CN118827600A - Information processing method, device, equipment and computer storage medium - Google Patents

Abstract

The embodiment of the present application discloses an information processing method, including: sending an identity authentication request corresponding to a user and attribute information of a client to a first server in a distributed system; when the identity authentication of the user based on the identity authentication request is passed by the first server, receiving a first credential for the first server sent by the first server, and storing the processed first credential to a target storage space of the client; wherein the first credential refers to a credential for exempting identity authentication when the client connects to the server again; when the first server fails, sending a connection request and the first credential to a second server in the distributed system, so as to provide services to the client through the second server. The embodiment of the present application also discloses an information processing device, equipment, and computer storage medium.

Description

Information processing method, device, equipment and computer storage medium

Technical Field

The present application relates to the field of Internet technology, and in particular to an information processing method, device, equipment and computer storage medium.

Background Art

At present, the specific process of server switching in the existing distributed system is: the session information between the servers is synchronized with each other, that is, after the user establishes session information in one of the servers in the distributed system, the server will immediately synchronize the user session information to other servers in the distributed system. Once the client cannot connect to the server, it can automatically switch to other servers. However, in the existing server switching method in the distributed system, it is required that the servers in the distributed system are either in the same local area network or distributed on the Internet. If the bandwidth is insufficient, the timeliness of the synchronization of session information between the servers is poor, resulting in the inability of the client to connect to other surviving servers, thereby resulting in low efficiency of server switching.

Summary of the invention

In order to solve the above technical problems, the embodiments of the present application hope to provide an information processing method, device, equipment and computer storage medium, which can solve the problem of low efficiency of server switching in related technologies.

The technical solution of this application is implemented as follows:

An information processing method, the method comprising:

Sending an identity authentication request corresponding to the user and attribute information of the client to a first server in the distributed system;

In the case where the identity authentication of the user is passed by the first server based on the identity authentication request, receiving a first credential for the first server sent by the first server, and storing the processed first credential in the target storage space of the client; wherein the first credential refers to a credential for exempting identity authentication when the client connects to the server again;

In the event that the first server fails, a connection request and the first credential are sent to a second server in the distributed system, so as to provide services to the client through the second server.

In the above solution, the receiving the first credential for the first server sent by the first server includes:

Sending a tunnel establishment request to the first server; wherein the tunnel establishment request is used to establish an information transmission channel between the client and the first server;

Upon receiving the consent information sent by the first server, the first credential sent by the first server is received through the information transmission channel; wherein the consent information is generated by the first server based on the tunnel establishment request; the first credential is generated by the first server by encrypting the first to-be-processed credential using a secret key, and the secret key has the characteristic of periodically changing over time; the first to-be-processed credential is generated by the first server.

In the above solution, after receiving the first credential sent by the first server through the information transmission channel, the method further includes:

The first credential is encrypted using the attribute information to obtain the processed first credential.

In the above solution, sending the connection request and the first credential to the second server in the distributed system includes:

Decrypting the processed first credential using the attribute information to obtain the first credential;

Send a connection request and the first credential to a second server in the distributed system, so that the second server uses the secret key to decrypt the first credential to obtain the first to-be-processed credential.

An information processing method, applied to a second server, comprising:

Receive a connection request and a first credential sent by a client; wherein the first credential is sent by a first server to the client, and the first credential refers to a credential for exempting identity authentication when the client connects to the server again;

In the case where it is determined by using a detection technology that a fault exists in the first server, a connection is established with the client based on the connection request and the first credential to provide services to the client.

In the above solution, after establishing a connection with the client based on the connection request and the first credential to provide a service to the client, the method further includes:

When the client establishes a connection with the second server, the first credential is decrypted using a secret key to obtain a first credential to be processed;

Based on the first pending credential and the identification of the second server, a second pending credential for the second server is generated.

In the above solution, the information processing method further includes:

In the case where the detection technology is used to determine that the first server is alive, a connection rejection message is sent to the client; wherein the connection rejection message is generated based on the connection request.

A first information processing device, the device comprising:

A first sending unit, used to send an identity authentication request corresponding to the user and attribute information of the client to a first server in the distributed system;

A first processing unit is configured to receive a first credential for the first server sent by the first server when the identity authentication of the user based on the identity authentication request is successful, and store the processed first credential in a target storage space of the client; wherein the first credential refers to a credential for exempting identity authentication when the client connects to the server again;

The second sending unit is used to send a connection request and the first credential to a second server in the distributed system when the first server fails, so as to provide services to the client through the second server.

