WO2022022057A1

WO2022022057A1 - Session ticket processing method and apparatus, electronic device, and computer readable storage medium

Info

Publication number: WO2022022057A1
Application number: PCT/CN2021/098070
Authority: WO
Inventors: 刘华
Original assignee: 北京金山云网络技术有限公司
Priority date: 2020-07-30
Filing date: 2021-06-03
Publication date: 2022-02-03
Also published as: CN111866172A

Abstract

The present application relates to the technical filed of communications. Provided are a session ticket processing method and apparatus, an electronic device, and a computer readable storage medium. The method comprises: receiving a new session ticket sent by a management server; updating session configuration, determining an original session ticket in the session configuration to be a primary key, and determining the new session ticket to be a secondary key, wherein both the primary key and the secondary key are configured to decrypt a communication session, it is preferred to use the primary key to decrypt the communication session, and the primary key is further configured to encrypt a communication session created after the new session ticket is received; if acknowledgement information indicating that a distributed cluster completes the update of the session configuration is received, determining the new session ticket as the primary key, and determining the original session ticket as the secondary key; and deleting the original session ticket when a preset time is reached. According to the session ticket processing method provided by the present application, the brief handshake rate of the whole network can be improved, the CPU consumption is saved, and the security of cluster communication is improved.

Description

Method, apparatus, electronic device and computer-readable storage medium for processing session ticket

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the priority of the Chinese Patent Application No. 202010754910.4 and entitled "Method, Apparatus and Electronic Equipment for Processing Session Tickets" filed with the China Patent Office on July 30, 2020, the entire contents of which are incorporated herein by reference Applying.

technical field

The present application relates to the field of communication technologies, and in particular, to a session ticket processing method, apparatus, electronic device, and computer-readable storage medium.

Background technique

As HTTPS (Hyper Text Transfer Protocol over SecureSocket Layer) access accounts for an increasing proportion of Internet access, for CDN (Content Delivery Network), how to reduce the cost caused by HTTPS CPU consumption has become an important issue, which requires improving the short handshake rate, and a very important solution is the session ticket mechanism of the short handshake.

At present, the distributed cluster web server Nginx can support the distributed session ticket (ticket) mechanism, but does not support the distributed session ID (session id) mechanism. In actual operation, when the old session ticket in the web server reaches the set security period, a new session ticket needs to be obtained. If the new session ticket is used to directly replace the old session ticket, because each server in the cluster replaces the session ticket There is a difference in time delay, and during the exchange of session tickets, two communication connection requests from the same client may reach two different servers. If the session tickets of the two servers are inconsistent, the client and one of the servers may The short handshake is not possible with another server. This situation will cause the short handshake rate of the entire network to plummet and increase the CPU consumption of the server.

On the whole, the deployment of session tickets in related distributed clusters will reduce the short handshake rate of the entire cluster network, increase server CPU consumption, and reduce the security of cluster communication.

SUMMARY OF THE INVENTION

In view of this, the purpose of this application is to provide a session ticket processing method, device, electronic device and computer-readable storage medium, which can improve the short handshake rate of the entire distributed cluster network, reduce CPU consumption, and improve cluster communication. security.

In a first aspect, an embodiment of the present application provides a method for processing session tickets, which is applied to a server in a distributed cluster, the server is in communication connection with a preset management server, and the management server is configured to generate a session ticket and store the session ticket. Sending the ticket to each server of the distributed cluster, the method includes: receiving a new session ticket sent by the management server; updating the session configuration, determining the original session ticket in the session configuration as the master key, and determining the new session ticket is the secondary key, wherein both the primary key and the secondary key are set to decrypt the communication session, and the primary key is preferentially used to decrypt the communication session, and the primary key is also set to decrypt the communication session when the primary key is received. The communication session created after the new session ticket is encrypted; if a confirmation message that the distributed cluster has completed updating the session configuration is received, the new session ticket is determined as the primary key, and the original session ticket is determined as the secondary key; and when When the preset time arrives, the original session ticket is deleted.

In one embodiment, the above communication session is one of a secure socket layer SSL session and a transport layer security TLS session.

In one embodiment, the preset time is not less than the validity period of the original session ticket.

In an embodiment, before the above step of receiving a new session ticket sent by the management server, the method further includes: enabling a preset switch control of the session ticket mechanism.

