Providing high availability computing service by issuing a certificate

Patent metadata

Field	Value
Publication number	US-11206137-B2
Application number	US-202117222619-A
Country	US
Kind code	B2
Filing date	Apr 5, 2021
Priority date	Aug 29, 2019
Publication date	Dec 21, 2021
Grant date	Dec 21, 2021

Abstract

This disclosure relates to providing a high availability computing service in a distributed system. In one aspect, a method includes sending, by a computing unit of multiple computing units that are each executing a respective copy of a computing task, a certificate request to a trusted certificate generator. The request includes authentication information. The authentication information includes a code hash of the computing task. The computing unit receives a certificate report including a public key certificate in a certificate chain generated for the code hash and a private key corresponding to the public key certificate. The public key certificate and the private key form a certificate pair. The certificate chain includes multiple certificates including the public key certificate and a root certificate corresponding to the public key certificate. The computing unit is used as a TLS server. The certificate pair is set as a certificate pair of the TLS server.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
sending, by a user terminal, a certificate request to a trusted certificate generator, wherein the certificate request comprises a first code hash of a computing task;
receiving, by the user terminal, a certificate report from the trusted certificate generator, wherein the certificate report comprises a first root certificate in a certificate chain generated for the first code hash, wherein the certificate chain comprises a first public key certificate corresponding to the first root certificate, wherein the first public key certificate and a matched first private key form a first certificate pair, and wherein the first certificate pair is pre-distributed to one or more authenticated computing units running the computing task;
using the user terminal as a transport layer security (TLS) client;
setting the first root certificate as a trusted root certificate of the TLS client to communicate with the one or more authenticated computing units that have the first certificate pair and that functions as a TLS server; and
obtaining a computing service corresponding to the computing task from the one or more authenticated computing units.

2. The computer-implemented method of claim 1 , further comprising, before sending the certificate request to the trusted certificate generator:
obtaining authentication information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information.

3. The computer-implemented method of claim 2 , wherein:
the authentication information is an authentication result file authenticated by a third-party authentication institution, and the authentication result file comprises signature information of the third-party authentication institution; and
performing authentication on the trusted certificate generator based on the authentication information comprises verifying the signature information, and in response to the signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.

4. The computer-implemented method of claim 2 , wherein:
the authentication information is a report file generated by the trusted certificate generator, and the report file comprises a second code hash and signature information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information comprises,
sending the report file to a third-party authentication institution to obtain an authentication result file, wherein the authentication result file comprises additional signature information of the third-party authentication institution, and
verifying the additional signature information, and in response to the additional signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.

5. The computer-implemented method of claim 1 , further comprising, after setting the first root certificate as a trusted root certificate of the TLS client:
performing a TLS handshake with the one or more authenticated computing units to establish a trusted TLS channel; and
obtaining the computing service corresponding to the computing task from the one or more authenticated computing units through the trusted TLS channel.

6. The computer-implemented method of claim 5 , wherein obtaining the computing service corresponding to the computing task from the one or more authenticated computing units comprises connecting to at least one computing unit of the one or more authenticated computing units based on a routing path determined by a routing server based on load balancing of the one or more authenticated computing units, thereby obtaining the computing service corresponding to the computing task from the at least one computing unit.

7. The computer-implemented method of claim 1 , further comprising:
determining that a first authenticated computing unit of the one or more authenticated computing units has failed; and
switching to a second authenticated computing unit of the one or more authenticated computing units.

8. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
sending, by a user terminal, a certificate request to a trusted certificate generator, wherein the certificate request comprises a first code hash of a computing task;
receiving, by the user terminal, a certificate report from the trusted certificate generator, wherein the certificate report comprises a first root certificate in a certificate chain generated for the first code hash, wherein the certificate chain comprises a first public key certificate corresponding to the first root certificate, wherein the first public key certificate and a matched first private key form a first certificate pair, and wherein the first certificate pair is pre-distributed to one or more authenticated computing units running the computing task;
using the user terminal as a transport layer security (TLS) client;
setting the first root certificate as a trusted root certificate of the TLS client to communicate with the one or more authenticated computing units that have the first certificate pair and that functions as a TLS server; and
obtaining a computing service corresponding to the computing task from the one or more authenticated computing units.

9. The non-transitory, computer-readable medium of claim 8 , wherein the operations comprise, before sending the certificate request to the trusted certificate generator:
obtaining authentication information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information.

10. The non-transitory, computer-readable medium of claim 9 , wherein:
the authentication information is an authentication result file authenticated by a third-party authentication institution, and the authentication result file comprises signature information of the third-party authentication institution; and
performing authentication on the trusted certificate generator based on the authentication information comprises verifying the signature information, and in response to the signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.

11. The non-transitory, computer-readable medium of claim 9 , wherein:
the authentication information is a report file generated by the trusted certificate generator, and the report file comprises a second code hash and signature information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information comprises,
sending the report file to a third-party authentication institution to obtain an authentication result file, wherein the authentication result file comprises additional signature information of the third-party authentication institution, and
verifying the additional signature information, and in response to the additional signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.

12. The non-transitory, computer-readable medium of claim 8 , wherein the operations comprise, after setting the first root certificate as a trusted root certificate of the TLS client:
performing a TLS handshake with the one or more authenticated computing units to establish a trusted TLS channel; and
obtaining the computing servic

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Yu Chaofan
• Wang Lei
• Zhou Aihui
• Zhang Ning
• Tian Hongliang
• Xiao Junxian

Classifications

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/006

  involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title

• H04L9/3265

  using certificate chains, trees or paths; Hierarchical trust model · CPC title