WO2024139903A1

WO2024139903A1 - Cluster cryptographic acceleration method and device for universal internet platform

Info

Publication number: WO2024139903A1
Application number: PCT/CN2023/133855
Authority: WO
Inventors: 伦占群; 贺明; 李欣; 张海阔; 叶崛宇
Original assignee: 中国互联网络信息中心
Priority date: 2022-12-28
Filing date: 2023-11-24
Publication date: 2024-07-04
Also published as: CN116132420B; CN116132420A

Abstract

The present invention provides a cluster cryptographic acceleration method for a universal Internet platform, comprising: S1: taking idle cryptographic calculation resources of servers in backend clusters of a platform as remote resource nodes to form a virtual cryptographic calculation cluster, and taking a front end of the platform as a central management node of the cluster; S2, establishing a two-stage asynchronous parallel mechanism; S3, converting cryptographic operations in a TLS handshake into independent calculation tasks by means of the central management node, and asynchronously scheduling the calculation tasks to the remote resource nodes according to the two-stage asynchronous parallel mechanism; and S4: by means of the remote resource nodes, and according to the two-stage asynchronous parallel mechanism, asynchronously unloading the received calculation tasks to local cryptographic calculation resources for asynchronous parallel calculation, and then returning the result to the central management node. The method overcomes the defect in the prior art of imbalance of calculation resources between the front end and the back end of the Internet platform, achieves balance of calculation resources and maximization of calculation efficiency, and effectively improves the service capability of the platform.

Description

A cluster cryptographic acceleration method and device for a general Internet platform

Technical Field

The present invention relates to the field of Internet communication technology, and in particular to a cluster cryptography acceleration method and device for a general Internet platform.

Background technique

Hyper Text Transfer Protocol (HTTP) is used to transmit information between Web browsers and website servers. HTTP sends content in plain text and does not provide any form of data encryption. If an attacker intercepts the transmission message between the Web browser and the website server, he can directly read the information in it. Therefore, using HTTP to transmit private information is very unsafe.

Today's general Internet platforms widely use Hypertext Transfer Protocol Secure (HTTPS) to implement encrypted communications to ensure information and data security. Transport Layer Security (TLS), as the security core of the HTTPS protocol, effectively ensures the security and reliability of the network transmission layer by adding a cryptography-based security encryption mechanism between TCP and HTTP. It has become a must for secure Internet communications.

Usually, Internet platforms deploy reverse proxy servers at the front end, establish HTTPS connections with clients, and use load balancing strategies to forward client requests to the back end. For large Internet platforms, the front-end proxy needs to handle a large number of concurrent HTTPS connection requests per unit time. The complete TLS handshake protocol needs to be executed at the first connection. This is the most complex process for establishing a connection between the client and the server. It completes the negotiation of symmetric encryption communication keys and the identity authentication of both parties. The performance consumption accounts for a considerable proportion of the entire TLS communication. The handshake protocol requires the server to apply asymmetric cryptographic algorithms to ensure data security, such as digitally signing key information such as its own DH parameters, random numbers generated by both parties (TLS1.2), and even all handshake messages (TLS1.3) to ensure that the negotiation messages are not tampered with. During peak business hours, the single-machine throughput of the server surges. The calculation of a large number of complex asymmetric cryptographic codes in the TLS handshake will consume a lot of system resources, reduce the concurrent processing performance of the front-end proxy, and cannot cope with high-concurrency service scenarios.

However, the large amount of high-performance cryptographic computing resources contained in the existing Internet platform back-end distributed cluster servers have not been fully utilized. On the one hand, high-performance cryptographic acceleration technology has become a standard configuration of mainstream cluster servers. Taking the Intel Xeon series processors, which are widely used in servers, as an example, they were equipped with the Advanced Encryption Standard instruction AES-IN as early as 2010, and later integrated acceleration instructions such as VAES, GFNI, IFMA, and supported QAT cards and other high-performance cryptographic hardware acceleration technologies; on the other hand, some business cluster functions rarely involve cryptographic computing operations, and there are a large number of idle computing resources.

In summary, existing large-scale Internet sites all have the problem of high pressure on cryptographic calculations and uneven use of computing resources in front-end proxy high-concurrency TLS connection processing, which has become one of the constraints on the ability to build high-performance Internet platform services. Existing solutions mainly rely on local software and hardware acceleration services provided by third parties to improve front-end computing performance, which increases the cost of platform construction, cannot achieve independent control in terms of security, and also fails to solve the uneven use of computing resources. The problem.

