Providing high availability computing service by issuing a certificate
This disclosure relates to providing a high availability computing service in a distributed system. In one aspect, a method includes sending, by a computing unit of multiple computing units that are each executing a respective copy of a computing task, a certificate request to a trusted certificate generator. The request includes authentication information. The authentication information includes a code hash of the computing task. The computing unit receives a certificate report including a public key certificate in a certificate chain generated for the code hash and a private key corresponding to the public key certificate. The public key certificate and the private key form a certificate pair. The certificate chain includes multiple certificates including the public key certificate and a root certificate corresponding to the public key certificate. The computing unit is used as a TLS server. The certificate pair is set as a certificate pair of the TLS server.
1. A computer-implemented method, comprising:
sending, by a user terminal, a certificate request to a trusted certificate generator, wherein the certificate request comprises a first code hash of a computing task;
receiving, by the user terminal, a certificate report from the trusted certificate generator, wherein the certificate report comprises a first root certificate in a certificate chain generated for the first code hash, wherein the certificate chain comprises a first public key certificate corresponding to the first root certificate, wherein the first public key certificate and a matched first private key form a first certificate pair, and wherein the first certificate pair is pre-distributed to one or more authenticated computing units running the computing task;
using the user terminal as a transport layer security (TLS) client;
setting the first root certificate as a trusted root certificate of the TLS client to communicate with the one or more authenticated computing units that have the first certificate pair and that functions as a TLS server; and
obtaining a computing service corresponding to the computing task from the one or more authenticated computing units.
2. The computer-implemented method of claim 1 , further comprising, before sending the certificate request to the trusted certificate generator:
obtaining authentication information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information.
3. The computer-implemented method of claim 2 , wherein:
the authentication information is an authentication result file authenticated by a third-party authentication institution, and the authentication result file comprises signature information of the third-party authentication institution; and
performing authentication on the trusted certificate generator based on the authentication information comprises verifying the signature information, and in response to the signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.
4. The computer-implemented method of claim 2 , wherein:
the authentication information is a report file generated by the trusted certificate generator, and the report file comprises a second code hash and signature information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information comprises,
sending the report file to a third-party authentication institution to obtain an authentication result file, wherein the authentication result file comprises additional signature information of the third-party authentication institution, and
verifying the additional signature information, and in response to the additional signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.
5. The computer-implemented method of claim 1 , further comprising, after setting the first root certificate as a trusted root certificate of the TLS client:
performing a TLS handshake with the one or more authenticated computing units to establish a trusted TLS channel; and
obtaining the computing service corresponding to the computing task from the one or more authenticated computing units through the trusted TLS channel.
6. The computer-implemented method of claim 5 , wherein obtaining the computing service corresponding to the computing task from the one or more authenticated computing units comprises connecting to at least one computing unit of the one or more authenticated computing units based on a routing path determined by a routing server based on load balancing of the one or more authenticated computing units, thereby obtaining the computing service corresponding to the computing task from the at least one computing unit.
7. The computer-implemented method of claim 1 , further comprising:
determining that a first authenticated computing unit of the one or more authenticated computing units has failed; and
switching to a second authenticated computing unit of the one or more authenticated computing units.
8. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
sending, by a user terminal, a certificate request to a trusted certificate generator, wherein the certificate request comprises a first code hash of a computing task;
receiving, by the user terminal, a certificate report from the trusted certificate generator, wherein the certificate report comprises a first root certificate in a certificate chain generated for the first code hash, wherein the certificate chain comprises a first public key certificate corresponding to the first root certificate, wherein the first public key certificate and a matched first private key form a first certificate pair, and wherein the first certificate pair is pre-distributed to one or more authenticated computing units running the computing task;
using the user terminal as a transport layer security (TLS) client;
setting the first root certificate as a trusted root certificate of the TLS client to communicate with the one or more authenticated computing units that have the first certificate pair and that functions as a TLS server; and
obtaining a computing service corresponding to the computing task from the one or more authenticated computing units.
9. The non-transitory, computer-readable medium of claim 8 , wherein the operations comprise, before sending the certificate request to the trusted certificate generator:
obtaining authentication information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information.
