Resource allocation method of virtual cipher machine and cloud server
By acquiring the resource specifications and hardware resource mapping relationships of the virtual cryptographic machine, memory, processing resources, and encryption cards are dynamically allocated, solving the problem of inflexible resource allocation in cloud server cryptographic machines and improving resource utilization and performance stability.
Patent Information
- Application Number
- CN202511591126.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-03
- Publication Date
- 2026-01-16
AI Technical Summary
In existing cloud server cryptographic machines, the one-to-one fixed mapping mode between physical cryptographic cards and virtual cryptographic machines leads to inflexible resource allocation. When there is a high demand for computing, low-performance virtual cryptographic machines cannot be upgraded, while high-performance cryptographic machines suffer from serious resource waste and low resource utilization.
By acquiring the resource specifications and hardware resource mapping relationships of the virtual cryptographic machine, memory, processing resources, and encryption cards are dynamically allocated to achieve precise matching and isolation of virtual cryptographic machine resources, including memory resource quantization, processing core scheduling, and encryption channel allocation.
It improves the performance stability and resource utilization efficiency of cryptographic services in the cloud environment, solves the problems of resource contention and low utilization, and realizes dynamic scheduling and precise matching of resources.
Smart Images
Figure CN121349699A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security technology, and more specifically, to a resource allocation method for a virtual cryptographic machine and a cloud server. Background Technology
[0002] A cloud server cryptographic machine is a cryptographic security device specifically designed for virtualized environments. This device integrates a cryptographic operation core at the physical hardware level and builds multiple virtual cryptographic machines at the virtualization layer. It provides basic cryptographic operation services such as encryption and decryption, digital signature, and key generation for various information systems in the cloud platform, and is one of the core components for building a cloud environment security protection system.
[0003] However, in existing cloud server cryptographic machines, one physical cryptographic card typically corresponds to only one virtual cryptographic machine. This one-to-one fixed mapping model severely limits the flexible scheduling of resources. When there is a high demand for cryptographic operations, the allocated low-performance virtual cryptographic machines cannot quickly increase their computing power, resulting in business response delays or even interruptions. Conversely, for low-demand operations, high-performance virtual cryptographic machines remain idle for extended periods, causing a serious waste of valuable cryptographic computing resources.
[0004] Therefore, optimizing the allocation of computing resources for cloud server cryptographic machines, achieving dynamic scheduling and precise matching of cryptographic resources, and improving resource utilization have become urgent technical challenges. Summary of the Invention
[0005] This application addresses the shortcomings of the prior art by providing a resource allocation method for a virtual cryptographic machine and a cloud server to solve the problems existing in the prior art.
[0006] The technical solution adopted in the embodiments of this application is as follows: In a first aspect, embodiments of this application provide a resource allocation method for a virtual cryptographic machine, comprising: Obtain the current resource specification level of the target virtual cryptographic machine, as well as the processing resource quota and encryption card usage unit corresponding to the current resource specification level; wherein, the target virtual cryptographic machine is any one of multiple virtual cryptographic machines corresponding to the physical cryptographic machine connected to the cloud server; Based on the unit occupied by the encryption card, allocate corresponding target memory resources from the memory resources of the physical cryptographic machine to the target virtual cryptographic machine; Based on the processing resource quota, allocate corresponding target processing resources from the processing core of the physical cryptographic machine to the target virtual cryptographic machine; Based on the encryption card occupancy unit, a corresponding target encryption card and a target encryption channel on the target encryption card are allocated to the target virtual encryption machine from among the multiple encryption cards inserted into the physical encryption machine.
[0007] In one embodiment, obtaining the current resource specification level of the target virtual cryptographic machine, and the processing resource quota and encryption card usage unit corresponding to the current resource specification level, includes: Based on the current resource specification level of the target virtual cryptographic machine and the preset mapping relationship between resource specification level and hardware resources, the target hardware resource information corresponding to the current resource specification level is determined. The target hardware resource information includes: the processing resource quota and the encryption card occupancy unit.
[0008] In one embodiment, before determining the target hardware resource information corresponding to the current resource specification level based on the current resource specification level of the target virtual cryptographic machine and a preset mapping relationship between resource specification levels and hardware resources, the method further includes: Based on the ratio of the theoretical calculation value of a single channel of the cryptographic card to the processing capability of a single processing core, hardware resources are quantified for multiple preset resource specification levels to obtain hardware resource information corresponding to the multiple preset resource specification levels. The mapping relationship is constructed based on the hardware resource information corresponding to the multiple preset resource specification levels.