A second information processing device, the device comprising:

A receiving unit, configured to receive a connection request and a first credential sent by a client; wherein the first credential is sent by a first server to the client, and the first credential refers to a credential for exempting identity authentication when the client connects to the server again;

The second processing unit is configured to establish a connection with the client based on the connection request to provide services to the client when it is determined that the first server has a fault by using a detection technology.

A client comprises: a first processor, a first memory and a first communication bus;

The first communication bus is used to realize the communication connection between the first processor and the first memory;

The first processor is used to execute the information processing program stored in the first memory to implement the steps of the above-mentioned information processing method.

A second server, the second server comprising: a second processor, a second memory, and a second communication bus;

The second communication bus is used to realize the communication connection between the second processor and the second memory;

The second processor is used to execute the information processing program stored in the second memory to implement the steps of the above-mentioned information processing method.

A computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the above-mentioned information processing method.

The information processing method, apparatus, device and computer storage medium provided in the embodiments of the present application first send an identity authentication request corresponding to the user and attribute information of the client to the first server in the distributed system, and then, when the identity authentication of the user based on the identity authentication request is passed by the first server, receive the first credential for the first server sent by the first server, and store the processed first credential in the target storage space of the client, and the first credential refers to the credential that is exempted from identity authentication when the client connects to the server again, and then, when there is a failure in the first server, send a connection request and the first credential to the second server in the distributed system to provide services to the client through the second server. In this way, by storing the first credential generated by the first server in the client and then sending it to the second server by the client, instead of requiring synchronization of session information (i.e., credentials) between the servers of the distributed system as in the related art, it is not dependent on network bandwidth, thereby improving the efficiency of server switching, and storing the first credential in the client, instead of each server in the distributed system storing credentials synchronized from other servers as in the related art, thereby reducing the overhead of the server.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a flow chart of an information processing method provided in an embodiment of the present application;

FIG2 is a schematic diagram of a flow chart of another information processing method provided in an embodiment of the present application;

FIG3 is a schematic diagram of a flow chart of another information processing method provided in an embodiment of the present application;

FIG4 is a schematic diagram of the structure of a first information processing device provided in an embodiment of the present application;

FIG5 is a schematic diagram of the structure of a second information processing device provided in an embodiment of the present application;

FIG6 is a schematic diagram of the structure of a client provided in an embodiment of the present application;

FIG. 7 is a schematic diagram of the structure of a second server provided in an embodiment of the present application.

DETAILED DESCRIPTION

The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

It should be noted that in the related technology, the session information between the service ends (i.e., servers) of the distributed system is synchronized with each other. That is, after the user establishes session information on one of the server ends of the distributed system, the server end will immediately synchronize the user session information to other server ends in the distributed system. Once the client cannot connect to the server end and automatically switches to other server ends, the synchronized session information can also be used for seamless switching and continuous keep-alive.

However, the main technical drawbacks of the switching method for server-side session information synchronization used in related technologies are that it relies on high-speed networks and has high server-side overhead. Specifically, it relies on high-speed networks: when using a server-side session synchronization solution, the servers in the distributed system are either in the same local area network with a LAN speed of more than 1 gigabit; or they are distributed on the Internet, and different servers are connected using a bare fiber high-speed network. The above two scenarios can guarantee the timeliness of session information synchronization. If the bandwidth is insufficient, the client will not be able to connect to the online server. When switching to other surviving servers, the server has not yet obtained the synchronized session information, resulting in the need for users to re-authenticate and unable to maintain survival, resulting in a poor user experience. High server-side overhead: When using a server-side session synchronization solution, all users' session information is fully stored on any server in the distributed system, which makes the server-side overhead extremely large.

Based on this, an embodiment of the present application provides an information processing method, which can be applied to a client. As shown in FIG1 , the method includes the following steps:

Step 101: Send an identity authentication request corresponding to a user and attribute information of a client to a first server in a distributed system.

In an embodiment of the present application, the first server may refer to a server in a distributed system that currently provides services to the client; the identity authentication request may refer to a request for authenticating the identity of the user; the attribute information of the client may specifically refer to the hardware characteristics of the client; the client may access the first server and send the identity authentication request corresponding to the user and the hardware characteristics of the client to the first server; it should be noted that the distributed system may include multiple servers.

