,AAD). The AAD contains information such as userkey2-ver-cur, syskey-ver-cur, regionS-ID, userkey2-ID, device2-ID (or Conn2-ID), random2, and counter2.

[0131] Finally, compute node 1 can use ciphertext2 as the encrypted part of the re-encrypted message, add AAD to the re-encrypted message, and add the remaining parts required for the re-encrypted message to construct the re-encrypted message (third message), and send the re-encrypted message to gateway 2 of region2.

[0132] (2) After obtaining the eighth key and the ninth key, the first gateway can calculate the eighth key and the ninth key to obtain the tenth key.

[0133] After obtaining the tenth key, the first gateway can calculate the eleventh key.

[0134] After obtaining the eleventh key, the first gateway can calculate the twelfth key by combining the tenth and eleventh keys.

[0135] After obtaining the eleventh key, the first gateway can also calculate the tenth and eleventh keys to obtain the fourteenth key.

[0136] After obtaining the twelfth and fourteenth keys, the first gateway can calculate the thirteenth key using the twelfth and fourteenth keys to obtain the thirteenth key. Then, it can use the thirteenth key and the information of the first gateway to encrypt the first message to obtain the third message.

[0137] As in the example above, after obtaining userkey_21 and syskey_11, gateway 1 can first calculate userkey_21 and syskey_11 to obtain masterKey_2.

[0138] Next, gateway 1 can calculate masterKey_2 to obtain maskKey_2.

[0139] Subsequently, Gateway 1 can perform calculations on masterKey_2 and maskKey_2, and the resulting output can be recorded as Output 1. At the same time, Gateway 1 can perform calculations on masterKey_2 and maskKey_2 again, and the resulting output (the fourteenth key) can be recorded as Output 2.

[0140] In this way, the computing node can perform calculations on output 1 and output 2 to obtain datakey_2 (the thirteenth key) with a size of 256 bits.

[0141] Next, gateway 1 can calculate the random number nonce2 = unique2 - ID||random2||counter2.

[0142] Therefore, gateway 1 can encrypt the original plaintext message to obtain the original ciphertext message: ciphertext2 = AES-256-GCM(dataKey_2,nonce2,plaintext,AAD). The AAD message contains information such as userkey2-ver-cur, syskey-ver-cur, regionS-ID, userkey2-ID, device2ID (or Conn2-ID), random2, and counter2.

[0143] Finally, Gateway 1 can use ciphertext2 as the encrypted part of the re-encrypted message, add AAD to the re-encrypted message, and add the remaining parts required for the re-encrypted message to construct the re-encrypted message, and send the re-encrypted message to Gateway 2 in region2.

[0144] 503. The second gateway decrypts the third message to obtain the first message, and encrypts the first message based on the information of the second gateway and the key associated with the second area to obtain the fourth message, and sends the fourth message to the second computing node.

[0145] After receiving the third message, the second gateway can decrypt the third message to obtain the first message. Based on the information of the second gateway and the key associated with the second area, the first message is encrypted to obtain the fourth message (the message after re-encryption), and then the fourth message is sent to the second computing node.

[0146] Specifically, the second gateway can decrypt the third message to obtain the first message in the following way:

[0147] Upon receiving the third message, the second gateway can obtain the information of the first gateway and the keys associated with the first and second regions based on the information carried in the third message. Then, the second gateway can use the information of the first gateway and the keys associated with the first and second regions to obtain the thirteenth key, and then use the thirteenth key to decrypt the third message, thereby obtaining the first message. It should be noted that the process by which the second gateway obtains the thirteenth key is similar to that of the first gateway, and will not be elaborated upon here.

[0148] As in the example above, after obtaining the re-encrypted message, Gateway 2 can obtain information such as userkey2-ver-cur, syskey-ver-cur, regionS-ID, userkey2-ID, device2-ID (or Conn2-ID), random2, and counter2 from the AAD of the re-encrypted message. Therefore, Gateway 2 can use the information such as userkey2-ver-cur, syskey-ver-cur, regionS-ID, userkey2-ID, device2-ID (or Conn2-ID) to derive datakey_2 online, and then use the information such as device2-ID (or Conn2-ID), random2, and counter2 to calculate nonce2.

