WO2022127294A1 - 一种集群特征码获得方法、装置及电子设备 - Google Patents

一种集群特征码获得方法、装置及电子设备 Download PDF

Info

Publication number
WO2022127294A1
WO2022127294A1 PCT/CN2021/121891 CN2021121891W WO2022127294A1 WO 2022127294 A1 WO2022127294 A1 WO 2022127294A1 CN 2021121891 W CN2021121891 W CN 2021121891W WO 2022127294 A1 WO2022127294 A1 WO 2022127294A1
Authority
WO
WIPO (PCT)
Prior art keywords
cluster
feature code
key
node
nodes
Prior art date
Application number
PCT/CN2021/121891
Other languages
English (en)
French (fr)
Inventor
刘硕
Original Assignee
苏州浪潮智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州浪潮智能科技有限公司 filed Critical 苏州浪潮智能科技有限公司
Priority to US18/023,160 priority Critical patent/US11784802B1/en
Publication of WO2022127294A1 publication Critical patent/WO2022127294A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
    • H04L9/0836—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key using tree structure or hierarchical structure
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/60—Digital content management, e.g. content distribution
    • H04L2209/603—Digital right managament [DRM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • the present application relates to the technical field of computer systems, and in particular, to a method, an apparatus, and an electronic device for obtaining a cluster feature code.
  • the current solution is to calculate the characteristic code of a cluster according to the characteristic code of each machine in the cluster.
  • the problem with this method is that there will always be storage expansion, configuration changes, fault replacements, etc. of physical nodes in large-scale clusters.
  • the feature code of a node changes, it will lead to the change of the entire cluster feature code, which will lead to the invalidation of software product authorization.
  • the other is that the control node summarizes the feature code of the computing node and generates a secondary feature code, which can solve the first problem and reduce the scope of influence. How to divide the nodes into a certain control node? If the algorithm is not used, it is necessary to manually plan the attribution relationship between the computing node and the control node. Secondly, if the modulo algorithm is used, manual planning of the attribution relationship can be avoided, but when the number of control nodes is changed, it will be A huge change in the system's secondary signature will still cause the system to be unusable on a large scale.
  • the present application proposes a large-scale cluster software validity management method based on consistent hashing, which reduces the scope of influence on the entire system when system nodes are changed.
  • the purpose of the present application is to provide a method, device and electronic device for obtaining a cluster feature code, which reduces the scope of influence on the entire system when system nodes are changed, and improves the reliability and availability of the system.
  • a method for obtaining a cluster feature code includes:
  • the secondary public key is used to obtain the cluster characteristic code.
  • steps of determining multiple key nodes from all nodes in the cluster include:
  • steps of calculating the hash value of each node in the cluster and forming a hash ring include:
  • steps of determining multiple key nodes from all nodes in the cluster include:
  • step of calculating the check code according to the feature code ciphertext of each key node includes:
  • the feature code ciphertext of each key node and the node capacity of each key node are combined to form a combined ciphertext
  • the check code of the combined ciphertext is calculated using a digest algorithm.
  • digest algorithm is the SM3 algorithm.
  • a new key node when added to the cluster, it also includes:
  • the present application also provides an apparatus for obtaining a cluster feature code, including:
  • a key node module for determining multiple key nodes from all nodes in the cluster
  • the first-level computing module is used to obtain the feature code plaintext of each key node; according to the feature code plaintext of each key node, the first-level public key is used to obtain the feature code ciphertext of each key node;
  • the second-level computing module is used to calculate the check code according to the feature code ciphertext of each key node; according to the check code, the second-level public key is used to obtain the cluster feature code.
  • the present application further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and the processor implements a cluster feature when executing the computer program The steps of the code acquisition method.
  • the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores machine-executable instructions, and when the computer-executable instructions are invoked and executed by a processor, the computer can run The instructions cause the processor to execute a cluster signature obtaining method.
  • the present application provides a method, device and electronic device for obtaining a cluster feature code.
  • the key nodes and other nodes and their feature codes are managed according to a consistent hash algorithm.
  • organization using the double-layer feature code calculation method, realizes the service reliability and availability improvement of the cloud computing system based on openstack, thereby reducing the scope of influence on the entire system when the system node is changed.