In a feasible implementation, the hardware characteristics of the client may refer to the client's memory information, the client's Media Access Control Address (MAC), the client's operating system information, etc.; the first server may refer to the server closest to the client.

Step 102: When the identity authentication of the user based on the identity authentication request is successful through the first server, a first credential for the first server sent by the first server is received, and the processed first credential is stored in the target storage space of the client.

The first credential may refer to a credential that is used to exempt the client from identity authentication when the client connects to the server again.

In an embodiment of the present application, the first credential may be generated by the first server after encrypting the first to-be-processed credential generated by itself, and the first to-be-processed credential may specifically be generated by the first server based on the attribute information of the session established between the client and the first server, the user identifier carried in the identity authentication request, and the attribute information of the client; passing the identity authentication of the user may indicate that the user is a legitimate user; the attribute information of the session may at least include the login time of the user logging into the first server (i.e., the session online time) and the identifier of the first server (i.e., the identifier of the session online server); the processed first credential may refer to the credential generated by the client after processing the first credential; after the client sends the identity authentication request and the attribute information of the client to the first server, the first server may authenticate the identity of the user based on the identity authentication request, and if the identity authentication of the user passes In this case, the first server can generate a first to-be-processed credential based on the user identifier carried in the identity authentication request, the client's attribute information, the session online time and the identifier of the session online server, and encrypt the first to-be-processed credential to generate the first credential, and send the first credential to the client. The client then processes the first credential and stores the processed first credential in its own target storage space. In this way, there is no need for the server of the distributed system to synchronize the credentials, but the credentials are stored on the client. Therefore, the network bandwidth requirement is extremely low and does not rely on high-speed networks, which greatly reduces the construction cost and physical environment dependence of session persistence technology between distributed systems and broadens the application scenarios. At the same time, there is no need for the server of the distributed system to store credentials synchronized from other servers. The credentials of all users are distributed and stored on all servers and clients, which greatly reduces the server overhead.

Step 103: When a failure occurs on the first server, a connection request and a first credential are sent to a second server in the distributed system, so as to provide services to the client through the second server.

In an embodiment of the present application, the second server may refer to the server to which the client switches; the main server in the distributed system may use communication mechanism detection technology to detect the first server, and when a fault is detected in the first server, a connection request and a first credential may be sent to the second server to continue providing services to the client through the second server. In this way, after any server in the distributed system generates credentials, session maintenance can be achieved without the need for server synchronization of credentials; at the same time, seamless switching and continuous keep-alive of servers in the distributed system can also be achieved, thereby improving the user experience.

The information processing method provided in the embodiment of the present application stores the first credential generated by the first server on the client, which is then sent by the client to the second server, instead of requiring synchronization of session information (i.e., credentials) between the servers of the distributed system as in the related art. It is independent of network bandwidth, thereby improving the efficiency of server switching, and stores the first credential on the client, instead of requiring each server in the distributed system to store credentials synchronized from other servers as in the related art, thereby reducing the overhead of the server.

The present application embodiment provides another information processing method, which can be applied to the second server. As shown in FIG. 2 , the method includes the following steps:

Step 201: Receive a connection request and a first credential sent by a client.

Among them, the first credential is sent by the first server to the client, and the first credential is generated by the first server after encrypting the first to-be-processed credential generated based on the attribute information of the session established between the client and the first server, the user identifier carried in the identity authentication request sent by the client to the first server, and the attribute information of the client.

In an embodiment of the present application, a connection request may refer to a connection request from a client to connect to a second server; in the event that a failure occurs in the first server providing services to the client, the client may send a connection request and a first credential to the second server, that is, the second server may receive the connection request and the first credential sent by the client in real time.

Step 202: When it is determined that the first server has a fault by using the detection technology, a connection is established with the client based on the connection request to provide services to the client.

In an embodiment of the present application, the second server can use a communication mechanism to detect whether the first server is faulty or alive, and when it is determined that the first server determines that the second server is faulty, the identity of the client is directly authenticated in the local machine (i.e., the second server), that is, the user can directly log in to the second server, and the second server continues to provide services to the client. In this way, when the client's access to the first server fails, causing the service to be unavailable, the client will automatically connect to the server that is still alive in the distributed system (i.e., the second server), and transmit the first credential to the surviving server during the connection process. If the first credential passes the security check of the surviving server, the user on the client goes online directly and establishes credentials on the surviving server. There is no need for the user to repeatedly perform identity authentication, thereby achieving seamless switching of sessions and continuous keep-alive within the distributed system, thereby improving the user experience.