[0149] Then, Gateway 2 can obtain the encrypted part from the re-encrypted message, which is the original message ciphertext2 in the ciphertext state, and decrypt it to obtain the original message in the plaintext state: plaintext = AES-256-GCM(datakey_2,nonce2,ciphertext2,AAD).

[0150] More specifically, the keys associated with the second region may include a fifteenth key and a sixteenth key, where the fifteenth key is the user key associated with the second region, and the sixteenth key is the system key (syskey). It is worth noting that the fifteenth key is usually a private key within the second region, while the sixteenth key is a globally shared key. That is, the sixteenth key can be used within the first region, between the first and second regions, and within the second region. Therefore, the sixteenth key and the aforementioned second key are usually the same key.

[0151] More specifically, the second gateway can obtain the fifteenth and sixteenth keys in the following ways.

[0152] After determining that the first message needs to be encrypted, the second gateway can first obtain the ID of the second area, the ID of the ninth key, the ID of the tenth key, and the current key version. It should be noted that the ID of the second area, the ID of the ninth key, and the ID of the tenth key are usually set in the second gateway after it is created by the cloud management platform. The current key version can be provided to the second gateway by the cloud management platform in real time or in advance; there is no restriction here.

[0153] Next, the second gateway can concatenate the ID of the second region and the ninth key ID to obtain the eleventh key ID, and concatenate the ID of the second region and the tenth key ID to obtain the twelfth key ID.

[0154] After obtaining the eleventh key ID and the twelfth key ID, the second gateway can obtain a preset key set. This key set contains a large number of candidate keys provided by the cloud management platform to the second gateway. These candidate keys correspond to a large number of key IDs. For any given key ID, the key ID corresponds to multiple candidate keys. The multiple candidate keys corresponding to the key ID are usually candidate keys of different key versions.

[0155] Based on this, the second gateway can determine multiple candidate keys corresponding to the eleventh key ID from the key set, and determine the candidate key corresponding to the current key version from the multiple candidate keys corresponding to the eleventh key ID as the nineteenth key.

[0156] At the same time, the second gateway can also determine multiple candidate keys corresponding to the twelfth key ID from the key set, and determine the candidate key corresponding to the key version from the multiple candidate keys corresponding to the twelfth key ID as the twentieth key.

[0157] As in the example above, gateway 2 needs to send the original message (first message) to compute node 2 in region 2. Gateway 2 can determine that the original message needs to be encrypted. Therefore, gateway 2 can first obtain region2-ID (the ID of the second region), userkey3-ID (the ninth key ID), all-zero key-ID (that is, the ID is zero, which is the aforementioned tenth key ID) and the current key version. The current key version includes userkey3-ver-cur (let it be key version 1) and syskey-ver-cur (let it be key version 1).

[0158] Next, Gateway 2 can concatenate region2-ID with userkey3-ID to obtain key5-ID (eleventh key ID), and concatenate region2-ID with all-zero key-ID to obtain key6-ID (twelfth key ID).

[0159] Then, Gateway 2 can obtain a set of keys, which may include a series of candidate keys such as userkey_31 (corresponding to key5-ID and being a userkey of key version 1), userkey_32 (corresponding to key5-ID and being a userkey of key version 2), ..., userkey_3m (corresponding to key5-ID and being a userkey of key version m), and syskey_11 (corresponding to key6-ID and being a syskey of key version 1), syskey_12 (corresponding to key6-ID and being a syskey of key version w), ..., syskey_1n (corresponding to key6-ID and being a syskey of key version n).

[0160] Subsequently, Gateway 2 can determine userkey_31, userkey_32, ..., userkey_3m corresponding to key5-ID from the key set. Since the current key version is userkey3-ver-cur, Gateway 2 can determine userkey_31 (the fifteenth key) corresponding to userkey3-ver-cur from userkey_31, userkey_32, ..., userkey_3m.

[0161] Similarly, gateway 2 can determine syskey_11, syskey_12, ..., syskey_1n corresponding to key6-ID from this key set. Since the current key version is syskey-ver-cur, gateway 2 can determine syskey_11 (the sixteenth key) corresponding to syskey-ver-cur from syskey_11, syskey_12, ..., syskey_1n.

[0162] More specifically, the second gateway can encrypt the first message using the following various line-rate derivation methods to obtain the fourth message:

[0163] (1) After obtaining the fifteenth key and the sixteenth key, the second gateway can calculate the fifteenth key and the sixteenth key to obtain the seventeenth key.