Summary of the invention

The present invention provides a cluster cryptography acceleration method for a general Internet platform, which is used to solve the defect of unbalanced computing resources between the front-end and back-end of the Internet platform in the prior art, realize balanced use of computing resources and maximize computing efficiency, and effectively improve the platform service capability.

The present invention provides a cluster cryptography acceleration method for a general Internet platform, comprising:

S1: Use the idle cryptographic computing resources of the back-end cluster server of the Internet platform as remote resource nodes to form a virtual cryptographic computing cluster, and use the front-end of the Internet platform as the central management node of the virtual cryptographic computing cluster;

S2: Establish a two-level asynchronous parallel mechanism based on the central management node and remote resource nodes;

S3: converting cryptographic operations in the TLS handshake into independent computing tasks through the central management node, and asynchronously scheduling the computing tasks to remote resource nodes according to the two-level asynchronous parallel mechanism;

S4: Through the remote resource node, according to the two-level asynchronous parallel mechanism, the received computing tasks are asynchronously unloaded to the local cryptographic computing resources for asynchronous parallel computing, and the computing results are transmitted back to the central management node.

According to a cluster cryptographic acceleration method for a general Internet platform provided by the present invention, the two-level asynchronous parallel mechanism includes: a first-level asynchronous parallel mechanism and a second-level asynchronous parallel mechanism; the first-level asynchronous parallel mechanism is deployed on a central management node, and asynchronous parallel distribution of computing tasks is realized based on a coroutine mechanism, and independent computing tasks are established for asymmetric cryptographic operations based on an encryption engine mechanism; the second-level asynchronous parallel mechanism is deployed on a remote resource node, and computing tasks are offloaded to local cryptographic computing resources based on a coroutine mechanism, and a third-party cryptographic acceleration solution is called based on an encryption engine mechanism for asynchronous parallel computing.

According to a cluster cryptographic acceleration method for a general Internet platform provided by the present invention, the encryption engine mechanism is mounted on a user platform and an encryption software library based on a proprietary encryption scheme.

According to a cluster cryptography acceleration method for a general Internet platform provided by the present invention, S3 includes:

S3-1: The central management node uses the coroutine mechanism to establish a handshake coroutine for the TLS handshake as an independent transaction. When the handshake coroutine runs to the point where asymmetric cryptographic operations are required, the handshake coroutine is suspended and resources are transferred to other coroutines or threads to achieve parallel processing.

S3-2: The central management node converts asymmetric cryptographic operations into independent computing tasks through the encryption engine mechanism and distributes them to the encryption process in the remote resource node. After the task results are returned, the handshake coroutine is awakened to continue executing the unfinished handshake transactions.

According to a cluster cryptographic acceleration method for a general Internet platform provided by the present invention, a dynamic load balancing algorithm is applied to the asynchronous scheduling process from the central management node to the remote resource node; the dynamic load balancing algorithm is implemented based on the computing task response time in conjunction with a weighted strategy, the computing task response time is the time interval from the central management node issuing a computing task to receiving the task result, the dynamic load balancing algorithm uses the predicted value of the response time at the next moment as the evaluation value of the encryption process, and the evaluation value is inversely proportional to the assigned weight.

According to a cluster cryptography acceleration method for a general Internet platform provided by the present invention, the evaluation of the computing task response time applies a simple exponential smoothing prediction method, and the next time prediction value is modeled as an exponentially weighted linear function of the previous time observation value, and the weight decays as the observation value becomes older, which is expressed as follows:
y _T+1|T =αy _T +α(1-α)y _T-1 +α(1-α) ² y _T-2 +α(1-α) ³ y _T-3 +…+α(1-α) ^T-T0 y _T0 ;

Where yT is the current moment, yT0 is the initial moment, yT+1 is the predicted response time of the next moment, yT-1 is the response time of the previous moment, and α is the smoothing factor, which is used to control the decay rate of the previous response time evaluation value over time.

According to a cluster cryptographic acceleration method for a general Internet platform provided by the present invention, the two-level asynchronous parallel mechanism establishes a low-intrusion cluster architecture based on an encryption engine mechanism, and the low-intrusion cluster architecture includes platform-level low-intrusion and algorithm-level zero-intrusion.