In one embodiment, the above-mentioned server is communicated with a preset client, and the method further includes: receiving a communication connection request sent by the client, the communication connection request carrying a session ticket; judging whether the session ticket is within the validity period; If it is determined that the session ticket is within the validity period, the session ticket is verified through the master key; and if the session ticket is verified through the master key, a communication session is established with the client.

In one embodiment, the above method further includes: if the session ticket is not verified by the primary key, verifying the session ticket by the secondary key; and if the session ticket is verified by the secondary key , establishes a communication session with the client.

In a second aspect, an embodiment of the present application further provides a session ticket processing device, which is applied to a server in a distributed cluster, the server is in communication connection with a preset management server, and the management server is configured to generate a session ticket and store the session ticket. The ticket is sent to each server of the distributed cluster, and the device includes: a new session ticket receiving module, set to receive the new session ticket sent by the management server; a session configuration update module, set to update the session The original session ticket is determined as the primary key, and the new session ticket is determined as the secondary key, wherein the primary key and the secondary key are both set to decrypt the communication session, and the primary key is preferentially used to decrypt the communication session. For decryption, the primary key is also set to encrypt the communication session created after receiving the new session ticket; the primary and secondary key adjustment module is set to receive confirmation information that the distributed cluster has completed updating the session configuration, The new session ticket is determined as the primary key, and the original session ticket is determined as the secondary key; and the original session ticket deletion module is set to delete the original session ticket when the preset time arrives.

In one embodiment, the above-mentioned apparatus further includes a session ticket mechanism enabling module, which is configured as a preset switch control for enabling the session ticket mechanism.

In one embodiment, the above-mentioned server is connected to a preset client in communication, and the above-mentioned device further includes: a communication connection request receiving module, configured to receive a communication connection request sent by the client, and the communication connection request carries a session ticket; The verification module is set to judge whether the session ticket is within the validity period, and if it is judged that the session ticket is within the validity period, verify the session ticket through the master key, and establish a communication session with the client if the session ticket is verified through the master key.

In one embodiment, the above-mentioned judgment and verification module is further configured to verify the session ticket by the secondary key if the session ticket is not verified by the primary key, and establish with the client if the session ticket is verified by the secondary key. communication session.

In a third aspect, an embodiment of the present application further provides an electronic device, the electronic device includes a processor and a memory, the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions To implement the above session ticket processing method.

In a fourth aspect, embodiments of the present application further provide a computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are called and executed by a processor, the computer-executable instructions The processor is prompted to implement the above session ticket processing method.

Additional features and advantages of the present application will be set forth in the description that follows, or some of the features and advantages may be inferred or unambiguously determined from the description, or may be learned by practicing the above-described techniques of the present application.

In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the preferred embodiments are exemplified below, and are described in detail as follows in conjunction with the accompanying drawings.

Description of drawings

In order to more clearly illustrate the technical solutions in the specific embodiments of the present application or related technologies, the following briefly introduces the accompanying drawings required in the description of the specific embodiments or related technologies. Obviously, the accompanying drawings in the following description are For some embodiments of the present application, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

1 is a schematic diagram of an application scenario of session communication through session tickets provided by an embodiment of the present application;

2 is a schematic flowchart of a method for processing a session ticket according to an embodiment of the present application;

3 is a schematic flowchart of another session ticket processing method provided by an embodiment of the present application;

4A is a schematic structural diagram of an apparatus for processing session tickets provided by an embodiment of the present application;

4B is a schematic structural diagram of another apparatus for processing session tickets according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Reference numeral description: 100-cluster server; 200-management server; 300-client; 41-new session ticket receiving module; 42-session configuration update module; 43-primary and secondary key adjustment module; 44-existing session ticket deletion module; 51-processor; 52-memory; 53-bus; 54-communication interface.

detailed description

In order to make the purposes, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions of the present application will be described clearly and completely below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, not all of them. example. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

A session is an uninterrupted request-response sequence between a client and a server. For each request from a client, the server can recognize that the request comes from the same client. A session is started when an unknown client sends its first request to a web application; a session ends when the client explicitly ends the session or the server does not accept any requests from the client within a predefined time limit.

In a web-based e-commerce environment, before the server allows clients to access protected resources within the website, the server typically implements authentication and/or authorization services in the form of guard gates, wherein the security processing performed by these authentication and authorization services can be divided into The following two stages.