It should be noted that when the surviving server (ie, the second server) receives the first credential, the faulty server (ie, the first server) that generated the first credential must be in a faulty state, otherwise the surviving server will not pass the security check of the first credential.

The information processing method provided in the embodiment of the present application, by receiving the first credential generated by the first server and sent by the client, does not rely on network bandwidth, instead of requiring synchronization of session information (i.e., credentials) between the servers of the distributed system as in the related art, thereby improving the efficiency of server switching. After receiving the first credential, since the first credential is the credential for exempting identity authentication when the client connects to the server again, the client can be directly connected based on the first credential without having to authenticate the client again, thereby not only improving the efficiency of server switching, but also improving the user experience.

Based on the above embodiments, the present application provides another information processing method. As shown in FIG. 3 , the method may include the following steps:

Step 301: The client sends an identity authentication request corresponding to the user and attribute information of the client to the first server in the distributed system.

Step 302: When the first server successfully authenticates the user based on the identity authentication request, the client sends a tunnel establishment request to the first server.

The tunnel establishment request is used to establish an information transmission channel between the client and the first server.

Step 303: When the client receives the consent information sent by the first server, it receives the first credential sent by the first server through the information transmission channel.

Among them, the consent information is generated by the first server based on the tunnel establishment request; the first credential is generated by the first server using a secret key to encrypt the first credential to be processed, and the secret key has the characteristic of periodically changing over time; the first credential to be processed is generated by the first server.

In the embodiment of the present application, the secret key may refer to a distributed cluster secret key, which may be specifically that when building a distributed system, all servers in the distributed system use the same algorithm and operator to produce a unified distributed cluster secret key; the first to-be-processed credential may be generated by the first server based on the attribute information of the session established between the client and the first server, the user identifier carried in the identity authentication request, and the attribute information of the client; after the first server passes the identity authentication of the user, the first server generates the first credential, and then the client can send a tunnel establishment request to the first server to establish an information transmission channel between the client and the first server, and then, if the first server agrees to establish the information transmission channel, the secret key is used to encrypt the to-be-processed credential to generate the first credential, and the first credential is sent to the client. It should be noted that the secret key has the characteristic of periodic changes over time, so the use of a changing secret key to encrypt the first credential can ensure the security of the information, and the first credential can be updated synchronously with the secret key, which can prevent seed forgery after the secret key is leaked to the greatest extent; in a feasible implementation method, the information transmission channel may refer to a Secure Sockets Layer (SSL) encrypted tunnel.

Step 304: The client uses the client's attribute information to encrypt the first credential to obtain a processed first credential.

Step 305: The client stores the processed first credential in a target storage space.

In the embodiment of the present application, the processed first credential may refer to the credential obtained by encrypting the first credential again using the client's attribute information; after the client receives the first credential sent by the first server and encrypts the first credential to be processed using a secret key, the first credential may be encrypted again using the client's attribute information to obtain the processed first credential, and the processed first credential is stored in the local database (i.e., the target storage space). In this way, through technical mechanisms such as randomly generated and out-of-band transmitted secret key encryption, information transmission channels, and client attribute information binding, the security and reliability of the entire process of first credential generation, encryption, transmission, storage, and use can be achieved.

Step 306: When the first server fails, the client uses the attribute information of the client to decrypt the processed first credential to obtain the first credential.

Step 307: The client sends a connection request and a first credential to a second server in the distributed system, so that the second server uses a secret key to decrypt the first credential to obtain a first credential to be processed.

In an embodiment of the present application, when a failure occurs in the first server, the client cannot connect to the first server. At this time, the server switching mechanism can be triggered to select the second server surviving in the distributed system to reconnect; specifically, the client can first use the client's attribute information to decrypt the processed first credential stored in the target storage space to obtain the first credential, and then send a connection request and the first credential to the second server. After the second server receives the first credential, it can use the secret key to decrypt the first credential to obtain the first credential to be processed.