[0009] In one embodiment, allocating corresponding target memory resources for the target virtual cryptographic machine from the memory resources of the physical cryptographic machine according to the unit occupied by the encryption card includes: Based on the unit occupied by the encryption card and the memory resource size corresponding to each unit, calculate the amount of memory resources required by the target virtual cryptographic machine; Based on the amount of memory resources, allocate corresponding target memory resources for the target virtual cryptographic machine from the memory resources of the physical cryptographic machine.
[0010] In one embodiment, the method further includes: When the container of the target virtual cryptographic machine starts, the target memory resource in the memory resource is hard isolated according to the amount of memory resources.
[0011] In one embodiment, allocating corresponding target processing resources to the target virtual cryptographic machine from the processing core of the physical cryptographic machine according to the processing resource quota includes: Determine whether the processing resource quota is less than 1; If the processing resource quota is less than 1, then an idle scheduling resource is determined from the multiple preset scheduling resources of the processing core; Based on the processing resource quota, a target scheduling resource is determined from the idle scheduling resources as the target processing resource.
[0012] In one embodiment, allocating corresponding target processing resources to the target virtual cryptographic machine from the processing core of the physical cryptographic machine according to the processing resource quota includes: If the processing resource quota is greater than or equal to 1, then an idle processing core is determined from the multiple processing cores of the physical cryptographic machine; Based on the processing resource quota, a target processing core is determined from the idle processing cores as the target processing resource.
[0013] In one embodiment, the step of allocating a corresponding target cryptographic card and a target encryption channel on the target cryptographic card to the target virtual cryptographic machine from multiple cryptographic cards inserted into the physical cryptographic machine according to the cryptographic card occupancy unit includes: Based on the multiple password cards and the fixed number of channels corresponding to a single password card, determine all encryption channels corresponding to the physical cryptographic machine; Obtain the channel status of all encrypted channels; Based on the channel status of all encrypted channels, the target cryptographic card is determined from the multiple cryptographic cards to be the cryptographic card containing the idle channel. Based on the encryption card occupancy unit and the preset encryption card carrying unit corresponding to a preset single channel, the target encryption channel is allocated to the target virtual cryptographic machine from the idle channels of the target cryptographic card.
[0014] In one embodiment, the method further includes: Based on the current resource specification level, the information of the target processing resources, the information of the target memory resources, the information of the target cryptographic card, and the information of the target encryption channel, generate the encryption resource configuration file of the target virtual cryptographic machine; The encrypted resource configuration file is copied into the container of the target virtual cryptographic machine so that the encrypted resource configuration file is loaded when the target virtual cryptographic machine starts.
[0015] Secondly, this application also provides a cloud server, which is connected to a physical cryptographic machine. The physical cryptographic machine is configured with multiple virtual cryptographic machines, and multiple cryptographic cards are inserted into the physical cryptographic machine. The cloud server is used to execute the resource allocation method for the virtual cryptographic machines described in any of the above embodiments.
[0016] The beneficial effects of this application are: This application provides a resource allocation method for a virtual cryptographic machine. Through a systematic resource quantification and allocation process, it solves the problems of computing power contention and low resource utilization in the resource allocation of a virtual cryptographic machine, and improves the performance stability, security and resource utilization efficiency of cryptographic services in the cloud environment. Attached Figure Description
[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0018] Figure 1 One of the flowcharts illustrating a resource allocation method for a virtual cryptographic machine provided in this application embodiment; Figure 2 A second schematic flowchart illustrating a resource allocation method for a virtual cryptographic machine provided in this application embodiment; Figure 3 A third schematic flowchart illustrating a resource allocation method for a virtual cryptographic machine provided in this application embodiment; Figure 4 The fourth flowchart illustrates a resource allocation method for a virtual cryptographic machine provided in this application embodiment; Figure 5 Fifth flowchart illustrating a resource allocation method for a virtual cryptographic machine provided in this application embodiment; Figure 6 A flowchart illustrating a resource allocation method for a virtual cryptographic machine provided in this application embodiment is shown in Figure 6. Figure 7 This is the seventh flowchart illustrating a resource allocation method for a virtual cryptographic machine provided in an embodiment of this application. Figure 8 This is a schematic diagram of the resource allocation device for a virtual cryptographic machine provided in an embodiment of this application. Detailed Implementation
[0019] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of this application, but not all embodiments.