The present invention also provides a cluster cryptographic acceleration device for a general Internet platform, comprising:

The cluster composition module is used to use the idle cryptographic computing resources of the back-end cluster server of the Internet platform as remote resource nodes to form a virtual cryptographic computing cluster, and use the front-end of the Internet platform as the central management node of the virtual cryptographic computing cluster;

A mechanism establishment module is used to establish a two-level asynchronous parallel mechanism based on the central management node and the remote resource node;

A task scheduling module, used to convert the cryptographic operations in the TLS handshake into independent computing tasks through the central management node, and asynchronously schedule the computing tasks to the remote resource nodes according to the two-level asynchronous parallel mechanism;

The task computing module is used to asynchronously offload the received computing tasks to the local cryptographic computing resources through the remote resource nodes according to the two-level asynchronous parallel mechanism for asynchronous parallel computing, and transmit the computing results back to the central management node.

The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the cluster cryptographic acceleration method for a general Internet platform as described in any one of the above is implemented.

The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the cluster cryptographic acceleration method for a general Internet platform as described in any one of the above is implemented.

The present invention provides a cluster cryptographic acceleration method for a general Internet platform. By deploying a central management node at the front end of the platform and deploying a remote resource node at the back end cluster server of the platform, a two-level asynchronous parallel mechanism is established, and the complex cryptographic calculations in the TLS handshake process of the platform front end proxy are asynchronously scheduled to the back end business cluster server, and the idle cryptographic computing resources of the cluster server are used for high-performance asynchronous parallel computing to build a virtual high-performance computing cluster, which can effectively alleviate the pressure of the front end business and improve the platform's concurrent connection processing capabilities. The balanced use of computing resources and the maximization of computing efficiency are achieved, and the platform service capabilities are effectively improved. In addition, it can solve the problems of high construction costs and lack of autonomous control caused by the existing acceleration solutions relying on third-party services, effectively reduce the platform construction and operation costs, and improve the platform's autonomous and controllable capabilities.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a flow chart of a cluster cryptographic acceleration method for a general Internet platform provided by the present invention;

FIG2 is a schematic diagram of the virtual cryptography computing cluster assembly of the cluster cryptography acceleration method for a general Internet platform provided by the present invention;

3 is a schematic diagram of a virtual cryptography computing cluster architecture of a cluster cryptography acceleration method for a general Internet platform provided by the present invention;

FIG4 is a schematic diagram of the implementation and deployment of the cluster cryptographic acceleration method for a general Internet platform provided by the present invention;

FIG5 is a schematic diagram of the structure of a cluster cryptographic acceleration device for a general Internet platform provided by the present invention;

FIG. 6 is a schematic diagram of the structure of an electronic device provided by the present invention.

Detailed ways

The following describes the cluster cryptography acceleration method for a general Internet platform according to the first embodiment of the present invention in conjunction with Figures 1 to 4.

As shown in FIG1 , a cluster cryptographic acceleration method for a general Internet platform in this embodiment specifically includes the following steps (the numbering of each step in the present invention is only used to distinguish the steps, and does not limit the specific execution order of each step):

S1: Use the idle cryptographic computing resources of the back-end cluster server of the Internet platform as remote resource nodes to form a virtual cryptographic computing cluster, and use the front-end of the Internet platform as the central management node of the virtual cryptographic computing cluster.

The present invention is combined with the actual construction scenario of the general Internet platform, as shown in Figure 2. The left side of Figure 2 shows the mainstream architecture of the current Internet platform. The front end establishes an HTTPS connection with the client through a reverse proxy server, and uses a load balancing strategy to forward customer requests to the back end. The back end adopts a distributed architecture, and the application layer is vertically divided into different business subsystems according to different business needs. The subsystem is composed of a business cluster composed of several containers in multiple servers to form a high-performance business processing capability; the service layer provides public services for the application layer; and the resource layer provides data storage support for the upper layer. In this step, the idle cryptographic computing resources of the servers in each business cluster of the back end of the Internet platform are used as remote resource nodes to form a virtual cryptographic computing cluster, referred to as a cluster. The front end is used as the central management node of the cluster, and the cryptographic operations in the TLS handshake are converted into computing tasks, which are dispatched to the remote resource nodes for high-performance parallel computing using a two-level asynchronous parallel mechanism.