In the first phase, the client and server establish a secure communication session, such as a Secure Sockets Layer (SSL) session, which can include certificate and key exchange between the client and the remote server in order to establish trust relationship, and negotiate the key and cipher that will be set to encrypt messages in the SSL session. Many websites use the SSL protocol in their authentication services. SSL or its successors, such as Transport Layer Security (TLS), are widely used protocols set up to establish secure connections from clients to servers in order to prevent message forgery, data tampering, and eavesdropping. Among them, the SSL handshake protocol allows the client and server to negotiate encryption algorithms and keys before the application protocol sends or receives its first data byte. In this way, the SSL handshake provides a secure communication session or connection that can be used by higher network layers for secure communication, including subsequent transmission of credential information for subsequent authentication operations or subsequent authorization operations.

In the second phase, after the secure communication session is completed, credential information is transmitted from the client to the server for subsequent authentication operations or subsequent authorization operations. For example, after an SSL session is established, the server requests the client to provide user credentials, the client provides the user credentials to the server, and the server verifies the user credentials in subsequent authentication or authorization operations. Based on authentication of user credentials, the server either allows or blocks client access to protected resources.

In practice, session id and session ticket are two mechanisms for short handshakes. Among them, session id is usually used in stand-alone mode, and if the same ticket is deployed in the entire network of the cluster, distribution can be achieved. session ticket.

As shown in FIG. 1 , which is a schematic diagram of an application scenario of session communication through session tickets, in which the cluster server 100 is connected to the client 300 and the management server 200 in communication respectively, and the management server 200 is configured to generate a session ticket and send The session ticket is sent to the cluster server 100 . In the embodiment shown in FIG. 1 , when the client 300 needs to access the data resources on the cluster server 100 , a secure communication session is first established between the client 300 and the cluster server 100 . Specifically, the above two stages are used to establish a secure communication session. The session is secured, and the server authenticates the client 300 through the session ticket provided by the client 300 to allow or prevent the client 300 from quickly accessing the requested resource.

In one possible implementation, the management server 200 may be Nginx, which is a high-performance HTTP and reverse proxy web server, wherein Nginx supports distributed session tickets, but does not support distributed sessions Identifies the session id. In actual operation, if the same session ticket is used all the time, there is a risk of being cracked, so it is necessary to update and replace the session ticket in the session communication.

Considering that the deployment method of the session ticket in the relevant distributed cluster will reduce the brief handshake rate of the entire cluster network, increase the consumption of the server CPU, and reduce the security of the cluster communication, a session ticket provided by the embodiment of the present application The processing method, device and electronic device are provided, and the technology can be applied to various scenarios where session tickets need to be updated. In order to facilitate the understanding of this embodiment, a method for processing a session ticket disclosed in the embodiment of this application is first introduced in detail.

Referring to FIG. 2, it is a schematic flowchart of a method for processing session tickets, wherein the method is applied to a server in a distributed cluster, the server is in communication connection with a preset management server, and the management server is configured to generate a session ticket, and send the session ticket to each server in the distributed cluster. As can be seen from Figure 2, the method includes the following steps:

Step S202: Receive a new session ticket sent by the management server.

For a server in a distributed cluster, it obtains a session ticket from the management server, which is set to encrypt and decrypt the communication session established between the cluster server and the client. Usually, when generating a session ticket, the management server sets the validity period corresponding to the session ticket, which is usually set to 300 seconds. During the validity period of the session ticket, the cluster server can quickly authenticate the identity of the client through the valid session ticket provided by the client. If the verification is passed, session communication is established, so as to realize a brief handshake and quickly establish a communication session. If the verification fails, for example, the session ticket has expired, the client cannot quickly establish a communication session with the cluster server, and needs to go through a complete handshake process to establish a communication session. During the complete handshake process, the client will re-obtain from the cluster server. Session ticket, and within the validity period of the newly obtained session ticket, a brief handshake can be implemented with the cluster server again.

In practice, in order to alleviate the risk of being cracked by cluster servers due to long-term use of the same session ticket, the session tickets of the entire cluster network are often updated within a certain period of time. Here, the update period is also called the security period of the session ticket, which can be one month, half a month, one week or other time periods, and the length of the security period can be flexibly adjusted according to the needs of the actual application scenario.

In one of the application scenarios, when the session ticket in the cluster server needs to be replaced, the management server generates a new session ticket, and simultaneously issues the original session ticket and the new session ticket to each server in the cluster. The cluster server receives the original session ticket and the new session ticket issued by the management server.