Step 308: The second server receives the connection request and the first credential sent by the client.

The first credential is sent by the first server to the client, and the first credential refers to the credential that exempts the client from identity authentication when connecting to the server again.

It should be noted that after the first pending credential is encrypted twice, the second server receives the connection request sent by the client and the first credential obtained after decrypting the processed first credential stored by the client. Therefore, after the second server receives the first credential, it is also necessary to use the secret key to decrypt the first credential to obtain the first pending credential.

Step 309: When the second server determines that the first server has a fault by using the detection technology, the second server establishes a connection with the client based on the connection request and the first credential to provide services to the client.

It should be noted that steps 310 to 311 may be performed after step 309, and step 312 may also be performed after step 309;

Step 310: When the client establishes a connection with the second server, the second server uses the secret key to decrypt the first credential to obtain the first credential to be processed.

Step 311: The second server generates a second credential to be processed for the second server based on the first credential to be processed and the identifier of the second server.

In an embodiment of the present application, the second to-be-processed credential may refer to the credential generated by the second server; when the client establishes a connection with the second server, it means that the second server continues to provide services to the client. After that, the second server obtains the user identification and attribute information of the client, and regenerates new credentials (i.e., the second to-be-processed credential) in combination with the session online time on the second server and the identifier of the second server. The second to-be-processed credential may specifically include the user identification, attribute information, session online time, and the identifier of the second server.

It should be noted that, when the first credential sent by the client is received, the second server needs to first use the secret key to decrypt the first credential to obtain the first credential to be processed.

Step 312: When the second server uses detection technology to determine that the first server is alive, the second server sends a connection rejection message to the client.

The connection rejection message is generated based on the connection request.

In an embodiment of the present application, the communication mechanism detecting the survival of the first server may indicate a possible credential leakage. Therefore, when the detection technology is used to determine the survival of the first server, the second server directly rejects the client connection and determines whether the client has a credential leakage.

It should be noted that this application can be applied to distributed zero-trust systems or other distributed systems with identity verification, and zero trust refers to a security concept of "never trust, always verify", and develops a security framework of "identity-centric, continuous trust assessment, and dynamic access control". The mainstream technical implementations are software-defined perimeter (SDP), identity and access management (IAM) and micro-segmentation (MSG). The concept of "zero trust" in this application specifically refers to software-defined perimeter products; among them, SDP means that before accessing hidden assets, a trust connection needs to be established through single packet authorization (SPA), and the minimum authorization policy is used to implement user access control. It consists of three major components: SDP control center, proxy gateway (i.e., server) and SDP connection initiator host (i.e., client).

In other embodiments of the present application, the first credential is generated by the server and encrypted and stored on the client. Although the security is high, the usage scenarios are limited. Therefore, the present application can also adopt the local data storage structure and method supported by the browser to store the credentials in the browser, thereby eliminating the dependence on the client.

It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

The information processing method provided in the embodiment of the present application stores the first credential generated by the first server in the client, which is then sent by the client to the second server, instead of requiring synchronization of session information (i.e., credentials) between the servers of the distributed system as in the related art. It is independent of network bandwidth, thereby improving the efficiency of server switching. The first credential is stored in the client, instead of each server in the distributed system storing credentials synchronized from other servers as in the related art, thereby reducing the overhead of the server. After the second server receives the connection request and the first credential, it can directly connect to the client based on the first credential without authenticating the client again, thereby not only improving the efficiency of server switching but also improving the user experience.

Based on the foregoing embodiments, the embodiments of the present application provide a first information processing device, which can be applied to the information processing method provided in the embodiments corresponding to FIG. 1 and FIG. 3 . As shown in FIG. 4 , the first information processing device 4 may include: a first sending unit 41, a first processing unit 42, and a second sending unit 43, wherein:

A first sending unit 41 is used to send an identity authentication request corresponding to the user and attribute information of the client to a first server in the distributed system;

The first processing unit 42 is configured to receive the first credential for the first server sent by the first server when the identity authentication of the user based on the identity authentication request is successful, and store the processed first credential in the target storage space of the client; wherein the first credential refers to the credential for exempting the identity authentication when the client connects to the server again;

The second sending unit 43 is used to send a connection request and a first credential to a second server in the distributed system when the first server fails, so as to provide services to the client through the second server.