This embodiment uses the Nginx software, which is widely used on the Internet platform, as a reverse proxy tool, and the Openssl software library, which has a high underlying application deployment rate, as an encryption tool. Cluster acceleration is implemented using proxy software, which is specifically divided into central management node proxy and remote resource node proxy. As shown in Figure 4, the Nginx software is deployed on the front end of the platform, and parameters such as the service IP address, port number, number of work processes, and forwarding strategy are configured according to the actual needs of the user. The central management node agent is also deployed on the front end and is attached to Nginx in a low-intrusive manner. The back end is connected to multiple cluster servers with integrated cryptographic hardware acceleration instructions or acceleration cards. Each server deploys a remote resource node agent based on the original business system. Users can set encryption based on the size of the business volume and the specific operation of the business system. The number of processes and their binding relationship with CPU logical cores.

S2: Establish a two-level asynchronous parallel mechanism based on the central management node and the remote resource nodes.

The two-level asynchronous parallel mechanism includes a first-level asynchronous parallel mechanism and a second-level asynchronous parallel mechanism; the first-level asynchronous parallel mechanism is deployed on the central management node, and implements asynchronous parallel distribution of computing tasks based on the coroutine mechanism, and establishes independent computing tasks for asymmetric cryptographic operations based on the encryption engine mechanism; the second-level asynchronous parallel mechanism is deployed on the remote resource node, and offloads computing tasks to local cryptographic computing resources based on the coroutine mechanism, and calls third-party cryptographic acceleration solutions for asynchronous parallel computing based on the encryption engine mechanism.

As shown in Figure 3, the central management node is deployed at the front end of the platform to implement the first-level asynchronous parallel mechanism and dynamic load balancing algorithm. It is responsible for transactionalizing each TLS handshake in a coroutine manner, and converting the asymmetric cryptographic operations in the transaction into independent computing tasks, asynchronously scheduling them to remote resource nodes for execution, and realizing asynchronous parallel computing of massive TLS handshake cryptographic operations, improving the platform's concurrent connection processing capabilities. The scheduling process applies a dynamic balancing algorithm to ensure a high degree of matching between computing tasks and node performance and balanced allocation of computing resources. The remote resource node is deployed in the back-end cluster server of the platform, and a second-level asynchronous parallel mechanism is implemented through multiple parallel encryption processes. The encryption process asynchronously offloads the multiple computing tasks received to the local idle software and hardware cryptographic acceleration resources for asynchronous parallel computing, and finally transmits the calculation results back to the central management node.

S3-1: The central management node uses the coroutine mechanism to establish a handshake coroutine for the TLS handshake as an independent transaction. When the handshake coroutine runs to the point where asymmetric cryptographic operations are required, the handshake coroutine is suspended and resources are given to other coroutines or threads to achieve parallel processing.

As shown in Figure 3, the first-level asynchronous parallel mechanism is deployed on the central management node, and the asynchronous parallel distribution of computing tasks is realized based on the coroutine mechanism. Asynchronous distribution first establishes a handshake coroutine for each TLS handshake as an independent transaction. The coroutine mechanism is a standardized, lightweight asynchronous communication mechanism established within the thread. When the handshake coroutine runs to the point where asymmetric cryptographic operations are required, the handshake coroutine is suspended and resources are given to other coroutines or threads to achieve high-performance parallel processing.

At the same time, the encryption engine mechanism is used to establish independent computing tasks for asymmetric cryptographic operations, which are distributed to the encryption process in the remote resource node through a dynamic load balancing algorithm. After the task result is returned, the handshake coroutine is awakened to continue to execute the unfinished handshake transaction. The encryption process is used to offload multiple computing tasks to the local computing resources of the remote resource node for execution.

Two-level asynchronous parallelism uses a more mature coroutine mechanism to implement asynchronous operations. As a lightweight asynchronous mechanism compared to those built within threads, it has the advantages of high efficiency, low overhead, simplicity and practicality. The central management node regards a single TLS handshake as an independent transaction and establishes a coroutine for it. All events of a single handshake are completed in sequence within the coroutine, such as key negotiation and identity authentication. A large number of parallel coroutines are used to handle massive TLS concurrent handshake processes and complete handshake instantiation.