[0164] After obtaining the seventeenth key, the second gateway can calculate the eighteenth key from the seventeenth key.

[0165] After obtaining the eighteenth key, the second gateway can calculate the seventeenth and eighteenth keys to obtain the nineteenth key.

[0166] After obtaining the nineteenth key, the second gateway can use the nineteenth key as the twentieth key, and use the twentieth key and the information of the second gateway (e.g., the ID of the second gateway or the ID of the session between the second gateway and the second computing node, etc.) to encrypt the first message, thereby obtaining the fourth message.

[0167] As in the example above, after obtaining userkey_31 and syskey_11, gateway 2 can first calculate userkey_31 and syskey_11 to obtain masterKey_3 (the seventeenth key), which is 32 bytes in size.

[0168] Next, gateway 2 can calculate masterKey_3 to obtain maskKey_3 (the eighteenth key).

[0169] Subsequently, Gateway 2 can perform operations on masterKey_3 and maskKey_3, and the resulting output (the nineteenth key) can be directly used as datakey_3 (the twentieth key) with a size of 128 bits.

[0170] Based on this, Gateway 2 can calculate a random number nonce3 = unique3-ID || random3 || counter3, where Unique3-ID is 4 bytes in size and can be the last 4 bytes of either device3-ID (the ID of the second gateway) or Conn3-ID (the ID of the session between the second gateway and the second computing node). Random3 and Counter3 can be pre-set data from Gateway 2, with random3 being 1 byte in size and Counter3 being 7 bytes in size.

[0171] Gateway 2 can then encrypt the plaintext message to obtain the ciphertext message: ciphertext3 = AES-256-GCM(dataKey_3, nonce3, plaintext, AAD). The AAD message contains information such as userkey3-ver-cur, syskey-ver-cur, region2-ID, userkey3-ID, device3-ID (or Conn3-ID), random3, and counter3.

[0172] Finally, compute node 1 can use ciphertext3 as the encrypted part of the re-encrypted message, add AAD to the re-encrypted message, and add the remaining parts required for the re-encrypted message to construct the re-encrypted message (fourth message), and send the re-encrypted message to compute node 2 in region 2.

[0173] (2) After obtaining the fifteenth key and the sixteenth key, the second gateway can calculate the fifteenth key and the sixteenth key to obtain the seventeenth key.

[0174] After obtaining the seventeenth key, the second gateway can calculate the eighteenth key from the seventeenth key.

[0175] After obtaining the eighteenth key, the second gateway can calculate the seventeenth and eighteenth keys to obtain the nineteenth key.

[0176] After obtaining the eighteenth key, the second gateway can also calculate the seventeenth and eighteenth keys to obtain the twenty-first key.

[0177] After obtaining the nineteenth and twenty-first keys, the second gateway can calculate the nineteenth and twenty-first keys to obtain the twentieth key, and use the twentieth key to encrypt the first message to obtain the fourth message.

[0178] As in the example above, after obtaining userkey_31 and syskey_11, gateway 2 can first calculate userkey_31 and syskey_11 to obtain masterKey_3.

[0179] Next, gateway 2 can calculate masterKey_3 to obtain maskKey_3.

[0180] Subsequently, Gateway 2 can perform calculations on masterKey_3 and maskKey_3, and the resulting output (the nineteenth key) can be recorded as Output 1. At the same time, Gateway 2 can perform calculations on masterKey_3 and maskKey_3 again, and the resulting output (the twenty-first key) can be recorded as Output 2.

[0181] In this way, the computing node can perform calculations on output 1 and output 2 to obtain datakey_3 (the twentieth key) with a size of 256 bits.

[0182] Next, gateway 2 can calculate the random number nonce3 = unique3 - ID||random3||counter3.

[0183] Gateway 2 can then encrypt the plaintext message to obtain the ciphertext message: ciphertext3 = AES-256-GCM(dataKey_3, nonce3, plaintext, AAD). The AAD message contains information such as userkey3-ver-cur, syskey-ver-cur, region2-ID, userkey3-ID, device3ID (or Conn3-ID), random3, and counter3.

[0184] Finally, Gateway 2 can use ciphertext3 as the encrypted part of the re-encrypted message, add AAD to the re-encrypted message, and add the remaining parts required for the re-encrypted message to construct the re-encrypted message, and send the re-encrypted message to compute node 2 of region2.