  • the electronic device and the computer-readable storage medium provided by the embodiments of the present application also have the above technical effects.
  • FIG. 1 is a flowchart of a method for obtaining a cluster feature code provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of node processing in a cluster provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of a key node feature code processing principle provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of an electronic device provided by an embodiment of the present application.
  • 800 electronic equipment 801 memory, 802 processor, 803 bus, 804 communication interface.
  • an embodiment of the present application provides a method for obtaining a cluster feature code, including:
  • the secondary public key is used to obtain the cluster characteristic code.
  • This application divides the nodes in the cluster into key nodes and ordinary nodes, manages and organizes the key nodes and other nodes and their feature codes according to the consistent hash algorithm, and uses the double-layer feature code calculation method to realize the openstack based feature code calculation method.
  • the service reliability and availability of the cloud computing system are improved, thereby reducing the impact on the entire system when the system nodes are changed.
  • the step of determining multiple key nodes from all nodes in the cluster includes:
  • the steps of calculating the hash value of each node in the cluster and forming a hash ring include:
  • the step of determining multiple key nodes from all nodes in the cluster includes:
  • the step of calculating the check code according to the feature code ciphertext of each key node includes:
  • the feature code ciphertext of each key node and the node capacity of each key node are combined to form a combined ciphertext
  • the digest algorithm is the SM3 algorithm.
  • the method when a new key node is added to the cluster, the method further includes:
  • the embodiment of the present application also provides a cluster feature code obtaining device, including:
  • a key node module for determining multiple key nodes from all nodes in the cluster
  • the first-level computing module is used to obtain the feature code plaintext of each key node; according to the feature code plaintext of each key node, the first-level public key is used to obtain the feature code ciphertext of each key node;
  • the second-level computing module is used to calculate the check code according to the feature code ciphertext of each key node; according to the check code, the second-level public key is used to obtain the cluster feature code.
  • An embodiment of the present application further provides an electronic device, including a memory and a processor, where a computer program that can be run on the processor is stored in the memory, and the processor implements the steps of the method for obtaining a cluster feature code when the computer program is executed.
  • Embodiments of the present application further provide a computer-readable storage medium, where the computer-readable storage medium stores machine-executable instructions, and when the computer-executable instructions are invoked and run by the processor, the computer-executable instructions cause the processor to run the cluster feature How to get the code.
  • the nodes in the cluster are divided into key nodes and common nodes, and the key nodes and other nodes and their feature codes are managed and organized according to the consistent hash algorithm.
  • the nodes in the cluster are divided into key nodes and ordinary nodes.
  • the cluster When the cluster is deployed, according to certain rules (it can be the IP address, MAC address, etc. of the node), take the modulo of 2 ⁇ 32, and set the The node falls on the virtual hash ring, and then automatically calculates the required number of key nodes according to the size of the node and selects the key nodes on the hash ring on an average.
  • the nodes that affect the business plane are regarded as key nodes (for example, the control nodes in the Openstack system).
  • the key nodes and common nodes When adding key nodes to the cluster, if the common modulo algorithm is used, then the key nodes and common nodes will be recalculated and attributed.
  • the above design makes it unnecessary to re-calculate the modulo, and the original nodes do not need to be adjusted.
  • the method for calculating the double-layer feature code is specifically as follows:
  • the feature code of the key node (which can be the node's IP address, MAC address, disk serial number, etc.) is organized into a certain format, the first-level public key is used, and the encrypted data is obtained through the asymmetric SM2 algorithm. , a number of encrypted key node feature codes and node capacity are combined, and the check code is calculated through the SM3 digest algorithm. Then, after combining the data, the final feature code is obtained through the secondary key and asymmetric encryption algorithm again.
  • Double-layer feature code calculation method When configuration changes and fault replacements are required in the cluster, as long as the key nodes are not changed, the cluster software authorization will not be invalidated.
  • the double-layer feature code uses double public keys to encrypt information. When the corresponding server is verified, it also uses double private keys for decryption, and the security is further guaranteed.