Step S204: Update the session configuration, determine the original session ticket in the session configuration as the primary key, and determine the new session ticket as the secondary key; wherein, the primary key and the secondary key are both set to be used for the communication session. decrypt, and preferably use the master key to decrypt the communication session, the master key is also set to encrypt the communication session created after the receipt of the new session ticket.

The above communication session may be a secure socket layer SSL session or a transport layer security TLS session. Here, both the SSL session and the TLS session are security protocols that provide security and data integrity for network communication, and TLS and SSL encrypt network connections between the transport layer and the application layer.

In this embodiment, the cluster server replaces the received session ticket with the existing session ticket in the server, that is, retains the original session ticket, and adds a new received session ticket after the original session ticket. Thus, there are two session tickets stored on the cluster server at the same time.

Here, the original session ticket in the session configuration is determined as the primary key, and the new session ticket is determined as the secondary key. When the cluster server establishes a communication session with the client, the master key is used to encrypt the communication session created after receiving the new session ticket. That is, if the session ticket needs to be sent to the client, the original session ticket is still sent. The newly created communication session is still encrypted with the original session ticket. Moreover, if the received client information needs to be decrypted in the communication session, the master key is preferentially used, and the original session credentials are still used for decryption at this time.

Step S206: If the confirmation message that the distributed cluster has completed updating the session configuration is received, the new session ticket is determined as the primary key, and the original session ticket is determined as the secondary key.

There are usually a large number of cluster servers in a distributed cluster. During the session ticket replacement, each cluster server receives a new session ticket from the management server, and the time for configuration update varies. After the cluster server completes the session configuration update , it will return the information that the update configuration is completed to the management server. Here, when the management server confirms that all servers in the cluster have completed the update of the session configuration, it notifies the servers in the cluster. When the server in the cluster receives confirmation information that the distributed cluster has completed updating the session configuration, it determines the new session ticket as the primary key and the original session ticket as the secondary key.

That is, for each cluster server, there are still two session tickets stored in the server at this time, but the two session tickets (that is, the keys) are rotated, and the new session ticket is determined as the master key, and Identify the original session ticket as the secondary key. After the key rotation, if a session ticket needs to be sent to the client, a new session ticket is sent to encrypt the communication session created later with the new session ticket, and if the received communication session needs to be When the client's information is decrypted, the new session ticket is used first for decryption. If the decryption fails, the original session ticket is used for decryption.

Step S208: when the preset time arrives, delete the original session ticket.

Since the newly created session is still encrypted with the original session ticket before the key rotation is performed, after the key rotation, these sessions encrypted with the original session ticket may not have ended. At this time, the original session ticket needs to be retained. This part of the session is decrypted to ensure that the client can achieve a brief handshake with the cluster server by virtue of the original session ticket during this period.

When all sessions encrypted with the old session ticket have ended, the old session ticket can be deleted. In this embodiment, the deletion of the original session ticket is triggered by setting a preset time. In at least one possible implementation, the preset time is not less than the validity period of the original session ticket. For example, if the validity period of the original session ticket is 300 seconds, the original session ticket will be deleted when the key is rotated for at least 300 seconds. There are no restrictions.

In this way, after deleting the original session ticket, only the new session ticket is kept on the cluster server, and only the communication session is encrypted and decrypted through the new session ticket, until the next round of session ticket replacement is triggered, and the above steps S202 to S208 are continued to be executed .

Compared with the traditional hard replacement method of directly replacing the original session ticket with a new session ticket, the processing method of the session ticket provided in this embodiment makes the session ticket exchange on the cluster server, for those not yet encrypted and decrypted through the original session ticket. The completed session can still achieve a short handshake normally, which effectively alleviates the problem of a sharp drop in the handshake rate of the entire network caused by the hard replacement of old and new session tickets.

In a session ticket processing method provided by an embodiment of the present application, a new session ticket sent by the management server is received; the session configuration is updated, the original session ticket in the session configuration is determined as the primary key, and the new session ticket is determined as the secondary key key; wherein, both the primary key and the secondary key are set to decrypt the communication session, and the primary key is preferentially used to decrypt the communication session, and the primary key is also set to decrypt the communication session when the new session is received. The communication session created after the ticket is encrypted; if the confirmation message that the distributed cluster has completed updating the session configuration is received, the new session ticket is determined as the primary key, and the original session ticket is determined as the secondary key; when the preset time When it arrives, delete the original session ticket. In this method, by deploying a unified session ticket in the entire distributed cluster network, when different requests from the same client are sent to different servers, a short handshake can be successfully implemented, thereby improving the short handshake rate; Not only a new session ticket is added to the clustered server, but the original session ticket is retained, so that the original session encrypted by the original session ticket can be decrypted, and the session encrypted by the new session ticket can also be decrypted until the session encrypted by the original session ticket can be decrypted. After the session is over, delete the original session ticket on the server, and only keep the new session ticket, which effectively alleviates the fact that during the session ticket replacement period, some sessions caused by the hard replacement of the session ticket cannot be successfully decrypted because the original session ticket is decrypted, making the entire network. The problem of the sudden drop in the short handshake rate can improve the short handshake rate of the entire network, save CPU consumption, and improve the security of cluster communication.