[0185] 504. The second computing node decrypts the fourth message to obtain the first message.

[0186] After receiving the fourth message, the second computing node can decrypt the fourth message to obtain the first message, and then process the first message to complete the communication between the first computing node and the second computing node.

[0187] Specifically, the second computing node can decrypt the fourth message to obtain the first message in the following way:

[0188] Upon receiving the fourth message, the second computing node can obtain the information of the second gateway and the key associated with the second area based on the information carried in the fourth message. Then, the second computing node can use the information of the second gateway and the key associated with the second area to obtain the twentieth key, and then use the twentieth key to decrypt the fourth message, thereby obtaining the first message. It should be noted that the process by which the second computing node obtains the twentieth key is similar to the process by which the second gateway obtains the twentieth key, and will not be elaborated here.

[0189] As in the example above, after obtaining the re-encrypted message, compute node 2 can obtain information such as userkey3-ver-cur, syskey-ver-cur, region2-ID, userkey3-ID, device3-ID (or Conn3-ID), random3, and counter3 from the AAD of the re-encrypted message. Therefore, gateway 2 can use the information such as userkey3-ver-cur, syskey-ver-cur, region2-ID, userkey3-ID, device3-ID (or Conn3-ID) to derive datakey_3 online, and then use the information such as device3-ID (or Conn3-ID), random3, and counter3 to calculate nonce3.

[0190] Then, compute node 2 can obtain the encrypted part from the re-encrypted message, which is the original message ciphertext3 in the ciphertext state, and decrypt it to obtain the original message in the plaintext state: plaintext = AES-256-GCM(datakey_3,nonce3,ciphertext3,AAD).

[0191] In this embodiment, a first computing node in the first region can encrypt a first message based on its information and a key associated with the first region to obtain a second message, which is then sent to a first gateway in the first region. The first gateway then decrypts the second message to obtain the first message again, and encrypts it using its information and a key associated with both the first and second regions to obtain a third message, which is then sent to a second gateway in the second region. Subsequently, the second gateway decrypts the third message to obtain the first message again, and encrypts it using its information and a key associated with the second region to obtain a fourth message, which is then sent to a second computing node. The second computing node can then decrypt the fourth message to obtain the first message. In the aforementioned process, when the first computing node located in the first region needs to transmit the first message to the second computing node located in the second region, the first computing node can encrypt the first message and transmit the resulting second message to the first gateway. The first gateway can encrypt the first message and transmit the resulting third message to the second gateway. The second gateway can encrypt the first message and transmit the resulting fourth message to the second computing node. Thus, even if the first computing node and the second computing node are located in the first region and the second region, respectively, with the cooperation of the gateways in these two regions (i.e., the first gateway and the second gateway), the two computing nodes can achieve encryption of the entire transmission process of the first message, that is, to achieve encryption of the entire message transmission chain across domains from end to end, so as to avoid potential security risks in the message transmission process and improve the security of cross-domain communication between computing nodes.

[0192] Furthermore, in this embodiment, the first computing node, the first gateway, the second gateway, and the second computing node all support line-speed derivation to generate keys. This method is a high-speed key derivation technology, which can generate keys quickly enough without the need to pre-compute and store a lot of key data. This can avoid occupying a lot of computing and storage resources of the devices (first computing node, first gateway, second gateway, and second computing node), thereby improving resource utilization.

[0193] Furthermore, in the embodiments of this application, the high-speed key derivation technology provided can be applied to scenarios based on various communication protocols, such as communication scenarios between devices based on RoCE, communication scenarios between devices based on UBoE, etc., which is beneficial to the practicality of the solution.

[0194] The above is a detailed description of the communication method based on a cloud service system provided in the embodiments of this application. The following will describe the devices in the cloud service system provided in the embodiments of this application. Figure 9 A schematic diagram of the structure of the first computing node provided in the embodiments of this application, as shown below. Figure 9 As shown, the first computing node is located in the first region of the cloud service system. The cloud service system also includes a first gateway located in the first region, a second gateway located in the second region, and a second computing node located in the second region. The first computing node includes:

[0195] Encryption module 901 is used to encrypt a first message based on information from the first computing node and a key associated with the first region to obtain a second message; sending module 902 is used to send the second message to the first gateway; for example, encryption module 901 and sending module 902 are used to implement Figure 5 Step 501 in the illustrated embodiment.