[0020] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.
[0021] Furthermore, the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Additionally, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0022] It should be noted that, where there is no conflict, the features in the embodiments of this application can be combined with each other. The following is a brief explanation of the terms used in this application.
[0023] Docker: A lightweight containerization technology that packages applications and their dependencies into standardized, portable "containers" for rapid deployment and resource isolation.
[0024] Virtual cryptographic card: A software simulation layer of physical cryptographic hardware. It provides independent cryptographic computing services for multiple virtual machines or containers by virtualizing, segmenting, and isolating physical cryptographic resources.
[0025] Virtual cryptographic machine: A cryptographic device that uses virtualization technology on a cloud server to provide cryptographic services to multiple tenant application systems in a network manner.
[0026] With the rapid iteration of information technology, cloud computing, with its efficient resource integration capabilities, flexible deployment models, and low-cost operation and maintenance advantages, has become a core infrastructure supporting the digital transformation of various industries. However, while driving industrial innovation, cloud computing, due to its characteristics such as resource sharing and multi-tenant coexistence, has also made information security issues increasingly prominent. Data encryption, identity authentication, key management, and other cryptographic application security in the cloud environment have become key links in ensuring the reliable operation of cloud services.
[0027] To address these security challenges, cloud server cryptographic machines have emerged as a specialized cryptographic security device for virtualized environments, designed to ensure the security of cryptographic applications within virtualized environments. A cloud server cryptographic machine comprises multiple virtual cryptographic machines, providing cryptographic computation services to information systems. However, current technology has drawbacks. For example, one physical cryptographic card corresponds to only one virtual cryptographic machine, and the allocated virtual cryptographic machine's computational performance cannot be adjusted as needed. This results in low-performance cryptographic machines failing to meet the computational demands of tenants, while high-performance cryptographic machines lead to resource waste.
[0028] To address the aforementioned issues, this application provides a resource allocation method for a virtual cryptographic machine, which can be generated by a cloud server. The following examples, in conjunction with the accompanying drawings, provide specific illustrations of the resource allocation method for the virtual cryptographic machine provided in this application.
[0029] Figure 1 This is one of the flowcharts illustrating a resource allocation method for a virtual cryptographic machine provided in an embodiment of this application, such as... Figure 1 As shown, the method includes: S101. Obtain the current resource specification level of the target virtual cryptographic machine, as well as the processing resource quota and encryption card usage unit corresponding to the current resource specification level.
[0030] The target virtual cryptographic machine is any one of the multiple virtual cryptographic machines corresponding to the physical cryptographic machine connected to the cloud server, used to provide cryptographic encryption services for the user's application system.
[0031] Specifically, based on the current resource specification level of the target virtual cryptographic machine and the preset mapping relationship between resource specification levels and hardware resources, the target hardware resource information corresponding to the current resource specification level is determined. The target hardware resource information includes processing resource quota and encryption card occupancy unit.
[0032] For example, the current resource specification level of the target virtual cryptographic machine is determined. This level is selected from the four preset levels L1 to L4. Based on the preset resource specification level and hardware resource mapping relationship (this relationship is established based on the ratio of the theoretical calculation value of the single channel of the cryptographic card to the processing capacity of a single processing core), the hardware resource information of the corresponding level is extracted, including: processing resource quota (i.e., the CPU quota benchmark corresponding to this level, for example, the current level of the target virtual cryptographic machine is L3, and L3 level corresponds to 2 CPU cores) and encryption card occupancy units (i.e., the encryption card channel occupancy units corresponding to this level, for example, L3 level corresponds to 8 encryption card occupancy units).
[0033] S102. Based on the unit occupied by the encryption card, allocate the corresponding target memory resources from the physical cryptographic machine's memory resources to the target virtual cryptographic machine.
[0034] Based on the encryption card occupancy unit determined by S101, allocate corresponding target memory resources from the physical cryptographic machine's memory resources to the target virtual cryptographic machine, ensuring that the target memory resources are used only by the current virtual cryptographic machine.
[0035] S103. Based on the processing resource quota, allocate the corresponding target processing resources to the target virtual cryptographic machine from the processing core of the physical cryptographic machine.