A complete handshake instance will involve multiple cryptographic operations, which can be modeled as Independent computing task entities involve the extraction of raw data, the creation of cryptographic algorithm structures, and the management of the entire life cycle of tasks and keys. When the TLS handshake instance runs to cryptographic operations, the cryptographic operations are converted into computing task entities to achieve decoupling from the handshake instance. The computing task will be submitted to the dynamic load balancing module and distributed to the remote resource node. At the same time, the corresponding coroutine is suspended, and the resources are given to other coroutines to handle parallel TLS handshakes. After the task is completed, the coroutine is awakened, and the remote resource node reports the calculation results. After the central management node obtains the calculation results, it continues to execute subsequent handshake events and recycles task resources to complete the first level of asynchronous parallelism.

In this embodiment, the Nginx software forwards the client HTTPS request to the central management node agent. The agent establishes a handshake coroutine for each TLS handshake, converts the asymmetric signature operation in the TLS handshake into a computing task through the encryption engine mechanism, realizes the suspension and wake-up of the handshake coroutine, and submits it to the dynamic load balancing algorithm for processing.

The dynamic load balancing algorithm is implemented based on the computing task response time and weighted strategy. It can not only satisfy the distribution of computing tasks to high-performance encryption processes to ensure computing efficiency, but also avoid uneven utilization of computing resources due to excessive concentration of computing tasks. The computing task response time refers to the time interval from the central management node issuing a computing task to receiving the task result. The algorithm uses the predicted response time value at the next moment as the evaluation value of the encryption process. The smaller the evaluation value, the higher the computing performance and the higher the weight assigned. Conversely, the lower the weight assigned. When distributing tasks, the encryption process of the remote resource node is selected based on the weight. The probability of selection is high for a high weight, and vice versa. The evaluation of the computing task response time uses the simple exponential smoothing prediction method, which is suitable for predicting univariate time series data without clear trends or seasonal patterns. The next time prediction value is modeled as an exponentially weighted linear function of the previous time observation value. The weight decays as the observation value becomes older, expressed as follows:
y _T+1|T =αy _T +α(1-α)y _T-1 +α(1-α) ² y _T-2 +α(1-α) ³ y _T-3 +…+α(1-α) ^T-T0 y _T0 ;

In this embodiment, the algorithm calculates the target node encryption process to which the current computing task should go based on the probability corresponding to the encryption process weight of the remote resource node, and distributes it through the sending module. The central management node agent will measure, evaluate and record the historical values of the response time of each computing task sent to each encryption process in real time, and predict the response time value at the next moment based on the historical value sequence combined with the simple exponential smoothing prediction method, and set the encryption process weight and corresponding probability accordingly.

The remote resource node will establish multiple acceleration service instances, and at the same time receive a large number of computing tasks distributed by the processing center management node, and establish a coroutine for it. Similar to the migration of computing tasks, the coroutine mechanism is used to realize asynchronous parallel processing of computing tasks on local hardware computing resources, and the computing results are reported to the central management node to complete the second-level asynchronous parallelism.

As shown in Figure 3, the secondary asynchronous parallel mechanism is implemented by the encryption process of the remote resource node. The encryption process is bound to the CPU logic core, and the binding relationship can be specified by the user according to his own needs. The secondary asynchronous mechanism is similar to the primary asynchronous implementation mechanism. The computing tasks are offloaded to the local computing resources for asynchronous execution through the coroutine mechanism and the encryption engine mechanism, and multiple encryption processes are established in the remote resource node to realize high-performance parallel processing of computing tasks. The computing resources can be hardware encryption instructions integrated in the CPU or flexibly pluggable hardware encryption cards, such as QAT encryption cards.

In this embodiment, multiple encryption processes of the remote resource node agent will simultaneously receive a large number of computing tasks sent by the central management node agent, and use a method similar to the first-level asynchronous mechanism to offload the computing tasks to the local cryptographic acceleration resources, and use the encryption engine mechanism to transparently call the third-party cryptographic acceleration solution to perform asynchronous parallel computing. After the computing task is completed, the agent will return the calculation result to the central management node agent, which will wake up the corresponding handshake coroutine to perform subsequent handshake operations.

