RanchiMall/exchangemarket
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improved sink-key management

Browse Source 
- multiple sink keys supported
- sink keys are split and shared among nodes (master and slaves)
- when a key is required, master collects the shares from slaves and reconstructs. (key is removed from memory after usage)
This commit is contained in:
sairajzero 2022-09-25 01:06:08 +05:30
parent 60a574a905
commit 65f7a5d94e
3 changed files with 130 additions and 129 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/_constants.js
View File

@ -27,7 +27,6 @@ module.exports = {
backup: { backup: {
SHARE_THRESHOLD: 50 / 100, //50% SHARE_THRESHOLD: 50 / 100, //50%
HASH_N_ROW: 100, HASH_N_ROW: 100,
SINK_KEY_INDICATOR: '$$$',
BACKUP_INTERVAL: 5 * 60 * 1000, //5 min BACKUP_INTERVAL: 5 * 60 * 1000, //5 min
BACKUP_SYNC_TIMEOUT: 10 * 60 * 1000, //10 mins BACKUP_SYNC_TIMEOUT: 10 * 60 * 1000, //10 mins
CHECKSUM_INTERVAL: 100, //times of BACKUP_INTERVAL CHECKSUM_INTERVAL: 100, //times of BACKUP_INTERVAL

206
src/backup/head.js
View File

@ -6,39 +6,39 @@ const sync = require('./sync');
const WebSocket = require('ws'); const WebSocket = require('ws');
const { const {
SINK_KEY_INDICATOR,
SHARE_THRESHOLD SHARE_THRESHOLD
} = require("../_constants")["backup"]; } = require("../_constants")["backup"];
var DB, app, wss, tokenList; //Container for database and app var DB, app, wss, tokenList; //Container for database and app
var nodeList, nodeURL, nodeKBucket; //Container for (backup) node list var nodeList, nodeURL, nodeKBucket; //Container for (backup) node list
var nodeShares = null, const connectedSlaves = {},
connectedSlaves = {}, shares_collected = {},
mod = null; shares_pending = {};
var _mode = null;
const SLAVE_MODE = 0, const SLAVE_MODE = 0,
MASTER_MODE = 1; MASTER_MODE = 1;
const sinkList = {};
//Shares //Shares
function generateShares(sinkKey) { function generateShares(sinkKey) {
let nextNodes = nodeKBucket.nextNode(global.myFloID, null), let nextNodes = nodeKBucket.nextNode(global.myFloID, null),
aliveNodes = Object.keys(connectedSlaves); aliveNodes = Object.keys(connectedSlaves);
if (nextNodes.length == 0) //This is the last node in nodeList nextNodes.unshift(global.myFloID);
return false; aliveNodes.unshift(global.myFloID);
else if (aliveNodes.length == 0) //This is the last node in nodeList let N = nextNodes.length + 1,
return null; th = Math.ceil(aliveNodes.length * SHARE_THRESHOLD) + 1,
else { shares, refShare, mappedShares = {};
let N = nextNodes.length + 1, shares = floCrypto.createShamirsSecretShares(sinkKey, N, th);
th = Math.ceil(aliveNodes.length * SHARE_THRESHOLD) + 1, refShare = shares.pop();
shares, refShare, mappedShares = {}; for (let i in nextNodes)
shares = floCrypto.createShamirsSecretShares(sinkKey, N, th); mappedShares[nextNodes[i]] = [refShare, shares[i]].join("|");
refShare = shares.pop(); return mappedShares;
for (let i in nextNodes)
mappedShares[nextNodes[i]] = [refShare, shares[i]].join("|");
return mappedShares;
}
} }
function sendShare(ws, sinkID, keyShare) { function sendShare(ws, sinkID, keyShare) {
if (shares_pending[sinkID][ws.floID] === keyShare) //this should always be true unless there is an error
delete shares_pending[sinkID][ws.floID]; //delete the share after sending it to respective slave
ws.send(JSON.stringify({ ws.send(JSON.stringify({