[0196] The system comprises the following: A first gateway decrypts the second message to obtain a first message, and encrypts the first message using information from the first gateway and a key associated with the first and second areas to obtain a third message, which is then sent to the second gateway. A second gateway decrypts the third message to obtain the first message, and encrypts the first message using information from the second gateway and a key associated with the second area to obtain a fourth message, which is then sent to the second computing node. The second computing node decrypts the fourth message to obtain the first message. For example, the first gateway is used to implement... Figure 5 In step 502 of the illustrated embodiment, the second gateway is used to implement... Figure 5 In step 503 of the illustrated embodiment, the second computing node is used to implement... Figure 5 Step 504 in the illustrated embodiment.

[0197] In one possible implementation, the key associated with the first region includes a first key and a second key. The encryption module 901 is used to: calculate the first key and the second key to obtain a third key; calculate the third key to obtain a fourth key; calculate the third key and the fourth key to obtain a fifth key; obtain a sixth key based on the fifth key; and encrypt the first message based on the sixth key and the information of the first computing node to obtain a second message.

[0198] In one possible implementation, encryption module 901 is used to use the fifth key as the sixth key.

[0199] In one possible implementation, the encryption module 901 is further configured to: calculate the third key and the fourth key to obtain the seventh key; and calculate the fifth key and the seventh key to obtain the sixth key.

[0200] In one possible implementation, the encryption module 901 is further configured to: obtain a first key identification number ID, a second key ID, and a key version; concatenate the ID of the first region and the first key ID to obtain a third key ID; concatenate the ID of the first region and the second key ID to obtain a fourth key ID; determine multiple candidate keys corresponding to the third key ID from a preset key set, and determine the candidate key corresponding to the key version from the multiple candidate keys corresponding to the third key ID as the first key; determine multiple candidate keys corresponding to the fourth key ID from the key set, and determine the candidate key corresponding to the key version from the multiple candidate keys corresponding to the fourth key ID as the second key.

[0201] In one possible implementation, the information of the first computing node includes: the ID of the first computing node or the ID of the session between the first computing node and the second computing node.

[0202] In one possible implementation, the first gateway is configured to: obtain information about the first computing node and a key associated with the first region based on the second message; and decrypt the second message based on the information about the first computing node and the key associated with the first region to obtain the first message.

[0203] In one possible implementation, the first compute node includes: a physical server, a virtual machine, a container, a microvirtual machine, or a bare metal server.

[0204] It should be noted that the information interaction and implementation process between the modules / units of the above-mentioned device are based on the same concept as the method embodiments of this application, and the resulting technical effects are the same as those of the method embodiments of this application. For details, please refer to the description in the method embodiments shown above in the embodiments of this application, and will not be repeated here.

[0205] Please see Figure 10 , Figure 10 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Figure 10 As shown, the computing device 1000 (which can be used to represent the aforementioned first computing node, first gateway, second gateway, and second computing node; the first computing node is used as an example for illustrative purposes in the following description) includes: a processor 1001, a memory 1002, a communication interface 1003, and a bus 1004. The processor 1001, memory 1002, and communication interface 1003 are coupled via the bus (not shown in the figure). The memory 1002 stores instructions. When the execution instructions in the memory 1002 are executed, the computing device 1000 executes the method performed by the first computing node in the above method embodiment.

[0206] The computing device 1000 may be one or more integrated circuits configured to implement the methods described above, such as: one or more application-specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs), or a combination of at least two of these forms of integrated circuits. Furthermore, when the units in the device can be implemented in the form of a processing element scheduler, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor capable of calling programs. Alternatively, these units may be integrated together and implemented as a system-on-a-chip (SOC).

[0207] The processor 1001 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0208] The memory 1002 can be volatile memory or non-volatile memory, or it can include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0209] The memory 1002 stores executable program code, and the processor 1001 executes the executable program code to implement the functions of the aforementioned encryption module and sending module, thereby realizing the aforementioned communication method based on the cloud service system. That is, the memory 1002 stores instructions for executing the aforementioned communication method based on the cloud service system.

[0210] The communication interface 1003 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 1000 and other devices or communication networks.