The encryption engine mechanism is a set of methods based on its own encryption scheme mounted on the user platform and encryption software library in a low-intrusion or zero-intrusion manner. At the architectural level, it provides an asynchronous acceleration service interface as an insertion point, embedded in the user platform encryption data processing flow, to achieve the migration of cryptographic operations to the backend and achieve a low-intrusion design; at the algorithm level, the computing task is encapsulated as a third-party application entity, directly mounted on the user encryption software library, replacing the original cryptographic operations to achieve zero intrusion.

The two-level asynchronous parallel mechanism of the present invention both establishes a low-intrusion cluster architecture based on the encryption engine mechanism, wherein the low-intrusion cluster architecture includes platform-level low-intrusion and algorithm-level zero-intrusion. After a lightweight transformation of the original platform, cluster acceleration can be quickly achieved. The method of the present invention provides users with a simple and easy-to-use transaction management service interface at the platform layer, which can be embedded in the platform to achieve cluster acceleration on the platform, achieving platform-level low-intrusion. At the algorithm layer, it supports encapsulating operations such as coroutine suspension and task distribution as an independent engine mounted on the underlying encryption software library, and realizes the distribution or unloading of computing tasks in a zero-intrusion manner, so that users do not need to replace the original underlying encryption software library to achieve cluster acceleration and achieve algorithm-level zero-intrusion.

In this embodiment, management service interfaces such as transaction suspension, wake-up, and task sending and receiving are embedded in the Nginx software processing flow to realize the mounting of the central management node agent on the mainstream reverse proxy software. At the same time, considering that the existing Internet platforms widely use the OpenSSL encryption software library to implement cryptographic operations, the method of the present invention encapsulates operations such as coroutine suspension and task distribution into an independent engine (Engine) mounted on OpenSSL, and implements the sending of computing tasks to the remote end or the unloading of computing tasks at the remote end in a zero-intrusive manner, so that users can achieve cluster acceleration without replacing the original underlying encryption software library. The purpose of the OpenSSL Engine mechanism is to enable users to transparently use third-party software and hardware encryption solutions, mount the solutions on OpenSSL in the form of Engine, and users call the general encryption interface to transparently use third-party encryption resources and methods.

The cluster cryptographic acceleration device for a general Internet platform provided by the present invention is described below. The cluster cryptographic acceleration device for a general Internet platform described below and the cluster cryptographic acceleration method for a general Internet platform described above can be referenced to each other.

As shown in FIG5 , the second embodiment of the present invention further provides a cluster cryptographic acceleration device for a general Internet platform, including:

The cluster composition module 510 is used to use the idle cryptographic computing resources of the Internet platform backend cluster server as remote resource nodes to form a virtual cryptographic computing cluster, and use the Internet platform front end as the central management node of the virtual cryptographic computing cluster.

The mechanism establishment module 520 is used to establish a two-level asynchronous parallel mechanism based on the central management node and the remote resource nodes.

The task scheduling module 530 is used to convert the cryptographic operations in the TLS handshake into independent computing tasks through the central management node, and asynchronously schedule the computing tasks to the remote resource nodes according to the two-level asynchronous parallel mechanism.

The task computing module 540 is used to asynchronously offload the received computing tasks to the local cryptographic computing resources through the remote resource nodes according to the two-level asynchronous parallel mechanism for asynchronous parallel computing, and transmit the computing results back to the central management node.

FIG6 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG6 , the electronic device may include: a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the cluster cryptographic acceleration method for the general Internet platform, and the method includes:

S3: The cryptographic operations in the TLS handshake are converted into independent computing tasks through the central management node, and the computing tasks are asynchronously scheduled to the remote resource nodes according to the two-level asynchronous parallel mechanism.

In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the cluster cryptographic acceleration method for a general Internet platform provided by the above methods, the method includes:

In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the cluster cryptographic acceleration method for a general Internet platform provided by the above methods, the method comprising:

Claims

A cluster cryptographic acceleration method for a general Internet platform, characterized by comprising:

S1: Use the idle cryptographic computing resources of the back-end cluster server of the Internet platform as remote resource nodes to form a virtual cryptographic computing cluster, and use the front-end of the Internet platform as the central management node of the virtual cryptographic computing cluster;

S2: Establish a two-level asynchronous parallel mechanism based on the central management node and remote resource nodes;

S3: converting cryptographic operations in the TLS handshake into independent computing tasks through the central management node, and asynchronously scheduling the computing tasks to remote resource nodes according to the two-level asynchronous parallel mechanism;