command: "SINK_SHARE", command: "SINK_SHARE",
sinkID, sinkID,
@ -47,19 +47,23 @@ function sendShare(ws, sinkID, keyShare) {
} }
function sendSharesToNodes(sinkID, shares) { function sendSharesToNodes(sinkID, shares) {
nodeShares = shares; shares_pending[sinkID] = shares;
for (let node in shares) for (let node in shares)
if (node in connectedSlaves) if (node in connectedSlaves)
sendShare(connectedSlaves[node], sinkID, shares[node]); sendShare(connectedSlaves[node], sinkID, shares[node]);
if (global.myFloID in shares) {
slave.storeShare(sinkID, shares[global.myFloID], false);
delete shares_pending[sinkID][global.myFloID];
}
sinkList[sinkID] = Date.now();
} }
function storeSink(sinkID, sinkPrivKey) { function requestShare(ws, sinkID) {
global.sinkID = sinkID; ws.send(JSON.stringify({
global.sinkPrivKey = sinkPrivKey; command: "SEND_SHARE",
let encryptedKey = Crypto.AES.encrypt(SINK_KEY_INDICATOR + sinkPrivKey, global.myPrivKey); sinkID: sinkID,
DB.query('INSERT INTO sinkShares (floID, share) VALUE (?, ?) ON DUPLICATE KEY UPDATE share=?', [sinkID, encryptedKey, encryptedKey]) pubKey: global.myPubKey
.then(_ => console.log('SinkID:', sinkID, '|SinkEnKey:', encryptedKey)) }));
.catch(error => console.error(error));
} }
/* /*
@ -97,42 +101,42 @@ function transferMoneyToNewSink(oldSinkID, oldSinkKey, newSink) {
} }
*/ */
const collectShares = {}; function collectAndCall(sinkID, callback) {
collectShares.retrive = function(floID, sinkID, share) { if (!(callback instanceof Function))
const self = this; throw Error("callback should be a function");
if (!self.sinkID) { if (sinkID in shares_collected) //if there is already a collect for sinkID, then just add the callback to queue
self.sinkID = sinkID; return shares_collected[sinkID].callbacks.push(callback);
self.shares = {};
} else if (self.sinkID !== sinkID) shares_collected[sinkID] = {
return console.error("Something is wrong! Slaves are sending different sinkID"); callbacks: [callback],
if (share.startsWith(SINK_KEY_INDICATOR)) { shares: {}
let sinkKey = share.substring(SINK_KEY_INDICATOR.length); };
console.debug("Received sink:", sinkID); for (let floID in connectedSlaves)
self.verify(sinkKey); requestShare(connectedSlaves[floID], sinkID);
} else DB.query("SELECT share FROM sinkShares WHERE floID=?", [sinkID]).then(result => {
self.shares[floID] = share.split("|"); if (result.length)
collectShares(myFloID, sinkID, Crypto.AES.decrypt(result[0].share, global.myPrivKey))
}).catch(error => console.error(error))
}
function collectShares(floID, sinkID, share) {
if (_mode !== MASTER_MODE)
return console.warn("Not serving as master");
if (!(sinkID in shares_collected))
return console.error("Something is wrong! Slaves are sending sinkID thats not been collected");
shares_collected[sinkID].shares[floID] = share.split("|");
try { try {
let sinkKey = floCrypto.retrieveShamirSecret([].concat(...Object.values(self.shares))); let sinkKey = floCrypto.retrieveShamirSecret([].concat(...Object.values(shares_collected[sinkID].shares)));
console.debug("Retrived sink:", sinkID); if (floCrypto.verifyPrivKey(sinkKey, sinkID)) {
self.verify(sinkKey); console.log("Shares collected successfully for", sinkID);
shares_collected[sinkID].callbacks.map(fn => fn(sinkKey));
delete shares_collected[sinkID];
}
} catch { } catch {