Based on the session ticket processing method shown in FIG. 2 , this embodiment further introduces the specific implementation process of the cluster server encrypting and decrypting the communication session through the original session ticket and the new session ticket during the session ticket replacement. Referring to FIG. 3, it is a schematic flowchart of another method for processing session tickets, wherein the method is applied to a server in a distributed cluster, and the server is in communication connection with a preset management server, and the management server is configured to generate session tickets. , and send the session ticket to each server in the distributed cluster. As can be seen from Figure 3, the method includes the following steps:

Step S302: Receive a communication connection request sent by the client, where the communication connection request carries a session ticket.

In this embodiment, the management server issues a unified session ticket for the entire network of the cluster. Therefore, the session ticket obtained by the client from one cluster server in the cluster can also be used for a brief handshake with another cluster server. .

Step S304: Determine whether the session ticket is within the validity period; if the session ticket is within the validity period, execute step S306, and if the session ticket is not within the validity period, execute step S316.

When the cluster server receives the communication connection request from the client, it determines whether the session ticket carried in the connection request is within the validity period, and if the session ticket is within the validity period, the session ticket is verified by the master key in the server. At this time, if it is before the key rotation, the master key is the original session ticket, that is, the session ticket is verified by the original session ticket to check whether it conforms to the session rules; The new session ticket is validated.

And, if the session ticket is not valid, a session ticket error notification is returned to the client.

Step S306: Verify the session ticket by using the master key.

That is, the session ticket is decrypted by the master key to verify whether it complies with the session rules.

Step S308: Determine whether the session ticket verification is passed through the master key; if the session ticket verification is passed through the master key, then step S314 is executed; if the session ticket verification fails through the master key, then Step S310 is executed.

If the session ticket is verified through the primary key, a communication session is established with the client to achieve a short handshake; if the session ticket verification through the primary key fails, the session ticket needs to be verified through the secondary key. authenticating.

Here, taking the communication connection request received after the key rotation and before the original session ticket is deleted as an example, at this time, the primary key is the new session ticket, and the secondary key is the original session ticket. If the session ticket carried in the communication connection request is a new session ticket, the verification of the session ticket through the master key will pass; and if the session ticket carried in the communication connection request is the original session ticket, the session ticket will be verified through the master key. The session ticket verification will not pass. In this case, the session ticket needs to be verified through the secondary key.

Step S310: Verify the session ticket through the secondary key.

That is, the session ticket is decrypted by the secondary key to verify whether it complies with the session rules.

Step S312: Determine whether the session ticket verification is passed by the secondary key; if the session ticket verification is passed by the secondary key, then step S314 is executed; if the session ticket verification is not passed by the secondary key, then Step S316 is executed.

If the session ticket is verified through the secondary key, a communication session is established with the client to achieve a short handshake; if the session ticket verification fails through the secondary key, a session ticket error notification is returned to the client. , the client needs to go through a full handshake to establish a communication session.

Step S314: Establish a communication session with the client.

After the cluster server and the client establish a communication session, the client can perform operations such as accessing data resources on the cluster server.

Step S316: Return a session ticket error notification to the client.

If the session ticket carried in the communication connection request has exceeded the validity period, or does not meet the session rules, a notification of session ticket error is returned to the client. At this time, the client needs to establish a communication session with the cluster server through a complete handshake.

In at least one possible implementation manner, a switch control may also be set on the cluster server to control the opening and closing of the session ticket mechanism. When the switch control is turned on, the processing method of the session ticket provided in the foregoing embodiment is executed. For example, the configuration of distributed session tickets in the Nginx service can be implemented by the following code:

ssl_session_tickets on;

ssl_session_ticket_key ticket.key.

Among them, ticket.key is also the session ticket, and its generation code is as follows:

openssl rand-out ticket.key 48.