  • OpenStack is an open source cloud computing management platform project, which is a combination of a series of software open source projects. OpenStack provides scalable and elastic cloud computing services for private clouds and public clouds. The project goal is to provide a cloud computing management platform that is simple to implement, scalable, rich, and standardized.
  • the machine code refers to a series of serial numbers formed by encrypting and hashing the hardware serial number.
  • the feature codes obtained by different software are different, but the general principle is similar. They are a set of strings obtained by reading the serial numbers of accessories such as motherboards and hard disks, and then performing encryption operations in a certain way. Because of the differences in the encryption operation methods of different software, there must be certain differences in the characteristic codes obtained by them.
  • the electronic device 800 includes a memory 801 and a processor 802, and the memory stores a computer program that can run on the processor, and the processor implements the above when executing the computer program.
  • the electronic device further includes: a bus 803 and a communication interface 804, the processor 802, the communication interface 804 and the memory 801 are connected through the bus 803; the processor 802 is used to execute executable modules stored in the memory 801, such as a computer program.
  • the memory 801 may include a high-speed random access memory (Random Access Memory, RAM for short), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.
  • RAM Random Access Memory
  • non-volatile memory such as at least one disk memory.
  • the communication connection between the network element of the system and at least one other network element is implemented through at least one communication interface 804 (which may be wired or wireless), which may use the Internet, a wide area network, a local network, a metropolitan area network, and the like.
  • the bus 803 may be an ISA bus, a PCI bus, an EISA bus, or the like.
  • the bus can be divided into address bus, data bus, control bus and so on. For ease of presentation, only one bidirectional arrow is used in FIG. 4, but it does not mean that there is only one bus or one type of bus.
  • the memory 801 is used to store the program, and the processor 802 executes the program after receiving the execution instruction.
  • the method executed by the apparatus defined by the process disclosed in any of the foregoing embodiments of the present application may be applied to the processor 802, or processed by the processor 802. 802 is implemented.
  • the processor 802 may be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above-mentioned method can be completed by an integrated logic circuit of hardware in the processor 802 or an instruction in the form of software.
  • the above-mentioned processor 802 may be a general-purpose processor, including a central processing unit (Central Processing Unit, referred to as CPU), a network processor (Network Processor, referred to as NP), etc.; may also be a digital signal processor (Digital Signal Processing, referred to as DSP) ), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.
  • CPU Central Processing Unit
  • NP Network Processor
  • DSP Digital Signal Processing
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory 801, and the processor 802 reads the information in the memory 801, and completes the steps of the above method in combination with its hardware.
  • embodiments of the present application also provide a computer-readable storage medium, where the computer-readable storage medium stores machine-executable instructions, and when the computer-executable instructions are invoked and run by a processor, the computer-executable instructions cause the The processor executes the steps of the above-described method.
  • the apparatus provided in this embodiment of the present application may be specific hardware on the device or software or firmware installed on the device, or the like.
  • the implementation principles and technical effects of the devices provided in the embodiments of the present application are the same as those in the foregoing method embodiments.
  • the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the above method embodiments, which will not be repeated here.
  • each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executables for implementing the specified logical function(s) instruction. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures.
  • each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations can be implemented in dedicated hardware-based systems that perform the specified functions or actions , or can be implemented in a combination of dedicated hardware and computer instructions.
  • the division of units is only for one logical function division. In actual implementation, there may be other division methods. For another example, multiple units or components may be combined or integrated into another system, or some features may be ignored, or Do not execute.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces, indirect coupling or communication connection of devices or units, which may be in electrical, mechanical or other forms.
  • Units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in the embodiments provided in this application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM for short), Random Access Memory (RAM for short), magnetic disk or CD, etc. that can store program codes medium.