In other embodiments of the present application, the first processing unit 42 is further configured to perform the following steps:

Sending a tunnel establishment request to the first server; wherein the tunnel establishment request is used to establish an information transmission channel between the client and the first server;

Upon receiving the consent information sent by the first server, the first credential sent by the first server is received through the information transmission channel; wherein the consent information is generated by the first server based on the tunnel establishment request; the first credential is generated by the first server by encrypting the first to-be-processed credential using a secret key, and the secret key has the characteristic of periodically changing over time; the first to-be-processed credential is generated by the first server.

In other embodiments of the present application, the first processing unit 42 is further configured to perform the following steps:

The first credential is encrypted using the attribute information to obtain a processed first credential.

In other embodiments of the present application, the second sending unit 43 is further configured to perform the following steps:

Decrypting the processed first credential using the attribute information to obtain the first credential;

Send a connection request and a first credential to a second server in the distributed system, so that the second server uses a secret key to decrypt the first credential to obtain a first credential to be processed.

It should be noted that the specific implementation process of the steps executed by each module in the embodiment of the present application can refer to the implementation process in the information processing method provided in the embodiments corresponding to Figures 1 and 3, and will not be repeated here.

The first information processing device provided in the embodiment of the present application stores the first credential generated by the first server on the client, which is then sent by the client to the second server, instead of requiring synchronization of session information (i.e., credentials) between the servers of the distributed system as in the related art. It is independent of network bandwidth, thereby improving the efficiency of server switching, and stores the first credential on the client, instead of requiring each server in the distributed system to store credentials synchronized from other servers as in the related art, thereby reducing the overhead of the server.

Based on the foregoing embodiments, the embodiments of the present application provide a second information processing device, which can be applied to the information processing method provided in the embodiments corresponding to FIG. 2 and FIG. 3 . As shown in FIG. 5 , the second information processing device 5 may include: a receiving unit 51 and a second processing unit 52, wherein:

The receiving unit 51 is used to receive a connection request and a first credential sent by a client; wherein the first credential is sent by the first server to the client, and the first credential refers to a credential for exempting identity authentication when the client connects to the server again;

The second processing unit 52 is configured to establish a connection with the client based on the connection request and the first credential to provide services to the client when it is determined that the first server has a fault by using the detection technology.

In other embodiments of the present application, the second processing unit 52 is further configured to perform the following steps:

When the client establishes a connection with the second server, the first credential is decrypted using the secret key to obtain a first credential to be processed;

Based on the first pending credential and the identification of the second server, a second pending credential for the second server is generated.

In other embodiments of the present application, the second processing unit 52 is further configured to perform the following steps:

In the case of using the detection technology to determine that the first server is alive, sending a connection rejection message to the client; wherein the connection rejection message is generated based on the connection request.

It should be noted that the specific implementation process of the steps executed by each module in the embodiment of the present application can refer to the implementation process in the information processing method provided in the embodiments corresponding to Figures 2 and 3, and will not be repeated here.

The second information processing device provided in the embodiment of the present application improves the efficiency of server switching by receiving the first credential generated by the first server and sent by the client, instead of requiring synchronization of session information (i.e., credentials) between the servers of the distributed system as in the related art, and is independent of network bandwidth. After receiving the first credential, since the first credential is the credential for exempting identity authentication when the client connects to the server again, the client can be directly connected based on the first credential without having to authenticate the client again, thereby not only improving the efficiency of server switching but also improving the user experience.

Based on the foregoing embodiments, an embodiment of the present application provides a client, which can be applied to the information processing method provided in the embodiments corresponding to FIG. 1 and FIG. 3 . As shown in FIG. 6 , the client 6 may include: a first processor 61, a first memory 62, and a first communication bus 63, wherein:

The first communication bus 63 is used to realize the communication connection between the first processor 61 and the first memory 62;

The first processor 61 is used to execute the information processing program in the first memory 62 to implement the following steps:

Sending an identity authentication request corresponding to the user and attribute information of the client to a first server in the distributed system;

When the identity authentication of the user based on the identity authentication request is passed by the first server, a first credential for the first server is received and sent by the first server, and the processed first credential is stored in the target storage space of the client; wherein the first credential refers to a credential for exempting identity authentication when the client connects to the server again;

In the event of a failure of the first server, a connection request and a first credential are sent to a second server in the distributed system to provide services to the client through the second server.