In the session ticket processing method provided by this embodiment, during the session ticket replacement, the cluster server retains the original session ticket and the new session ticket at the same time, which can decrypt the session encrypted by the original session ticket or decrypt the session encrypted by the new session ticket. It can alleviate the problem of the short handshake rate of the entire network caused by the hard ticket replacement method in the related technology, which can improve the short handshake rate of the entire network, save CPU consumption, and improve the security of cluster communication.

Corresponding to the session ticket processing method shown in FIG. 2 , an embodiment of the present application further provides a session ticket processing apparatus, as shown in FIG. 4A , which is a schematic structural diagram of a session ticket processing apparatus, wherein, The device is applied to a server of a distributed cluster, the server is in communication connection with a preset management server, and the management server is configured to generate a session ticket and send the session ticket to each server of the distributed cluster.

As can be seen from FIG. 4A , the device includes a new session ticket receiving module 41, a session configuration update module 42, a primary and secondary key adjustment module 43 and an original session ticket deletion module 44 that are connected in sequence, wherein the functions of each module are as follows:

The new session ticket receiving module 41 is configured to receive the new session ticket sent by the management server;

The session configuration update module 42 is configured to update the session configuration, determine the original session ticket in the session configuration as the primary key, and determine the new session ticket as the secondary key; wherein, the primary key and the secondary key are both set In order to decrypt the communication session, and preferably use the master key to decrypt the communication session, the master key is also set to encrypt the communication session created after receiving the new session ticket;

The primary and secondary key adjustment module 43 is configured to determine the new session ticket as the primary key and the original session ticket as the secondary key if receiving confirmation information that the distributed cluster has completed updating the session configuration;

The original session ticket deletion module 44 is configured to delete the original session ticket when the preset time arrives.

A session ticket processing device provided by an embodiment of the present application receives a new session ticket sent by the management server; updates the session configuration, determines the original session ticket in the session configuration as the primary key, and determines the new session ticket as the secondary The primary key and the secondary key are both set to decrypt the communication session, and the primary key is preferentially used to decrypt the communication session, and the primary key is also set to decrypt the communication session when the new session is received. The communication session created after the ticket is encrypted; if the confirmation message that the distributed cluster has completed updating the session configuration is received, the new session ticket is determined as the primary key, and the original session ticket is determined as the secondary key; when the preset time When it arrives, delete the original session ticket. In this device, by deploying a unified session ticket in the entire distributed cluster network, during the session ticket replacement period, not only a new session ticket is added to the cluster server, but the original session ticket is also retained, so that the original session ticket can be decrypted through the original session. The session encrypted by the ticket can also decrypt the session encrypted with the new session ticket. After the session encrypted by the original session ticket ends, the original session ticket on the server is deleted, and only the new session ticket is retained, which effectively alleviates the period of session ticket replacement. , because some sessions caused by hard-replaced session tickets cannot be successfully decrypted due to the need to decrypt the original session tickets, causing the short handshake rate of the entire network to plummet, which can improve the short handshake rate of the entire network, save CPU consumption, and improve the security of cluster communication .

In one possible implementation manner, the above communication session is one of a secure socket layer SSL session and a transport layer security TLS session.

In another possible implementation manner, the above-mentioned preset time is not less than the validity period of the original session ticket.

In another possible implementation manner, as can be seen from FIG. 4B , the above-mentioned apparatus further includes a session ticket mechanism enabling module 45 , which is set as a preset switch control for enabling the session ticket mechanism.

In another possible implementation, it can be seen from FIG. 4B that the above-mentioned apparatus further includes a communication connection request receiving module 46, which is configured to receive a communication connection request sent by the client, and the communication connection request carries a session ticket; the judgment and verification module 47, set to judge whether the session ticket is within the validity period; if it is judged that the session ticket is within the validity period, verify the session ticket through the master key; The client establishes a communication session.

In another possible implementation, the above judgment and verification module is further set to: if the session ticket is not verified by the primary key, the session ticket is verified by the secondary key; If the session ticket is verified, a communication session is established with the client.

The implementation principle and the resulting technical effects of the session ticket processing apparatus provided by the embodiments of the present application are the same as the foregoing embodiments of the session ticket processing method. Reference may be made to the corresponding content in the foregoing embodiments of the method for processing session tickets.