S4: Through the remote resource node, according to the two-level asynchronous parallel mechanism, the received computing tasks are asynchronously unloaded to the local cryptographic computing resources for asynchronous parallel computing, and the computing results are transmitted back to the central management node.
According to claim 1, the cluster cryptographic acceleration method for a general Internet platform is characterized in that the two-level asynchronous parallel mechanism includes: a first-level asynchronous parallel mechanism and a second-level asynchronous parallel mechanism; the first-level asynchronous parallel mechanism is deployed on a central management node, and asynchronous parallel distribution of computing tasks is realized based on a coroutine mechanism, and independent computing tasks are established for asymmetric cryptographic operations based on an encryption engine mechanism; the second-level asynchronous parallel mechanism is deployed on a remote resource node, and computing tasks are offloaded to local cryptographic computing resources based on a coroutine mechanism, and a third-party cryptographic acceleration solution is called based on an encryption engine mechanism for asynchronous parallel computing.
The cluster cryptographic acceleration method for a general Internet platform according to claim 2 is characterized in that the encryption engine mechanism is mounted on the user platform and encryption software library based on its own encryption scheme.
The cluster cryptography acceleration method for a general Internet platform according to claim 3, characterized in that S3 comprises:

S3-1: The central management node uses the coroutine mechanism to establish a handshake coroutine for the TLS handshake as an independent transaction. When the handshake coroutine runs to the point where asymmetric cryptographic operations are required, the handshake coroutine is suspended and resources are transferred to other coroutines or threads to achieve parallel processing.

S3-2: The central management node converts asymmetric cryptographic operations into independent computing tasks through the encryption engine mechanism and distributes them to the encryption process in the remote resource node. After the task results are returned, the handshake coroutine is awakened to continue executing the unfinished handshake transactions.
The cluster cryptographic acceleration method for a general Internet platform according to claim 3 is characterized in that the asynchronous scheduling process from the central management node to the remote resource node applies a dynamic load balancing algorithm; the dynamic load balancing algorithm is implemented based on the computing task response time in conjunction with a weighted strategy, and the computing task response time is The dynamic load balancing algorithm uses the predicted value of the response time at the next moment as the evaluation value of the encryption process, and the evaluation value is inversely proportional to the assigned weight.
According to claim 5, the cluster cryptography acceleration method for a general Internet platform is characterized in that the evaluation of the computing task response time applies a simple exponential smoothing prediction method, and the next time prediction value is modeled as an exponentially weighted linear function of the previous time observation value, and the weight decays as the observation value becomes older, which is expressed as follows:
y T+1|T =αy T +α(1-α)y T-1 +α(1-α) 2 y T-2 +α(1-α) 3 y T-3 +…+α(1-α) T-T0 y T0 ;

Where yT is the current moment, yT0 is the initial moment, yT+1 is the predicted response time of the next moment, yT-1 is the response time of the previous moment, and α is the smoothing factor, which is used to control the decay rate of the previous response time evaluation value over time.
According to the cluster cryptographic acceleration method for a general Internet platform according to claim 1, it is characterized in that the two-level asynchronous parallel mechanism establishes a low-intrusion cluster architecture based on the encryption engine mechanism, and the low-intrusion cluster architecture includes platform-level low-intrusion and algorithm-level zero-intrusion.
A cluster cryptographic acceleration device for a general Internet platform, comprising:

The cluster composition module is used to use the idle cryptographic computing resources of the back-end cluster server of the Internet platform as remote resource nodes to form a virtual cryptographic computing cluster, and use the front-end of the Internet platform as the central management node of the virtual cryptographic computing cluster;

A mechanism establishment module is used to establish a two-level asynchronous parallel mechanism based on the central management node and the remote resource node;

A task scheduling module, used to convert the cryptographic operations in the TLS handshake into independent computing tasks through the central management node, and asynchronously schedule the computing tasks to the remote resource nodes according to the two-level asynchronous parallel mechanism;

The task computing module is used to asynchronously offload the received computing tasks to the local cryptographic computing resources through the remote resource nodes according to the two-level asynchronous parallel mechanism for asynchronous parallel computing, and transmit the computing results back to the central management node.
An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the cluster cryptographic acceleration method for a general Internet platform as claimed in any one of claims 1 to 8 is implemented.
A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the cluster cryptographic acceleration method for a general Internet platform as described in any one of claims 1 to 8 is implemented.