Abstract

本申请提供了一种集群特征码获得方法、装置及电子设备，属于计算机系统的技术领域，解决了现有系统当控制节点数量变更后，会引起系统二级特征码的巨大变更，会导致系统大范围不可用。该方法包括从集群中的所有节点中确定多个关键节点，计算每个节点的哈希值，并形成哈希环；根据集群中的节点规模确定关键节点的数目；依数目在哈希环上平均选取多个关键节点；获取每个关键节点的特征码明文；根据每个关键节点的特征码明文，利用一级公钥分别获得每个关键节点的特征码密文；根据每个关键节点的特征码密文计算校验码；根据校验码，利用二级公钥获得集群特征码。本申请降低了系统节点变更时对整个系统的影响范围。

Description

一种集群特征码获得方法、装置及电子设备
本申请要求在2020年12月14日提交中国专利局、申请号为202011475084.6、发明名称为“一种集群特征码获得方法、装置及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机系统技术领域，尤其是涉及一种集群特征码获得方法、装置及电子设备。
背景技术
在openstack系统中，经常进行大规模的部署，在大规模部署时，会将软件部署在数千台物理机节点上，软件需要通过特征码，生成唯一可以使用的授权许可，仅能用于某集群，而不能用于其他集群，来保证软件不被非法的拷贝和滥用。
现行的方案是，根据集群中每台机器的特征码，计算一个集群的特征码，这种方法的问题是，大规模集群总会有物理节点出现存储扩容，配置变更，故障更换等情况，这时某节点的特征码变更，就会导致整个集群特征码的变更，进而导致软件产品授权失效。另一种是，控制节点汇总计算节点的特征码，并生成一个二级特征码，这样能解决问题一，将影响范围缩小，但这种情况存在的问题是，首先控制节点存在多个，计算节点如何划分到某个控制节点下，如果不使用算法，需要人工规划计算节点-控制节点的归属关系，其次如果使用取模算法，可以避免人工规划归属关系，但当控制节点数量变更后，会引起系统二级特征码的巨大变更，仍会导致系统大范围不可用。
基于上述问题，本申请提出了一种基于一致性哈希的大规模集群软件有效性管理方法，降低了系统节点变更时对整个系统的影响范围。
发明内容
本申请的目的在于提供一种集群特征码获得方法、装置及电子设备，降低了系统节点变更时对整个系统的影响范围，提高了系统的可靠性，可用性。
第一方面，本申请提供的一种集群特征码获得方法，包括：
从集群中的所有节点中确定多个关键节点；
获取每个关键节点的特征码明文；
根据每个关键节点的特征码明文，利用一级公钥分别获得每个关键节点的特征码密文；
根据每个关键节点的特征码密文计算校验码；
根据校验码，利用二级公钥获得集群特征码。
进一步的，从集群中的所有节点中确定多个关键节点的步骤，包括：
计算集群中的每个节点的哈希值，并形成哈希环；
根据集群中的节点规模确定关键节点的数目；
依所述数目在所述哈希环上平均选取多个关键节点。
进一步的，计算集群中的每个节点的哈希值，并形成哈希环的步骤，包括：
将集群中的每个节点的IP地址或MAC地址，进行对2 32取模运算，获得每个节点的哈希值；
将集群中的每个节点的哈希值组合形成哈希环。
进一步的，从集群中的所有节点中确定多个关键节点的步骤，包括：
根据用户输入的指定命令从集群中确定多个关键节点。
进一步的，根据每个关键节点的特征码密文计算校验码的步骤，包括：
每个关键节点的特征码密文，以及每个关键节点的节点容量进行组合，形成组合密文；
利用摘要算法计算所述组合密文的校验码。
进一步的，所述摘要算法为SM3算法。
进一步的，当集群中新增关键节点时，还包括：
获取新增关键节点的特征码明文；
根据新增关键节点的特征码明文，利用一级公钥获得新增关键节点的特征码密文；
返回所述根据每个关键节点的特征码密文计算校验码的步骤。
第二方面，本申请还提供一种集群特征码获得装置，包括：
关键节点模块，用于从集群中的所有节点中确定多个关键节点；
一级计算模块，用于获取每个关键节点的特征码明文；根据每个关键节点的特征码明文，利用一级公钥分别获得每个关键节点的特征码密文；
二级计算模块，用于根据每个关键节点的特征码密文计算校验码；根据校验码，利用二级公钥获得集群特征码。
第三方面，本申请还提供一种电子设备，包括存储器、处理器，所述存储器中存储有可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现集群特征码获得方法的步骤。
第四方面，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质存储有机器可运行指令，所述计算机可运行指令在被处理器调用和运行时，所述计算机可运行指令促使所述处理器运行集群特征码获得方法。
本申请提供的一种集群特征码获得方法、装置及电子设备，通过将集群中的节点，分为关键节点和普通节点，按照一致性哈希算法对关键节点和其他节点及其特征码进行管理和组织，使用双层特征码计算方法，实现 了基于openstack的云计算系统的服务可靠性、可用性提升，从而降低了系统节点变更时对整个系统的影响范围。
相应地，本申请实施例提供的一种电子设备及计算机可读存储介质，也同样具有上述技术效果。
附图说明
为了更清楚地说明本申请具体实施方式或现有技术中的技术方案，下面将对具体实施方式或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施方式，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的集群特征码获得方法流程图；
图2为本申请实施例提供的集群中节点处理原理图；
图3为本申请实施例提供的关键节点特征码处理原理图；