An embodiment of the present application also provides an electronic device, as shown in FIG. 5 , which is a schematic structural diagram of the electronic device, wherein the electronic device includes a processor 51 and a memory 52 , and the memory 52 stores data that can be used by the processor 51 Executed computer-executable instructions, the processor 51 executes the computer-executable instructions to implement the above session ticket processing method.

In the embodiment shown in FIG. 5 , the electronic device further includes a bus 53 and a communication interface 54 , wherein the processor 51 , the communication interface 54 and the memory 52 are connected through the bus.

The memory 52 may include a high-speed random access memory (RAM, Random Access Memory), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory. The communication connection between the network element of the system and at least one other network element is realized through at least one communication interface 54 (which may be wired or wireless), which may use the Internet, a wide area network, a local network, a metropolitan area network, and the like. The bus can be an ISA bus, a PCI bus, an EISA bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one bidirectional arrow is shown in FIG. 5, but it does not mean that there is only one bus or one type of bus.

The processor 51 may be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above-mentioned method can be completed by a hardware integrated logic circuit in the processor 51 or an instruction in the form of software. The above-mentioned processor 51 can be a general-purpose processor, including a central processing unit (Central Processing Unit, referred to as CPU), a network processor (Network Processor, referred to as NP), etc.; it can also be a digital signal processor (Digital Signal Processing, referred to as DSP) ), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art. The storage medium is located in the memory, and the processor 51 reads the information in the memory 52, and completes the steps of the session ticket processing method in the foregoing embodiment in combination with its hardware.

Embodiments of the present application further provide a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when the computer-executable instructions are invoked and executed by a processor, the computer-executable instructions cause the processor to For the implementation of the above-mentioned method for processing session tickets, reference may be made to the foregoing method embodiments for specific implementation, and details are not described herein again.

The session ticket processing method, session ticket processing apparatus, and computer program product of an electronic device provided by the embodiments of the present application include a computer-readable storage medium storing program codes, and the instructions included in the program codes can be configured to execute the preceding steps. For the method for processing a session ticket described in the method embodiment, the specific implementation can refer to the method embodiment, which will not be repeated here.

The functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a processor-executable non-volatile computer-readable storage medium. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the related technology or the part of the technical solution. The computer software product is stored in a storage medium, including several The instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

The embodiments of the present application bring the following beneficial effects: the method, device, electronic device and computer-readable storage medium for processing session tickets provided by the embodiments of the present application receive a new session ticket sent by the management server; update the session configuration, Determine the original session ticket in the session configuration as the primary key, and determine the new session ticket as the secondary key; where both the primary key and the secondary key are set to decrypt the communication session, and the primary key is used preferentially. The key decrypts the communication session, and the master key is also set to encrypt the communication session created after receiving the new session ticket; if receiving confirmation that the distributed cluster has completed updating the session configuration, the new session The ticket is determined as the primary key, and the original session ticket is determined as the secondary key; when the preset time arrives, the original session ticket is deleted. In this method, by deploying a unified session ticket in the entire network of the distributed cluster, during the session ticket replacement, not only a new session ticket is added to the cluster server, but the original session ticket is also retained, so that the original session can be decrypted. The session encrypted by the ticket can also decrypt the session encrypted with the new session ticket. After the session encrypted by the original session ticket ends, the original session ticket on the server is deleted, and only the new session ticket is retained, which effectively alleviates the period of session ticket replacement. , because some sessions caused by hard-replaced session tickets cannot be successfully decrypted due to the need to decrypt the original session tickets, causing the short handshake rate of the entire network to plummet, which can improve the short handshake rate of the entire network, save CPU consumption, and improve the security of cluster communication .

In addition, in the description of the embodiments of the present application, unless otherwise expressly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it may be a fixed connection or a detachable connection , or integrally connected; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or the internal communication between the two components. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood in specific situations.

In the description of this application, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc. The indicated orientation or positional relationship is based on the orientation or positional relationship shown in the accompanying drawings, which is only for the convenience of describing the present application and simplifying the description, rather than indicating or implying that the indicated device or element must have a specific orientation or a specific orientation. construction and operation, and therefore should not be construed as limitations on this application. Furthermore, the terms "first", "second", and "third" are used for descriptive purposes only and should not be construed to indicate or imply relative importance.