[0036] Based on the processing resource quota determined in S101, the corresponding target processing resources are allocated from the processing cores of the physical cryptographic machine to the target virtual cryptographic machine, that is, CPU cores are allocated to the target virtual cryptographic machine.
[0037] S104. Based on the encryption card occupancy unit, allocate the corresponding target encryption card and the target encryption channel on the target encryption card to the target virtual encryption machine from the multiple encryption cards inserted into the physical encryption machine.
[0038] The physical cryptographic machine also has multiple physical cryptographic cards inserted into it. Each physical cryptographic card has four encryption channels, and each channel can support a maximum of 16 encryption card occupancy units. Based on the encryption card occupancy units determined in S101, the target virtual cryptographic machine is allocated a corresponding target cryptographic card and a target encryption channel on the target cryptographic card from the multiple cryptographic cards inserted into the physical cryptographic machine.
[0039] In summary, this embodiment provides a resource allocation method for a virtual cryptographic machine. Through a systematic resource quantification and allocation process, it solves the problems of computing power contention and low resource utilization in virtual cryptographic machine resource allocation, thereby improving the performance stability, security, and resource utilization efficiency of cryptographic services in a cloud environment.
[0040] Figure 2 This is a second flowchart illustrating a resource allocation method for a virtual cryptographic machine provided in an embodiment of this application. Figure 2 As shown, before determining the target hardware resource information corresponding to the current resource specification level based on the current resource specification level of the target virtual cryptographic machine and the preset mapping relationship between resource specification levels and hardware resources, the method of this application further includes: S201. Based on the ratio of the theoretical calculation value of a single channel of the cryptographic card to the processing capability of a single processing core, the hardware resources of multiple preset resource specification levels are quantified to obtain the hardware resource information corresponding to the multiple preset resource specification levels.
[0041] Using the theoretical computing power of a single channel of a cryptographic card (e.g., the theoretical speed of RSA 2048-bit signature operation as a benchmark) and the processing power of a single physical CPU core (e.g., the number of basic operations that can be completed per unit time) as core parameters, a ratio model is established between the two to serve as the basis for resource quantification. Four levels, L1, L2, L3, and L4, are set to cover cryptographic service requirements from low to high.
[0042] Calculate the ratio of the theoretical computing power of a single channel to the processing power of a single CPU core, and determine the correspondence between the processing resource quota required for different levels and the unit occupied by the encryption card. For example, the ratio calculation shows that to meet the computing power requirement of 1 unit of encryption card, it is necessary to match the processing power of 0.25 CPU cores, which is the basic mapping of L1 level.
[0043] S202. Construct a mapping relationship based on the hardware resource information corresponding to multiple preset resource specification levels.
[0044] The four preset resource specification levels (L1-L4) obtained in S201 are associated with the corresponding hardware resource information to form a mapping table of resource specification level, processing resource quota, and encryption card occupancy unit, as shown in Table 1.
[0045] Table 1. Mapping Table Between Preset Resource Specification Levels and Hardware Resource Information
[0046] The mapping relationships in this mapping table are stored in the cloud server's resource management system in the form of a data model, serving as the basis for subsequent resource allocation to the virtual cryptographic machine, thereby enabling rapid matching of resource specifications and hardware resource requirements.
[0047] This embodiment establishes a standardized resource quantification system and mapping relationship through S201-S202, providing a reliable benchmark for the accurate allocation of resources for virtual cryptographic machines, and solving the problems of no unified standard for resource allocation and mismatch with business needs in traditional solutions.
[0048] Figure 3 This is the third flowchart illustrating a resource allocation method for a virtual cryptographic machine provided in this application embodiment, as shown below. Figure 3 As shown, step S102, allocating corresponding target memory resources to the target virtual cryptographic machine from the physical cryptographic machine's memory resources based on the encryption card's occupied units, may include: S301. Calculate the amount of memory resources required by the target virtual cryptographic machine based on the unit occupied by the encryption card and the memory resource size corresponding to each unit.
[0049] Based on the preset resource specification level and hardware resource mapping relationship, the amount of memory resources required by the target virtual cryptographic machine is calculated according to the unit occupied by the encryption card and the memory resource size corresponding to each unit (each encryption card unit corresponds to 2000MB of memory resources).