//Unable to retrive sink private key. Waiting for more shares! Do nothing for now //Unable to retrive sink private key. Waiting for more shares! Do nothing for now
}; };
} }
collectShares.verify = function(sinkKey) {
const self = this;
if (floCrypto.verifyPrivKey(sinkKey, self.sinkID)) {
let sinkID = self.sinkID;
console.log("Shares collected successfully for", sinkID);
self.active = false;
delete self.sinkID;
delete self.shares;
storeSink(sinkID, sinkKey);
sendSharesToNodes(sinkID, generateShares(sinkKey));
}
}
function connectWS(floID) { function connectWS(floID) {
let url = nodeURL[floID]; let url = nodeURL[floID];
return new Promise((resolve, reject) => { return new Promise((resolve, reject) => {
@ -165,7 +169,7 @@ function connectToMaster(i = 0, init = false) {
function serveAsMaster(init) { function serveAsMaster(init) {
console.debug('Starting master process'); console.debug('Starting master process');
slave.stop(); slave.stop();
mod = MASTER_MODE; _mode = MASTER_MODE;
informLiveNodes(init); informLiveNodes(init);
app.resume(); app.resume();
} }
@ -174,7 +178,7 @@ function serveAsSlave(ws, init) {
console.debug('Starting slave process'); console.debug('Starting slave process');
app.pause(); app.pause();
slave.start(ws, init); slave.start(ws, init);
mod = SLAVE_MODE; _mode = SLAVE_MODE;
} }
function informLiveNodes(init) { function informLiveNodes(init) {
@ -199,40 +203,15 @@ function informLiveNodes(init) {
console.warn(`Node(${nodes[i]}) is offline`); console.warn(`Node(${nodes[i]}) is offline`);
if (init && flag) if (init && flag)
syncRequest(); syncRequest();
//Check if sinkKey or share available in DB DB.query("SELECT floID, share FROM sinkShares ORDER BY time_stored DESC").then(result => {
DB.query("SELECT floID, share FROM sinkShares ORDER BY time_stored DESC LIMIT 1").then(result => { if (result.length)
if (result.length) { result.forEach(r => reconstructShares(r.floID));
let share = Crypto.AES.decrypt(result[0].share, global.myPrivKey); else if (!flag) {
if (share.startsWith(SINK_KEY_INDICATOR)) { console.log("Starting the exchange...");
//sinkKey is already present in DB, use it directly let newSink = floCrypto.generateNewID();
collectShares.active = false; console.debug("Generated sink:", newSink.floID, newSink.privKey);
global.sinkPrivKey = share.substring(SINK_KEY_INDICATOR.length); sendSharesToNodes(newSink.floID, generateShares(newSink.privKey));
global.sinkID = floCrypto.getFloID(global.sinkPrivKey); }
if (global.sinkID != result[0].floID) {
console.warn("sinkID and sinkKey in DB are not pair!");
storeSink(global.sinkID, global.sinkPrivKey);
}
console.debug("Loaded sink:", global.sinkID);
sendSharesToNodes(global.sinkID, generateShares(global.sinkPrivKey))
} else {
//Share is present in DB, try to collect remaining shares and retrive sinkKey
collectShares.active = true;
collectShares.retrive(global.myFloID, result[0].floID, share);
}
} else if (init) {
if (flag) //Other nodes online, try to collect shares and retrive sinkKey
collectShares.active = true;
else {
//No other node is active (possible 1st node to start exchange)
console.log("Starting the exchange...");
collectShares.active = false;
let newSink = floCrypto.generateNewID();
console.debug("Generated sink:", newSink.floID, newSink.privKey);
storeSink(newSink.floID, newSink.privKey);
sendSharesToNodes(newSink.floID, generateShares(newSink.privKey));
}
} else //This should not happen!