[0211] In addition to the data bus, the 1004 bus can also include a power bus, a control bus, and a status signal bus. The bus can be a Peripheral Component Interconnect Express (PCIe) bus, an Extended Industry Standard Architecture (EISA) bus, a Unified Bus (Ubus or UB), a Compute Express Link (CXL) bus, a Cache Coherent Interconnect for Accelerators (CCIX) bus, etc. The bus can be divided into address bus, data bus, and control bus.

[0212] Please see Figure 11 , Figure 11 This is a schematic diagram of a computing device cluster provided in an embodiment of this application. Figure 11 As shown, the computing device cluster 1100 includes at least one computing device 1000.

[0213] like Figure 11 As shown, the computing device cluster 1100 includes at least one computing device 1000. The memory 1002 of one or more computing devices 1000 in the computing device cluster 1100 may store the same instructions for executing the communication method of the cloud service system described above.

[0214] In some possible implementations, the memory 1002 of one or more computing devices 1000 in the computing device cluster 1100 may also store partial instructions for executing the aforementioned communication method based on the cloud service system. In other words, a combination of one or more computing devices 1000 can jointly execute the aforementioned communication method based on the cloud service system.

[0215] It should be noted that the memory 1002 of different computing devices 1000 in the computing device cluster 1100 can store different instructions, which are used to execute some of the functions of the cloud management platform mentioned above. That is, the instructions stored in the memory 1002 of different computing devices 1000 can implement the functions of one or more modules such as the encryption module and the sending module.

[0216] In some possible implementations, one or more computing devices 1000 in the computing device cluster 1100 can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc.

[0217] Please see Figure 12 , Figure 12 This is a schematic diagram illustrating the network connection of computer devices in a computer cluster provided in an embodiment of this application. Figure 12 As shown, the two computing devices 1000A and 1000B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device.

[0218] In one possible implementation, the memory in computing device 1000A stores instructions for performing the functions of modules such as the encryption module. Meanwhile, the memory in computing device 1000B stores instructions for performing the functions of modules such as the sending module.

[0219] It should be understood that Figure 12 The functions of computing device 1000A shown can also be performed by multiple computing devices. Similarly, the functions of computing device 1000B can also be performed by multiple computing devices.

[0220] This application also relates to a computer storage medium storing a program for signal processing, which, when run on a computer, causes the computer to perform actions such as... Figure 5 The steps performed by the first computing node in the illustrated embodiment.

[0221] This application also relates to a computer program product that stores instructions that, when executed by a computer, cause the computer to perform actions such as... Figure 5 The steps performed by the first computing node in the illustrated embodiment.

[0222] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0223] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0224] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0225] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0226] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A communication method based on a cloud service system, characterized in that, The cloud service system includes a first computing node located in a first region, a first gateway located in the first region, a second gateway located in a second region, and a second computing node located in the second region. The method includes: The first computing node encrypts the first message based on its information and the key associated with the first region to obtain the second message, and sends the second message to the first gateway. The first gateway decrypts the second message to obtain the first message, and encrypts the first message based on the information of the first gateway and the key associated with the first area and the second area to obtain the third message, and sends the third message to the second gateway; The second gateway decrypts the third message to obtain the first message, and encrypts the first message based on the information of the second gateway and the key associated with the second area to obtain the fourth message, and sends the fourth message to the second computing node; The second computing node decrypts the fourth message to obtain the first message.

2. The method according to claim 1, characterized in that, The key associated with the first region includes a first key and a second key. Based on the information of the first computing node and the key associated with the first region, the first computing node encrypts the first message to obtain a second message, which includes: The first computing node calculates the third key using the first key and the second key; The first computing node calculates the fourth key using the third key; The first computing node calculates the fifth key using the third key and the fourth key; The first computing node obtains a sixth key based on the fifth key, and encrypts the first message based on the sixth key and the information of the first computing node to obtain a second message.

3. The method according to claim 2, characterized in that, The first computing node obtains the seventh key based on the sixth key, including: The first computing node uses the fifth key as the sixth key.

4. The method according to claim 2, characterized in that, The method further includes: The first computing node calculates the seventh key using the third key and the fourth key; The first computing node obtains the sixth key based on the fifth key, including: The first computing node calculates the sixth key by combining the fifth key and the seventh key.