图4为本申请实施例提供的电子设备的原理图。
图中：800电子设备、801存储器、802处理器、803总线、804通信接口。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请实施例中所提到的术语“包括”和“具有”以及它们的任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还 包括其他没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
请参阅附图1至4，本申请实施例提供了一种集群特征码获得方法，包括：
从集群中的所有节点中确定多个关键节点；
获取每个关键节点的特征码明文；
根据每个关键节点的特征码明文，利用一级公钥分别获得每个关键节点的特征码密文；
根据每个关键节点的特征码密文计算校验码；
根据校验码，利用二级公钥获得集群特征码。
本申请通过将集群中的节点，分为关键节点和普通节点，按照一致性哈希算法对关键节点和其他节点及其特征码进行管理和组织，使用双层特征码计算方法，实现了基于openstack的云计算系统的服务可靠性、可用性提升，从而降低了系统节点变更时对整个系统的影响范围。
本申请实施例中，从集群中的所有节点中确定多个关键节点的步骤，包括：
计算集群中的每个节点的哈希值，并形成哈希环；
根据集群中的节点规模确定关键节点的数目；
依数目在哈希环上平均选取多个关键节点。
本申请实施例中，计算集群中的每个节点的哈希值，并形成哈希环的步骤，包括：
将集群中的每个节点的IP地址或MAC地址，进行对2 32取模运算，获得每个节点的哈希值；
将集群中的每个节点的哈希值组合形成哈希环。
本申请实施例中，从集群中的所有节点中确定多个关键节点的步骤，包括：
根据用户输入的指定命令从集群中确定多个关键节点。
本申请实施例中，根据每个关键节点的特征码密文计算校验码的步骤，包括：
每个关键节点的特征码密文，以及每个关键节点的节点容量进行组合，形成组合密文；
利用摘要算法计算组合密文的校验码。
本申请实施例中，摘要算法为SM3算法。
本申请实施例中，当集群中新增关键节点时，还包括：
获取新增关键节点的特征码明文；
根据新增关键节点的特征码明文，利用一级公钥获得新增关键节点的特征码密文；
返回根据每个关键节点的特征码密文计算校验码的步骤。
本申请实施例还提供了一种集群特征码获得装置，包括：
关键节点模块，用于从集群中的所有节点中确定多个关键节点；
一级计算模块，用于获取每个关键节点的特征码明文；根据每个关键节点的特征码明文，利用一级公钥分别获得每个关键节点的特征码密文；
二级计算模块，用于根据每个关键节点的特征码密文计算校验码；根据校验码，利用二级公钥获得集群特征码。
本申请实施例还提供了一种电子设备，包括存储器、处理器，存储器中存储有可在处理器上运行的计算机程序，处理器执行计算机程序时实现集群特征码获得方法的步骤。
本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质存储有机器可运行指令，计算机可运行指令在被处理器调用和运行时，计算机可运行指令促使处理器运行集群特征码获得方法。
本申请实施例中，将集群中的节点，分为关键节点和普通节点，按照一致性哈希算法对关键节点和其他节点及其特征码进行管理和组织。
如附图2所示，将集群中的节点，分为关键节点和普通节点，当集群部署时，按照一定规则(可以是节点的IP地址，MAC地址等)，对2^32取模，将节点落到虚拟哈希环上，然后自动根据节点规模计算所需关键节点个数并平均的选择关键节点到哈希环上，也可以人工指定关键节点，将硬件不经常变更、或变更后不影响业务面的节点作为关键节点(例如Openstack系统中的控制节点)。
当向集群中添加关键节点时，如果使用普通取模算法，那么关键节点，普通节点的都会重新计算和归属，而上述设计，使得不必重新取模进行运算，原有节点不需要调整，仅需要在原有基础上，重新加入新扩容关键节点的特征码，计算特征码后加密即可，在扩容完成，获取序列号之前，原有节点均可自由使用。
当集群中关键节点故障时，所属的普通节点，沿顺时针方向归属于下一个关键节点。
本申请实施例中，使用双层特征码计算方法具体如下：
如附图3所示，将关键节点的特征码(可以是节点的IP地址，MAC地址，磁盘序列号等)组织成一定格式，使用一级公钥，通过非对称SM2算法，获得加密后数据，多个加密后关键节点特征码与节点容量组合，通过SM3摘要算法计算校验码。然后组合后数据，再次通过二级密钥，非对称加密算法得到最终的特征码。
双层特征码计算方法当集群中需要进行配置变更，故障更换等情况时，只要不变更关键节点，就不会导致集群软件授权的失效。
双层特征码使用了双公钥加密信息，对应服务端验证时，也使用双私钥解密，安全性进一步被保证。
本申请中，OpenStack是一个开源的云计算管理平台项目，是一系列软件开源项目的组合，OpenStack为私有云和公有云提供可扩展的弹性的云计 算服务。项目目标是提供实施简单、可大规模扩展、丰富、标准统一的云计算管理平台。
特征码：机器码指的是将硬件序列号经过一系列加密、散列形成的一串序列号。不同的软件获得的特征码都是不一样的，但大致的原理差不多，都是读取主板、硬盘等配件的序列号，然后通过一定的方式进行加密运算得到的一组字符串。正因为不同软件的加密运算方法存在差异，所以它们获得的特征码必然存在一定差异。
本申请实施例提供的一种电子设备，如图4所示，电子设备800包括存储器801、处理器802，存储器中存储有可在处理器上运行的计算机程序，处理器执行计算机程序时实现上述实施例提供的方法的步骤。