console.error("Something is wrong! Node is not starting and no key/share present in DB");
}).catch(error => console.error(error)); }).catch(error => console.error(error));
}); });
} }
@ -248,25 +227,42 @@ function syncRequest(cur = global.myFloID) {
} }
function updateMaster(floID) { function updateMaster(floID) {
let currentMaster = mod === MASTER_MODE ? global.myFloID : slave.masterWS.floID; let currentMaster = _mode === MASTER_MODE ? global.myFloID : slave.masterWS.floID;
if (nodeList.indexOf(floID) < nodeList.indexOf(currentMaster)) if (nodeList.indexOf(floID) < nodeList.indexOf(currentMaster))
connectToMaster(); connectToMaster();
} }
function slaveConnect(floID, pubKey, ws) { function reconstructShares(sinkID) {
if (_mode !== MASTER_MODE)
return console.warn("Not serving as master");
sinkList[sinkID] = null;
collectAndCall(sinkID, sinkKey => sendSharesToNodes(sinkID, generateShares(sinkKey)));
}
function slaveConnect(floID, pubKey, ws, sinks) {
if (_mode !== MASTER_MODE)
return console.warn("Not serving as master");
ws.floID = floID; ws.floID = floID;
ws.pubKey = pubKey; ws.pubKey = pubKey;
connectedSlaves[floID] = ws; connectedSlaves[floID] = ws;
if (collectShares.active)
ws.send(JSON.stringify({ //Send shares if need to be delivered
command: "SEND_SHARE", for (let sinkID in shares_pending)
pubKey: global.myPubKey if (floID in shares_pending[sinkID])
})); sendShare(ws, sinkID, shares_pending[floID]);
else if (nodeShares === null || //The 1st backup is connected //Request shares if any
Object.keys(connectedSlaves).length < Math.pow(SHARE_THRESHOLD, 2) * Object.keys(nodeShares).length) //re-calib shares for better for (let sinkID in shares_collected)
requestShare(ws, sinkID); //if (!(floID in shares_collected[sinkID].shares))
//check if sinks in slaves are present
if (Array.isArray(sinks))
for (let sinkID of sinks)
if (!(sinkID in sinkList))
reconstructShares(sinkID);
/*
if (shares_pending === null || //The 1st backup is connected
Object.keys(connectedSlaves).length < Math.pow(SHARE_THRESHOLD, 2) * Object.keys(shares_pending).length) //re-calib shares for better
sendSharesToNodes(global.sinkID, generateShares(global.sinkPrivKey)) sendSharesToNodes(global.sinkID, generateShares(global.sinkPrivKey))
else if (nodeShares[floID]) */
sendShare(ws, global.sinkID, nodeShares[floID]);
} }
//Transmistter //Transmistter
@ -302,10 +298,10 @@ function startBackupTransmitter(server) {
updateMaster(request.floID); updateMaster(request.floID);
break; break;
case "SLAVE_CONNECT": case "SLAVE_CONNECT":
slaveConnect(request.floID, request.pubKey, ws); slaveConnect(request.floID, request.pubKey, ws, request.sinks);
break; break;
case "SINK_SHARE": case "SINK_SHARE":
collectShares.retrive(request.floID, request.sinkID, floCrypto.decryptData(request.share, global.myPrivKey)) collectShares(request.floID, request.sinkID, floCrypto.decryptData(request.share, global.myPrivKey))
default: default:
invalid = "Invalid Request Type"; invalid = "Invalid Request Type";
} }

52
src/backup/slave.js
View File

@ -4,7 +4,6 @@ const {
BACKUP_INTERVAL, BACKUP_INTERVAL,
BACKUP_SYNC_TIMEOUT, BACKUP_SYNC_TIMEOUT,
CHECKSUM_INTERVAL, CHECKSUM_INTERVAL,
SINK_KEY_INDICATOR,
HASH_N_ROW HASH_N_ROW
} = require("../_constants")["backup"]; } = require("../_constants")["backup"];
@ -20,19 +19,25 @@ function startSlaveProcess(ws, init) {
//set masterWS //set masterWS
ws.on('message', processDataFromMaster); ws.on('message', processDataFromMaster);
masterWS = ws; masterWS = ws;
//inform master let sinks_stored = [];