[0050] Specifically, first determine the encryption card occupancy unit corresponding to the current resource specification level of the target virtual cryptographic machine (for example, if the target virtual cryptographic machine is at level L1, its encryption card occupancy unit is 1; if it is at level L4, its encryption card occupancy unit is 16).
[0051] The required total memory is calculated using the formula: Target memory resource amount (MB) = Number of encryption card units × 2000. For example, when the target virtual cryptography machine is at level L3, its encryption card occupies 8 units, then the target memory resource amount = 8 × 2000 = 16000MB.
[0052] S302. Based on the amount of memory resources, allocate corresponding target memory resources to the target virtual cryptographic machine from the memory resources of the physical cryptographic machine.
[0053] Extract a memory capacity equal to the S301 calculation result (e.g., 16000MB) from the total memory resources of the physical cryptographic machine, and use it as dedicated memory resources for the target virtual cryptographic machine. Then, when starting the Docker container of the target virtual cryptographic machine, resource locking is achieved through the memory isolation parameters of containerization technology. Specifically, configure `--memory=<target memory resource amount>MB` in the startup command, such as `--memory=16000MB` for L3 level.
[0054] This parameter ensures that the allocated memory resources are exclusively used by the target virtual cryptographic machine, and cannot be occupied by other virtual cryptographic machines or processes. This avoids fluctuations in cryptographic operation performance caused by memory resource contention (such as increased encryption / decryption latency, signature verification failure, etc.), and guarantees the independence and stability of memory resources.
[0055] This embodiment, through S301-S302, achieves precise quantitative allocation and hard isolation of virtual cryptographic machine memory resources, which not only meets the differentiated memory requirements of different specifications and levels (such as high-level L4 requiring 32000MB to support high-concurrency cryptographic operations), but also avoids over-allocation or under-allocation of memory resources, thereby improving the utilization efficiency of memory resources and the reliability of cryptographic services.
[0056] Figure 4 This is the fourth flowchart illustrating a resource allocation method for a virtual cryptographic machine provided in this application embodiment, as shown below. Figure 4 As shown, step S103, which allocates corresponding target processing resources from the processing core of the physical cryptographic machine to the target virtual cryptographic machine according to the processing resource quota, may include: S401. Determine whether the processing resource quota is less than 1.
[0057] Resource quotas are determined based on preset resource specification levels (L1-L4), where L1 corresponds to 0.25 cores (less than 1), L2 corresponds to 1 core, L3 corresponds to 2 cores, and L4 corresponds to 4 cores (L2, L3, and L4 are all greater than or equal to 1).
[0058] Extract the processing resource quota from the hardware resource information corresponding to the resource specification level of the target virtual cryptographic machine, compare it with 1, and determine whether the processing resource quota is less than 1.
[0059] S402. If the processing resource quota is less than 1, then an idle scheduling resource is determined from the multiple preset scheduling resources of the processing core.
[0060] Each processing core (physical CPU core) of the physical cryptographic machine is pre-divided into 4 scheduling units, each scheduling unit corresponding to 0.25 cores of processing capacity, as the basic scheduling resource. The resource management system of the cloud server cryptographic machine monitors the occupancy status of the 4 scheduling units of each processing core in real time, and filters out the scheduling units that are not occupied by any virtual cryptographic machine, i.e., idle scheduling resources.
[0061] S403. Based on the processing resource quota, determine the target scheduling resource from the idle scheduling resources as the target processing resource.
[0062] Since the processing resource quota for L1 level is 0.25 cores (corresponding to 1 scheduling unit), and multiple L1 instances are allowed to share the same physical core (up to 4 L1 instances per core), 1 scheduling unit is selected from the idle scheduling resources determined by S402.
[0063] By using the Docker container startup parameter --cpuset-cpus=<corresponding physical core number>, the target virtual cipher machine is bound to the physical core containing the available scheduling unit, and the CPU quota is set with --cpus=0.25 to ensure that it occupies the processing resources of 1 scheduling unit.
[0064] Figure 5 The fifth flowchart illustrates a resource allocation method for a virtual cryptographic machine provided in this application embodiment. Figure 5 As shown, S103 may also include: S501. If the processing resource quota is greater than or equal to 1, then an idle processing core is determined from the multiple processing cores of the physical cryptographic machine.