如图4所示，电子设备还包括：总线803和通信接口804，处理器802、通信接口804和存储器801通过总线803连接；处理器802用于执行存储器801中存储的可执行模块，例如计算机程序。
其中，存储器801可能包含高速随机存取存储器(Random Access Memory，简称RAM)，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。通过至少一个通信接口804(可以是有线或者无线)实现该系统网元与至少一个其他网元之间的通信连接，可以使用互联网，广域网，本地网，城域网等。
总线803可以是ISA总线、PCI总线或EISA总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图4中仅用一个双向箭头表示，但并不表示仅有一根总线或一种类型的总线。
其中，存储器801用于存储程序，处理器802在接收到执行指令后，执行程序，前述本申请任一实施例揭示的过程定义的装置所执行的方法可以应用于处理器802中，或者由处理器802实现。
处理器802可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器802中的硬件的集成逻辑电路 或者软件形式的指令完成。上述的处理器802可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(Digital Signal Processing，简称DSP)、专用集成电路(Application Specific Integrated Circuit，简称ASIC)、现成可编程门阵列(Field-Programmable Gate Array，简称FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器801，处理器802读取存储器801中的信息，结合其硬件完成上述方法的步骤。
对应于上述方法，本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质存储有机器可运行指令，计算机可运行指令在被处理器调用和运行时，计算机可运行指令促使处理器运行上述方法的步骤。
本申请实施例所提供的装置可以为设备上的特定硬件或者安装于设备上的软件或固件等。本申请实施例所提供的装置，其实现原理及产生的技术效果和前述方法实施例相同，为简要描述，装置实施例部分未提及之处，可参考前述方法实施例中相应内容。所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，前述描述的系统、装置和单元的具体工作过程，均可以参考上述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，也可以通过其它的方式实现。以上所描述的装置实施例仅仅是示意性的，例如，附图中的流程图和框图显示了根据本申请的多个实施例的装置、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流 程图或框图中的每个方框可以代表一个模块、程序段或代码的一部分，模块、程序段或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现方式中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个连续的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或动作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
又例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，再例如，多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些通信接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请提供的实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。而 前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，简称ROM)、随机存取存储器(Random Access Memory，简称RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步定义和解释，此外，术语“第一”、“第二”、“第三”等仅用于区分描述，而不能理解为指示或暗示相对重要性。
在本申请的描述中，还需要说明的是，除非另有明确的规定和限定，术语“设置”、“安装”、“相连”、“连接”应做广义理解，例如，可以是固定连接，也可以是可拆卸连接，或一体地连接；可以是机械连接，也可以是电连接；可以是直接相连，也可以通过中间媒介间接相连，可以是两个元件内部的连通。对于本领域的普通技术人员而言，可以具体情况理解上述术语在本申请中的具体含义。
最后应说明的是：以上所述实施例，仅为本申请的具体实施方式，用以说明本申请的技术方案，而非对其限制，本申请的保护范围并不局限于此，尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，其依然可以对前述实施例所记载的技术方案进行修改或可轻易想到变化，或者对其中部分技术特征进行等同替换；而这些修改、变化或者替换，并不使相应技术方案的本质脱离本申请实施例技术方案的范围。都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (10)