In other embodiments of the present application, the first processor 61 is used to execute the information processing program in the first memory 62 to receive the first credential for the first server sent by the first server, so as to implement the following steps:

Sending a tunnel establishment request to the first server; wherein the tunnel establishment request is used to establish an information transmission channel between the client and the first server;

Upon receiving the consent information sent by the first server, the first credential sent by the first server is received through the information transmission channel; wherein the consent information is generated by the first server based on the tunnel establishment request; the first credential is generated by the first server by encrypting the first to-be-processed credential using a secret key, and the secret key has the characteristic of periodically changing over time; the first to-be-processed credential is generated by the first server.

In other embodiments of the present application, the first processor 61 is used to execute the information processing method of the information processing program in the first memory 62 to implement the following steps:

The first credential is encrypted using the attribute information to obtain a processed first credential.

In other embodiments of the present application, the first processor 61 is used to execute the information processing program in the first memory 62 to send a connection request and a first credential to a second server in the distributed system to implement the following steps:

Decrypting the processed first credential using the attribute information to obtain the first credential;

Send a connection request and a first credential to a second server in the distributed system, so that the second server uses a secret key to decrypt the first credential to obtain a first credential to be processed.

It should be noted that the specific description of the steps executed by the processor can refer to the implementation process in the information processing method provided in the embodiments corresponding to Figures 1 and 3, and will not be repeated here.

The client provided in the embodiment of the present application stores the first credential generated by the first server in the client, which is then sent by the client to the second server, instead of requiring synchronization of session information (i.e., credentials) between the servers of the distributed system as in the related art. It is not dependent on network bandwidth, thereby improving the efficiency of server switching, and stores the first credential in the client, instead of requiring each server in the distributed system to store credentials synchronized from other servers as in the related art, thereby reducing the overhead of the server.

Based on the foregoing embodiments, an embodiment of the present application provides a second server, which can be applied to the information processing method provided in the embodiments corresponding to FIG. 2 and FIG. 3 . As shown in FIG. 7 , the second server may include: a second processor 71, a second memory 72, and a second communication bus 73, wherein:

The second communication bus 73 is used to realize the communication connection between the second processor 71 and the second memory 72;

The second processor 71 is used to execute the information processing program in the second memory 72 to implement the following steps:

Receive a connection request and a first credential sent by a client; wherein the first credential is sent by the first server to the client, and the first credential refers to a credential for exempting identity authentication when the client connects to the server again;

In the case where it is determined by using the detection technology that the first server has a fault, a connection is established with the client based on the connection request and the first credential to provide services to the client.

In other embodiments of the present application, the second processor 71 is used to execute the information processing method of the information processing program in the second memory 72 to implement the following steps:

When the client establishes a connection with the second server, the first credential is decrypted using the secret key to obtain a first credential to be processed;

Based on the first pending credential and the identification of the second server, a second pending credential for the second server is generated.

In other embodiments of the present application, the second processor 71 is used to execute the information processing method of the information processing program in the second memory 72 to implement the following steps:

In the case of using the detection technology to determine that the first server is alive, sending a connection rejection message to the client; wherein the connection rejection message is generated based on the connection request.

It should be noted that the specific description of the steps executed by the processor can refer to the implementation process in the information processing method provided in the embodiments corresponding to Figures 2 and 3, and will not be repeated here.

The second server provided in the embodiment of the present application receives the first credential generated by the first server and sent by the client, instead of requiring synchronization of session information (i.e., credentials) between the servers of the distributed system as in the related art, and does not rely on network bandwidth, thereby improving the efficiency of server switching. After receiving the first credential, since the first credential is the credential for exempting identity authentication when the client connects to the server again, the second server can directly connect to the client based on the first credential without having to authenticate the client again, thereby not only improving the efficiency of server switching, but also improving the user experience.

Based on the foregoing embodiments, an embodiment of the present application provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps in the information processing method provided in the embodiments corresponding to Figures 1, 2 and 3.