[0065] By querying the status of all processing cores of the physical cryptographic machine through the resource management system, a list of idle processing cores is filtered out. If an idle physical core is not bound to any virtual cryptographic machine and all scheduling units within the core are not occupied (to avoid sharing with L1 instances), it is determined to be an idle processing core.
[0066] S502. Based on the processing resource quota, determine the target processing core from the idle processing cores as the target processing resource.
[0067] For L2 level (1 quota core), select 1 idle processing core from the list of idle processing cores as the target processing core; for L3 level (2 quota cores), select 2 consecutive idle processing cores (or non-consecutive idle cores that meet the total quota) from the list of idle processing cores as the target processing cores; for L4 level (4 quota cores), select 4 consecutive idle processing cores (or non-consecutive idle cores that meet the total quota) from the list of idle processing cores as the target processing cores.
[0068] By using the Docker container startup parameter `--cpuset-cpus=<target processing core number list>` (e.g., binding L2 to core 5 with `--cpuset-cpus=5`; binding L3 to cores 6 and 7 with `--cpuset-cpus=6,7`), and in conjunction with `--cpus=<quota value>` (e.g., setting L2 to 1 and L3 to 2), hard binding and isolation of processing resources are achieved. Processing cores allocated to L2 and above cannot be allocated to any other virtual cryptographic machines (including L1), ensuring the exclusive use of computing power for high-specification instances.
[0069] Through the hierarchical allocation logic of S401-S502, it is possible to achieve shared utilization of CPU resources by low-specification (L1) instances (improving core utilization) and to ensure the exclusive use of CPU resources by high-specification (L2-L4) instances (avoiding computing power contention), ultimately achieving precise allocation of processing resources and performance isolation.
[0070] Figure 6 This is a flowchart illustrating a resource allocation method for a virtual cryptographic machine, as shown in the sixth example of an embodiment of this application. Figure 6 As shown, S104, based on the encryption card occupancy unit, assigns corresponding target encryption cards and target encryption channels on the target encryption cards to the target virtual encryption machine from multiple encryption cards inserted from the physical encryption machine, including: S601. Based on multiple password cards and a preset fixed number of channels corresponding to a single password card, determine all encryption channels corresponding to the physical password machine.
[0071] The physical cryptographic machine accepts multiple physical cryptographic cards, each providing a fixed number of encryption channels (preset to 4 or 8 channels, the specific number depending on the hardware model). The physical cryptographic machine's resource management module scans all accepted physical cryptographic cards, recording each card's identification information (such as card number) and the corresponding total number of channels (e.g., 3 eight-channel cryptographic cards provide a total of 3 × 8 = 24 encryption channels), forming a mapping list of cryptographic cards and channels, thus clearly defining the range of all encryption channels for the physical cryptographic machine.
[0072] S602. Obtain the channel status of all encrypted channels.
[0073] The state of an encrypted channel includes idle (not assigned to any virtual cryptographic machine) and occupied (assigned to other virtual cryptographic machines). The idle state must also record the number of remaining units that the channel can support (a single channel can support a maximum of 16 virtual cryptographic card units).
[0074] Specifically, the resource management module monitors the allocation records of each encrypted channel in real time, counts the number of units occupied by each channel, calculates the remaining capacity (remaining capacity = 16 - number of occupied units), and updates the channel status list (for example, if a channel has been allocated 4 units, then the remaining capacity is 12).
[0075] S603. Based on the channel status of all encrypted channels, determine the target cryptographic card from among multiple cryptographic cards that contains an idle channel.
[0076] From all encrypted channels, channels with remaining capacity greater than or equal to the unit occupied by the encryption card of the target virtual cryptographic machine are selected as valid idle channels. If a physical cryptographic card contains at least one valid idle channel, it is listed as a candidate target cryptographic card; if multiple candidate cryptographic cards exist, the card with the fewest valid idle channels is selected first to improve the resource utilization of the cryptographic card (or selected according to a load balancing strategy), and finally one card is determined as the target cryptographic card.
[0077] S604. Based on the encryption card occupancy unit and the preset encryption card carrying unit corresponding to a single preset channel, allocate a target encryption channel to the target virtual cryptographic machine from the idle channels of the target cryptographic card.