  1. 一种集群特征码获得方法，其特征在于，包括：
    从集群中的所有节点中确定多个关键节点；
    获取每个关键节点的特征码明文；
    根据每个关键节点的特征码明文，利用一级公钥分别获得每个关键节点的特征码密文；
    根据每个关键节点的特征码密文计算校验码；
    根据校验码，利用二级公钥获得集群特征码。
  2. 根据权利要求1所述的集群特征码获得方法，其特征在于，从集群中的所有节点中确定多个关键节点的步骤，包括：
    计算集群中的每个节点的哈希值，并形成哈希环；
    根据集群中的节点规模确定关键节点的数目；
    依所述数目在所述哈希环上平均选取多个关键节点。
  3. 根据权利要求2所述的集群特征码获得方法，其特征在于，计算集群中的每个节点的哈希值，并形成哈希环的步骤，包括：
    将集群中的每个节点的IP地址或MAC地址，进行对2 32取模运算，获得每个节点的哈希值；
    将集群中的每个节点的哈希值组合形成哈希环。
  4. 根据权利要求1所述的集群特征码获得方法，其特征在于，从集群中的所有节点中确定多个关键节点的步骤，包括：
    根据用户输入的指定命令从集群中确定多个关键节点。
  5. 根据权利要求1所述的集群特征码获得方法，其特征在于，根据每个关键节点的特征码密文计算校验码的步骤，包括：
    每个关键节点的特征码密文，以及每个关键节点的节点容量进行组合，形成组合密文；
    利用摘要算法计算所述组合密文的校验码。
  6. 根据权利要求5所述的集群特征码获得方法，其特征在于，所述摘要算法为SM3算法。
  7. 根据权利要求6所述的集群特征码获得方法，其特征在于，当集群中新增关键节点时，还包括：
    获取新增关键节点的特征码明文；
    根据新增关键节点的特征码明文，利用一级公钥获得新增关键节点的特征码密文；
    返回所述根据每个关键节点的特征码密文计算校验码的步骤。
  8. 一种集群特征码获得装置，其特征在于，包括：
    关键节点模块，用于从集群中的所有节点中确定多个关键节点；
    一级计算模块，用于获取每个关键节点的特征码明文；根据每个关键节点的特征码明文，利用一级公钥分别获得每个关键节点的特征码密文；
    二级计算模块，用于根据每个关键节点的特征码密文计算校验码；根据校验码，利用二级公钥获得集群特征码。
  9. 一种电子设备，包括存储器、处理器，所述存储器中存储有可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现上述权利要求1至7任一项所述的方法的步骤。
  10. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有机器可运行指令，所述计算机可运行指令在被处理器调用和运行时，所述计算机可运行指令促使所述处理器运行所述权利要求1至7任一项所述的方法。
PCT/CN2021/121891 2020-12-14 2021-09-29 一种集群特征码获得方法、装置及电子设备 WO2022127294A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/023,160 US11784802B1 (en) 2020-12-14 2021-09-29 Cluster feature code obtainment method and apparatus, and electronic device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011475084.6A CN112702167B (zh) 2020-12-14 2020-12-14 一种集群特征码获得方法、装置及电子设备
CN202011475084.6 2020-12-14