let message = { DB.query("SELECT floID FROM sinkShares").then(result => {
floID: global.myFloID, sinks_stored = result.map(r => r.floID);
pubKey: global.myPubKey, }).catch(error => console.error(error)).finally(_ => {
req_time: Date.now(), //inform master
type: "SLAVE_CONNECT" let message = {
} floID: global.myFloID,
message.sign = floCrypto.signData(message.type + "|" + message.req_time, global.myPrivKey); pubKey: global.myPubKey,
ws.send(JSON.stringify(message)); sinks: sinks_stored,
//start sync req_time: Date.now(),
if (init) type: "SLAVE_CONNECT"
requestInstance.open(); }
intervalID = setInterval(() => requestInstance.open(), BACKUP_INTERVAL); message.sign = floCrypto.signData(message.type + "|" + message.req_time, global.myPrivKey);
ws.send(JSON.stringify(message));
//start sync
if (init)
requestInstance.open();
intervalID = setInterval(() => requestInstance.open(), BACKUP_INTERVAL);
})
} }
function stopSlaveProcess() { function stopSlaveProcess() {
@ -131,7 +136,7 @@ function processDataFromMaster(message) {
storeSinkShare(message.sinkID, message.keyShare); storeSinkShare(message.sinkID, message.keyShare);
break; break;
case "SEND_SHARE": case "SEND_SHARE":
sendSinkShare(message.pubKey); sendSinkShare(message.sinkID, message.pubKey);
break; break;
case "REQUEST_ERROR": case "REQUEST_ERROR":
console.log(message.error); console.log(message.error);
@ -144,23 +149,23 @@ function processDataFromMaster(message) {
} }
} }
function storeSinkShare(sinkID, keyShare) { function storeSinkShare(sinkID, keyShare, decrypt = true) {
let encryptedShare = Crypto.AES.encrypt(floCrypto.decryptData(keyShare, global.myPrivKey), global.myPrivKey); if (decrypt)
keyShare = floCrypto.decryptData(keyShare, global.myPrivKey)
let encryptedShare = Crypto.AES.encrypt(keyShare, global.myPrivKey);
console.log(Date.now(), '|sinkID:', sinkID, '|EnShare:', encryptedShare); console.log(Date.now(), '|sinkID:', sinkID, '|EnShare:', encryptedShare);
DB.query("INSERT INTO sinkShares (floID, share) VALUE (?, ?) ON DUPLICATE KEY UPDATE share=?", [sinkID, encryptedShare, encryptedShare]) DB.query("INSERT INTO sinkShares (floID, share) VALUE (?, ?) ON DUPLICATE KEY UPDATE share=?", [sinkID, encryptedShare, encryptedShare])
.then(_ => null).catch(error => console.error(error)); .then(_ => null).catch(error => console.error(error));
} }
function sendSinkShare(pubKey) { function sendSinkShare(sinkID, pubKey) {
DB.query("SELECT floID, share FROM sinkShares ORDER BY time_stored DESC LIMIT 1").then(result => { DB.query("SELECT share FROM sinkShares WHERE floID=?", [sinkID]).then(result => {
if (!result.length) if (!result.length)
return console.warn("No key-shares in DB!"); return console.warn(`key-shares for ${sinkID} not found in DB!`);
let share = Crypto.AES.decrypt(result[0].share, global.myPrivKey); let share = Crypto.AES.decrypt(result[0].share, global.myPrivKey);
if (share.startsWith(SINK_KEY_INDICATOR))
console.warn("Key is stored instead of share!");
let response = { let response = {
type: "SINK_SHARE", type: "SINK_SHARE",
sinkID: result[0].floID, sinkID: sinkID,
share: floCrypto.encryptData(share, pubKey), share: floCrypto.encryptData(share, pubKey),
floID: global.myFloID, floID: global.myFloID,
pubKey: global.myPubKey, pubKey: global.myPubKey,
@ -425,5 +430,6 @@ module.exports = {
}, },
start: startSlaveProcess, start: startSlaveProcess,
stop: stopSlaveProcess, stop: stopSlaveProcess,
storeShare: storeSinkShare,
syncRequest: ws => requestInstance.open(ws) syncRequest: ws => requestInstance.open(ws)
} }