5. The method according to any one of claims 2 to 4, characterized in that, The method further includes: The first computing node obtains the first key identity ID, the second key ID, and the key version; The first computing node concatenates the ID of the first region and the first key ID to obtain the third key ID; The first computing node concatenates the ID of the first region and the second key ID to obtain the fourth key ID; The first computing node determines multiple candidate keys corresponding to the third key ID from a preset key set, and determines the candidate key corresponding to the key version from the multiple candidate keys corresponding to the third key ID as the first key; The first computing node determines multiple candidate keys corresponding to the fourth key ID from the key set, and determines the candidate key corresponding to the key version from the multiple candidate keys corresponding to the fourth key ID as the second key.

6. The method according to any one of claims 1 to 5, characterized in that, The information of the first computing node includes: the ID of the first computing node or the ID of the session between the first computing node and the second computing node.

7. The method according to any one of claims 1 to 6, characterized in that, The first gateway decrypts the second message to obtain the first message, which includes: The first gateway obtains information about the first computing node and the key associated with the first region based on the second message; The first gateway decrypts the second message based on the information of the first computing node and the key associated with the first region to obtain the first message.

8. The method according to any one of claims 1 to 7, characterized in that, The first computing node includes: a physical server, a virtual machine, a container, a microvirtual machine, or a bare metal server.

9. A cloud service system, characterized in that, The cloud service system includes a first computing node located in a first region, a first gateway located in the first region, a second gateway located in a second region, and a second computing node located in the second region, wherein: The first computing node is configured to encrypt the first message based on the information of the first computing node and the key associated with the first region to obtain the second message, and send the second message to the first gateway; The first gateway is used to decrypt the second message to obtain the first message, and based on the information of the first gateway and the key associated with the first area and the second area, encrypt the first message to obtain the third message, and send the third message to the second gateway; The second gateway is used to decrypt the third message to obtain the first message, and based on the information of the second gateway and the key associated with the second area, encrypt the first message to obtain the fourth message, and send the fourth message to the second computing node; The second computing node is used to decrypt the fourth message to obtain the first message.

10. The system according to claim 9, characterized in that, The key associated with the first region includes a first key and a second key, and the first computing node is used for: A third key is obtained by calculating the first key and the second key; The fourth key is obtained by calculating the third key; The fifth key is obtained by calculating the third key and the fourth key; The sixth key is obtained based on the fifth key, and the first message is encrypted based on the sixth key and the information of the first computing node to obtain the second message.

11. The system according to claim 10, characterized in that, The first computing node is used to use the fifth key as the sixth key.

12. The system according to claim 10, characterized in that, The first computing node is further configured to: The seventh key is obtained by calculating the third key and the fourth key; The first computing node is used to calculate the sixth key from the fifth key and the seventh key.

13. The system according to any one of claims 10 to 12, characterized in that, The first computing node is further configured to: Obtain the first key identity ID, the second key ID, and the key version; The third key ID is obtained by concatenating the ID of the first region and the first key ID. The ID of the first region and the second key ID are concatenated to obtain the fourth key ID; From a preset key set, determine multiple candidate keys corresponding to the third key ID, and from the multiple candidate keys corresponding to the third key ID, determine the candidate key corresponding to the key version as the first key; From the key set, a plurality of candidate keys corresponding to the fourth key ID are determined, and from the plurality of candidate keys corresponding to the fourth key ID, the candidate key corresponding to the key version is determined as the second key.

14. The system according to any one of claims 9 to 13, characterized in that, The information of the first computing node includes: the ID of the first computing node or the ID of the session between the first computing node and the second computing node.

15. The system according to any one of claims 9 to 14, characterized in that, The first gateway is used for: Based on the second message, obtain the information of the first computing node and the key associated with the first region; Based on the information of the first computing node and the key associated with the first region, the second message is decrypted to obtain the first message.

16. The system according to any one of claims 9 to 15, characterized in that, The first computing node includes: a physical server, a virtual machine, a container, a microvirtual machine, or a bare metal server.

17. A computing device cluster, characterized in that, The computing device cluster includes at least one computing device, each computing device including a processor and memory: The memory is used to store instructions; The processor is configured to, according to the instructions, cause the computing device cluster to perform the method of any one of claims 1 to 8.

18. A computer storage medium, characterized in that, The computer storage medium stores one or more instructions that, when executed by one or more computers, cause the one or more computers to perform the method of any one of claims 1 to 8.

19. A computer program product, characterized in that, The computer program product stores instructions that, when executed by a computer, cause the computer to perform the method described in any one of claims 1 to 8.

Images