Publications (1)

Publication Number Publication Date
WO2022127294A1 true WO2022127294A1 (zh) 2022-06-23

Family

ID=75508108

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/121891 WO2022127294A1 (zh) 2020-12-14 2021-09-29 一种集群特征码获得方法、装置及电子设备

Country Status (3)

Country Link
US (1) US11784802B1 (zh)
CN (1) CN112702167B (zh)
WO (1) WO2022127294A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112702167B (zh) * 2020-12-14 2022-11-11 苏州浪潮智能科技有限公司 一种集群特征码获得方法、装置及电子设备
CN113364770B (zh) * 2021-06-03 2022-12-27 上海天旦网络科技发展有限公司 一种基于集群特征的许可证实现方法及系统
CN114679340B (zh) * 2022-05-27 2022-08-16 苏州浪潮智能科技有限公司 一种文件共享方法、系统、设备及可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104700002A (zh) * 2013-12-05 2015-06-10 航天信息软件技术有限公司 一种软件保护、授权和注册的方法
CN107634946A (zh) * 2017-09-12 2018-01-26 郑州云海信息技术有限公司 一种微服务节点合法性验证方法和装置
US20180295115A1 (en) * 2017-04-11 2018-10-11 Fortanix, Inc. Management of and persistent storage for nodes in a secure cluster
CN109510702A (zh) * 2018-10-27 2019-03-22 福建福诺移动通信技术有限公司 一种基于计算机特征码的密钥存储及使用的方法
CN112702167A (zh) * 2020-12-14 2021-04-23 苏州浪潮智能科技有限公司 一种集群特征码获得方法、装置及电子设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103067525B (zh) * 2013-01-18 2015-11-25 广东工业大学 一种基于特征码的云存储数据备份方法
US9430649B2 (en) * 2013-12-17 2016-08-30 Microsoft Technology Licensing, Llc Automatic strong identity generation for cluster nodes
CN106909557B (zh) * 2015-12-23 2020-06-16 中国电信股份有限公司 内存集群的存储方法及装置、内存集群的读取方法及装置
WO2020010502A1 (zh) * 2018-07-10 2020-01-16 深圳花儿数据技术有限公司 一种基于一致性哈希算法的分布式数据冗余存储方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104700002A (zh) * 2013-12-05 2015-06-10 航天信息软件技术有限公司 一种软件保护、授权和注册的方法
US20180295115A1 (en) * 2017-04-11 2018-10-11 Fortanix, Inc. Management of and persistent storage for nodes in a secure cluster
CN107634946A (zh) * 2017-09-12 2018-01-26 郑州云海信息技术有限公司 一种微服务节点合法性验证方法和装置
CN109510702A (zh) * 2018-10-27 2019-03-22 福建福诺移动通信技术有限公司 一种基于计算机特征码的密钥存储及使用的方法
CN112702167A (zh) * 2020-12-14 2021-04-23 苏州浪潮智能科技有限公司 一种集群特征码获得方法、装置及电子设备

Also Published As

Publication number Publication date
CN112702167B (zh) 2022-11-11
US11784802B1 (en) 2023-10-10
CN112702167A (zh) 2021-04-23

Similar Documents

Publication Publication Date Title
WO2022127294A1 (zh) 一种集群特征码获得方法、装置及电子设备
US11784801B2 (en) Key management method and related device
CN111245597B (zh) 密钥管理方法、系统及设备
WO2020151330A1 (zh) 数据持有性验证方法及终端设备
US11252193B2 (en) Attestation service for enforcing payload security policies in a data center
US11917072B2 (en) Implementing opportunistic authentication of encrypted data
US11695541B2 (en) Implementing resilient deterministic encryption
US11316662B2 (en) Method and apparatus for policy hiding on ciphertext-policy attribute-based encryption
US10402593B2 (en) Verification paths of leaves of a tree
EP3618346A1 (en) A method and apparatus for policy hiding on ciphertext-policy attribute-based encryption
US9940195B2 (en) Encryption of slice partials
CN109951275B (zh) 密钥生成方法、装置、计算机设备及存储介质
WO2023115996A1 (zh) 一种模型保护方法、数据处理方法、装置、设备及介质
Kirubakaran et al. A cloud based model for deduplication of large data
CN111949996A (zh) 安全私钥的生成方法、加密方法、系统、设备及介质
CN111130788B (zh) 数据处理方法和系统、数据读取方法和iSCSI服务器
CN108141462A (zh) 数据库查询的方法和系统
KR102019558B1 (ko) 내재적 인증서를 사용하는 전자서명에 대한 효율적인 서명 검증 방법
Akintoye et al. Data security scheme for cloud computing using signcryption based on hyperelliptic curves
US10554517B2 (en) Reduction of volume of reporting data using content deduplication
JP2014170259A (ja) データ処理方法、データ処理システム及びデータ処理プログラム
TWI492092B (zh) 資料加密的方法
CN116208322A (zh) 秘钥软硬切换实现的方法、装置、设备和存储介质
CN117131541A (zh) 一种用于隐私保护的数据处理方法和计算设备
CN113810198A (zh) Ssd固件数字签名的方法、装置、计算机设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21905223

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21905223

Country of ref document: EP

Kind code of ref document: A1