[0078] From the available free channels of the target cryptographic card, select the channel with the smallest remaining capacity that meets the requirements. For example, if the target virtual cryptographic machine is at level L2 and the encryption card occupies 4 units, then select the channel with the smallest remaining capacity of ≥4. If the target virtual cryptographic machine is at level L4 (encryption card occupies 16 units), then select the free channel with a remaining capacity of 16 (maximum capacity per channel).
[0079] The selected channel is marked as occupied, and the binding relationship between the channel and the target virtual cipher machine is recorded. At the same time, the remaining capacity of the channel is updated. For example, after allocating 4 units to L2, the remaining capacity of the channel changes from 12 to 8.
[0080] This embodiment achieves fine-grained scheduling of encrypted channel resources through S601-S604, ensuring that low-specification instances (such as L1) can share channel resources (improving channel utilization) while guaranteeing the exclusive access of high-specification instances (such as L4) to the channel (avoiding performance interference), ultimately realizing the precise allocation and isolation of virtual cryptographic machine encryption computing resources.
[0081] Figure 7 This is the seventh flowchart illustrating a resource allocation method for a virtual cryptographic machine provided in this application embodiment, as shown below. Figure 7 As shown, the method of this application further includes: S701. Generate the encryption resource configuration file for the target virtual cryptographic machine based on the current resource specification level, target processing resource information, target memory resource information, target cryptographic card information, and target encryption channel information.
[0082] Based on the current resource specification level of the target virtual cryptographic machine, the allocated target processing resources, target memory resources, target cryptographic card, and target encryption channel information, an encryption resource configuration file is generated, which specifically includes the following core information: current resource specification level identifier (e.g., "L3"); target processing resource information: a list of bound physical core numbers (e.g., "2,3") and CPU quota (e.g., "2 cores"); target memory resource information: total memory (e.g., 16000MB); target cryptographic card and channel information: the hardware identifier of the target cryptographic card (e.g., cryptographic card number 03), the target encryption channel number (e.g., channel 5), and the number of encryption card units allocated to that channel (e.g., 8 units).
[0083] The configuration file uses a standardized format (such as JSON or XML) to ensure that the cryptographic service process inside the container can be parsed and recognized.
[0084] S702. Copy the encrypted resource configuration file to the container of the target virtual cryptographic machine so that the encrypted resource configuration file is loaded when the target virtual cryptographic machine starts.
[0085] Using the dockercp command of the Docker container, the encrypted resource configuration file generated by S701 is copied from the local storage path of the cloud server cryptographic machine to the preset directory inside the Docker container corresponding to the target virtual cryptographic machine. When the Docker container of the target virtual cryptographic machine starts, the internal cryptographic service process will automatically detect the encrypted resource configuration file in the preset directory, initialize it according to the CPU core binding, memory limit, and encryption channel information defined in the file, apply the resource limit parameters to the actual running environment, and ensure that the allocated hardware resources are accurately called and strictly isolated.
[0086] The implementation of S701-S702 has enabled the automated configuration of virtual cryptographic machine resources. The configuration file serves as a "bridge" between resource allocation and actual operation, recording the specific parameters of resource allocation and ensuring that the cryptographic service within the container operates according to preset specifications, ultimately guaranteeing the effectiveness of resource isolation and the stability of cryptographic service performance.
[0087] This application also provides a cloud server connected to a physical cryptographic machine, the physical cryptographic machine being configured with multiple virtual cryptographic machines, and multiple cryptographic cards being inserted into the physical cryptographic machine. The cloud server is used to execute the resource allocation method of the virtual cryptographic machines in any of the above embodiments.
[0088] The following will continue to explain the apparatus and storage medium for implementing the resource allocation method of the virtual cryptographic machine provided in any of the above embodiments of this application. The specific implementation process and the resulting technical effects are the same as those in the corresponding method embodiments. For the sake of brevity, the parts not mentioned in the following embodiments can be referred to the corresponding content in the method embodiments.
[0089] Figure 8 This is a schematic diagram of the structure of the resource allocation device for the virtual cryptographic machine provided in the embodiments of this application, as shown below. Figure 8 As shown, this application also provides a resource allocation method for a virtual cryptographic machine, including: The acquisition module 10 is used to acquire the current resource specification level of the target virtual cryptographic machine, as well as the processing resource quota and encryption card occupancy unit corresponding to the current resource specification level; wherein, the target virtual cryptographic machine is any one of the multiple virtual cryptographic machines corresponding to the physical cryptographic machine connected to the cloud server.