Finally, it should be noted that the above-mentioned embodiments are only specific implementations of the present application, and are used to illustrate the technical solutions of the present application, rather than limit them. The embodiments describe the application in detail, and those of ordinary skill in the art should understand that any person skilled in the art can still modify the technical solutions described in the foregoing embodiments within the technical scope disclosed in the application. Or can easily think of changes, or equivalently replace some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions in the embodiments of the application, and should be covered in this application. within the scope of protection. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Industrial Applicability

The present application is applied to the field of communication technology, and provides a session ticket processing method, device, electronic device and computer-readable storage medium, which can improve the short handshake rate of the entire distributed cluster network, reduce CPU consumption, and improve the efficiency of cluster communication. safety.

Claims

A session ticket processing method is applied to a server of a distributed cluster, the server is in communication connection with a preset management server, and the management server is configured to generate a session ticket and send the session ticket to the distributed cluster. Each server of the cluster, the method includes:

receiving a new session ticket sent by the management server;

The session configuration is updated, the original session ticket in the session configuration is determined as the primary key, and the new session ticket is determined as the secondary key, wherein the primary key and the secondary key are both set to perform a communication session on the communication session. decrypting, and preferably using the master key to decrypt the communication session, the master key is also set to encrypt the communication session created after receiving the new session ticket;

If receiving confirmation that the distributed cluster has completed updating the session configuration, determining the new session ticket as the primary key, and determining the original session ticket as the secondary key; and

When the preset time arrives, the original session ticket is deleted.
The method for processing session tickets according to claim 1, wherein the communication session is one of a secure socket layer SSL session and a transport layer security TLS session.
The method for processing a session ticket according to claim 1 or 2, wherein the preset time is not less than the validity period of the original session ticket.
The method for processing session tickets according to any one of claims 1 to 3, wherein, before the step of receiving a new session ticket sent by the management server, the method further comprises:

The preset switch control to enable the session ticket mechanism.
The method for processing session tickets according to any one of claims 1 to 4, wherein the server is communicatively connected to a preset client, and the method further comprises:

receiving a communication connection request sent by the client, where the communication connection request carries a session ticket;

Determine whether the session ticket is within the validity period;

If it is determined that the session ticket is within the validity period, verifying the session ticket with the master key; and

If the session ticket is verified through the master key, a communication session is established with the client.
The method for processing session tickets according to claim 5, wherein the method further comprises:

If verification of the session ticket by the primary key fails, verifying the session ticket by the secondary key; and

If the session ticket is verified through the secondary key, a communication session is established with the client.
A session ticket processing device is applied to a server of a distributed cluster, the server is in communication connection with a preset management server, and the management server is configured to generate a session ticket and send the session ticket to the distributed cluster. Each server of the cluster, the device includes:

a new session ticket receiving module, configured to receive the new session ticket sent by the management server;

A session configuration update module, configured to update the session configuration, determines the original session ticket in the session configuration as the primary key, and determines the new session ticket as the secondary key, wherein the primary key and the secondary key are set to decrypt the communication session, and preferably use the master key to decrypt the communication session, and the master key is also set to encrypt the communication session created after receiving the new session ticket;

a primary and secondary key adjustment module, configured to determine the new session ticket as the primary key and the original session ticket as the secondary key if receiving confirmation that the distributed cluster has completed updating the session configuration; and

The original session ticket deletion module is configured to delete the original session ticket when the preset time arrives.
The apparatus for processing session tickets according to claim 7, wherein the communication session is one of a secure socket layer SSL session and a transport layer security TLS session.
The apparatus for processing session tickets according to claim 7 or 8, wherein,

The device further includes a session ticket mechanism opening module, which is set as a preset switch control for opening the session ticket mechanism.
The apparatus for processing session tickets according to any one of claims 7 to 9, wherein,

The server is communicatively connected to a preset client, and the device further includes:

a communication connection request receiving module, configured to receive a communication connection request sent by the client, where the communication connection request carries a session ticket; and

The judgment and verification module is set to judge whether the session ticket is within the validity period, and if it is judged that the session ticket is within the validity period, the session ticket is verified by the master key, and if the session ticket is validated by the master key The session ticket verification is passed, and a communication session is established with the client.
The apparatus for processing session tickets according to claim 10, wherein,

The judgment and verification module is further configured to verify the session ticket by the secondary key if the session ticket is not verified by the primary key, and if the session ticket is verified by the secondary key If the verification is passed, a communication session is established with the client.
An electronic device comprising a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement claims 1 to 6. The processing method of the session ticket according to any one of the items.
A computer-readable storage medium storing computer-executable instructions that, when invoked and executed by a processor, cause the processor to implement claims 1 to 6 The processing method of any one of the session tickets.