It should be noted that the computer-readable storage medium may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EPROM), or a

The invention relates to a memory device including an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Ferromagnetic Random Access Memory (FRAM), a Flash Memory, a magnetic surface memory, an optical disc, or a Compact Disc Read-Only Memory (CD-ROM); or various electronic devices including one or any combination of the above memories, such as a mobile phone, a computer, a tablet device, a personal digital assistant, etc.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

The present application is described with reference to the flowchart and/or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and/or box in the flowchart and/or block diagram, and the combination of the process and/or box in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims (12)

1. An information processing method, applied to a client, comprising:

Sending an identity authentication request corresponding to a user and attribute information of a client to a first server in a distributed system;

Receiving a first credential sent by the first server for the first server under the condition that the identity authentication of the user passes based on the identity authentication request through the first server, and storing the processed first credential to a target storage space of the client; wherein, the first credential refers to a credential exempted from identity authentication when the client connects to the server again;

And in the case that the first server has a fault, sending a connection request and the first certificate to a second server in the distributed system so as to provide services to the client through the second server.

2. The method of claim 1, wherein the receiving the first credential sent by the first server for the first server comprises:

Sending a tunnel establishment request to the first server; the tunnel establishment request is used for establishing an information transmission channel between the client and the first server;

Receiving a first credential sent by the first server through the information transmission channel under the condition of receiving the consent information sent by the first server; wherein the consent information is generated by the first server based on the tunnel establishment request; the first credential is generated by encrypting a first credential to be processed by the first server by adopting a secret key, and the secret key has the characteristic of periodically changing along with time; the first to-be-processed credential is generated by the first server.

3. The method of claim 2, wherein after receiving the first credential sent by the first server via the information transmission channel, further comprising:

And encrypting the first credential by adopting the attribute information to obtain the processed first credential.

4. The method of claim 3, wherein the sending the connection request and the first credential to a second server in the distributed system comprises:

Decrypting the processed first credential by adopting the attribute information to obtain the first credential;

And sending a connection request and the first credential to a second server in the distributed system, so that the second server adopts the secret key to decrypt the first credential to obtain the first credential to be processed.

5. An information processing method, applied to a second server, comprising:

Receiving a connection request and a first credential sent by a client; wherein the first credential is sent to the client by a first server, and the first credential refers to a credential exempted from identity authentication when the client connects to the server again;

In the event that a failure of the first server is determined using a probing technique, a connection is established with the client based on the connection request and the first credential to provide a service to the client.

6. The method of claim 5, wherein after establishing a connection with the client based on the connection request to provide a service to the client, further comprising:

under the condition that the client side and the second server are connected, decrypting the first credential by adopting a secret key to obtain a first credential to be processed;

Generating a second credential to be processed for the second server based on the first credential to be processed and the identity of the second server.

7. The method of claim 5, wherein the method further comprises:

Transmitting a connection rejection message to the client under the condition that the first server is determined to survive by adopting the detection technology; wherein the reject connection message is generated based on the connection request.

8. A first information processing apparatus, characterized in that the apparatus comprises:

The first sending unit is used for sending an identity authentication request corresponding to the user and attribute information of the client to a first server in the distributed system;

The first processing unit is used for receiving first credentials sent by the first server for the first server and storing the processed first credentials to a target storage space of the client under the condition that the identity authentication of the user based on the identity authentication request passes through the first server; wherein, the first credential refers to a credential exempted from identity authentication when the client connects to the server again;

and the second sending unit is used for sending a connection request and the first certificate to a second server in the distributed system under the condition that the first server fails so as to provide services for the client through the second server.

9. A second information processing apparatus, characterized in that the apparatus comprises:

The receiving unit is used for receiving the connection request and the first certificate sent by the client; wherein the first credential is sent to the client by the first server, and the first credential refers to a credential exempted from identity authentication when the client is connected to the server again;

And the second processing unit is used for establishing connection with the client based on the connection request so as to provide services for the client under the condition that the first server is determined to have faults by adopting a detection technology.

10. A client, characterized in that, the client comprises: a first processor, a first memory, and a first communication bus;

The first communication bus is used for realizing communication connection between the first processor and the first memory;

The first processor is configured to execute an information processing program stored in the first memory to realize the steps of the information processing method according to claims 1 to 4.

11. A second server is characterized in that, the second server includes: a second processor, a second memory, and a second communication bus;

The second communication bus is used for realizing communication connection between the second processor and the second memory;

the second processor is configured to execute an information processing program stored in the second memory to implement the steps of the information processing method according to claims 5 to 7.

12. A computer-readable storage medium storing one or more programs executable by one or more processors to implement the steps of the information processing method of claims 1-4 or 5-7.