10. The non-transitory, computer-readable medium of claim 9 , wherein:
the authentication information is an authentication result file authenticated by a third-party authentication institution, and the authentication result file comprises signature information of the third-party authentication institution; and
performing authentication on the trusted certificate generator based on the authentication information comprises verifying the signature information, and in response to the signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.
11. The non-transitory, computer-readable medium of claim 9 , wherein:
the authentication information is a report file generated by the trusted certificate generator, and the report file comprises a second code hash and signature information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information comprises,
sending the report file to a third-party authentication institution to obtain an authentication result file, wherein the authentication result file comprises additional signature information of the third-party authentication institution, and
verifying the additional signature information, and in response to the additional signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.
12. The non-transitory, computer-readable medium of claim 8 , wherein the operations comprise, after setting the first root certificate as a trusted root certificate of the TLS client:
performing a TLS handshake with the one or more authenticated computing units to establish a trusted TLS channel; and
obtaining the computing service corresponding to the computing task from the one or more authenticated computing units through the trusted TLS channel.
13. The non-transitory, computer-readable medium of claim 12 , wherein obtaining the computing service corresponding to the computing task from the one or more authenticated computing units comprises connecting to at least one computing unit of the one or more authenticated computing units based on a routing path determined by a routing server based on load balancing of the one or more authenticated computing units, thereby obtaining the computing service corresponding to the computing task from the at least one computing unit.
14. The non-transitory, computer-readable medium of claim 8 , wherein the operations comprise:
determining that a first authenticated computing unit of the one or more authenticated computing units has failed; and
switching to a second authenticated computing unit of the one or more authenticated computing units.
15. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
sending, by a user terminal, a certificate request to a trusted certificate generator, wherein the certificate request comprises a first code hash of a computing task;
receiving, by the user terminal, a certificate report from the trusted certificate generator, wherein the certificate report comprises a first root certificate in a certificate chain generated for the first code hash, wherein the certificate chain comprises a first public key certificate corresponding to the first root certificate, wherein the first public key certificate and a matched first private key form a first certificate pair, and wherein the first certificate pair is pre-distributed to one or more authenticated computing units running the computing task;
using the user terminal as a transport layer security (TLS) client;
setting the first root certificate as a trusted root certificate of the TLS client to communicate with the one or more authenticated computing units that have the first certificate pair and that functions as a TLS server; and
obtaining a computing service corresponding to the computing task from the one or more authenticated computing units.
16. The computer-implemented system of claim 15 , wherein the operations comprise, before sending the certificate request to the trusted certificate generator:
obtaining authentication information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information.
17. The computer-implemented system of claim 16 , wherein:
the authentication information is an authentication result file authenticated by a third-party authentication institution, and the authentication result file comprises signature information of the third-party authentication institution; and
performing authentication on the trusted certificate generator based on the authentication information comprises verifying the signature information, and in response to the signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.
18. The computer-implemented system of claim 16 , wherein:
the authentication information is a report file generated by the trusted certificate generator, and the report file comprises a second code hash and signature information of the trusted certificate generator; and
performing authentication on the trusted certificate generator based on the authentication information comprises,
sending the report file to a third-party authentication institution to obtain an authentication result file, wherein the authentication result file comprises additional signature information of the third-party authentication institution, and
verifying the additional signature information, and in response to the additional signature information being verified successfully, determining that the authentication on the trusted certificate generator succeeds.
19. The computer-implemented system of claim 15 , wherein the operations comprise, after setting the first root certificate as a trusted root certificate of the TLS client:
performing a TLS handshake with the one or more authenticated computing units to establish a trusted TLS channel; and
obtaining the computing service corresponding to the computing task from the one or more authenticated computing units through the trusted TLS channel.
20. The computer-implemented system of claim 19 , wherein obtaining the computing service corresponding to the computing task from the one or more authenticated computing units comprises connecting to at least one computing unit of the one or more authenticated computing units based on a routing path determined by a routing server based on load balancing of the one or more authenticated computing units, thereby obtaining the computing service corresponding to the computing task from the at least one computing unit.
21. The computer-implemented system of claim 15 , wherein the operations comprise:
determining that a first authenticated computing unit of the one or more authenticated computing units has failed; and
switching to a second authenticated computing unit of the one or more authenticated computing units.