[0090] The first allocation module 20 is used to allocate corresponding target memory resources to the target virtual cryptographic machine from the memory resources of the physical cryptographic machine according to the unit occupied by the encryption card.
[0091] The second allocation module 30 is used to allocate corresponding target processing resources to the target virtual cryptographic machine from the processing core of the physical cryptographic machine according to the processing resource quota.
[0092] The third allocation module 40 is used to allocate a corresponding target cryptographic card and a target encryption channel on the target cryptographic card to the target virtual cryptographic machine from multiple cryptographic cards inserted into the physical cryptographic machine according to the cryptographic card occupancy unit.
[0093] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.
[0094] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more microprocessors, or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).
[0095] Optionally, this application also provides a readable storage medium storing program instructions, which, when executed by a processor, implement the resource allocation method of the virtual cryptographic machine described in any of the above embodiments.
[0096] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
[0097] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0098] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.
[0099] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0100] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A resource allocation method for a virtual cryptographic machine, characterized by, The method comprises the following steps: obtaining the current resource specification level of a target virtual cryptographic machine, and the processing resource quota and the encryption card occupation unit corresponding to the current resource specification level; wherein the target virtual cryptographic machine is any virtual cryptographic machine in a plurality of virtual cryptographic machines corresponding to a physical cryptographic machine connected to a cloud server; allocating corresponding target memory resources for the target virtual cryptographic machine from the memory resources of the physical cryptographic machine according to the encryption card occupation unit; allocating corresponding target processing resources for the target virtual cryptographic machine from the processing cores of the physical cryptographic machine according to the processing resource quota; allocating corresponding target cryptographic cards and target encryption channels on the target cryptographic cards for the target virtual cryptographic machine from a plurality of cryptographic cards connected to the physical cryptographic machine according to the encryption card occupation unit.
2. The method of claim 1, wherein, The method further comprises the following steps: determining the target hardware resource information corresponding to the current resource specification level of the target virtual cryptographic machine according to the mapping relationship between the preset resource specification levels and the hardware resources, wherein the target hardware resource information comprises the processing resource quota and the encryption card occupation unit.
3. The method of claim 2, wherein, Before the step of determining the target hardware resource information corresponding to the current resource specification level of the target virtual cryptographic machine according to the mapping relationship between the preset resource specification levels and the hardware resources, the method further comprises the following steps: quantifying the hardware resources of a plurality of preset resource specification levels based on the ratio relationship between the single-channel theoretical calculation value of a cryptographic card and the processing capacity of a single processing core, to obtain the hardware resource information corresponding to the plurality of preset resource specification levels; constructing the mapping relationship according to the hardware resource information corresponding to the plurality of preset resource specification levels.
4. The method of claim 1, wherein, The method further comprises the following steps: calculating the amount of memory resources required by the target virtual cryptographic machine according to the encryption card occupation unit and the memory resource size corresponding to each unit; allocating corresponding target memory resources for the target virtual cryptographic machine from the memory resources of the physical cryptographic machine according to the amount of memory resources.
5. The method of claim 4, wherein, The method further comprises the following steps: performing resource hard isolation on the target memory resources in the memory resources according to the amount of memory resources when the container of the target virtual cryptographic machine is started.
6. The method of claim 1, wherein, The method further comprises the following steps: determining whether the processing resource quota is less than 1; if the processing resource quota is less than 1, determining an idle scheduling resource from a plurality of preset scheduling resources of the processing core; allocating the target scheduling resource as the target processing resource from the idle scheduling resource according to the processing resource quota.
7. The method of claim 6, wherein, The method further comprises the following steps: determining, from the plurality of processing cores of the physical cryptographic machine, an idle processing core if the processing resource quota is greater than or equal to 1; determining, from the idle processing core, a target processing core as the target processing resource according to the processing resource quota.
8. The method of claim 1, wherein, The allocating, according to the encryption card occupation unit, of a corresponding target cryptographic card and a target encryption channel on the target cryptographic card to the target virtual cryptographic machine from the plurality of cryptographic cards plugged into the physical cryptographic machine comprises: determining all encryption channels corresponding to the physical cryptographic machine according to the plurality of cryptographic cards and a preset fixed channel number corresponding to a single cryptographic card; obtaining channel states of the all encryption channels; determining, from the plurality of cryptographic cards, a cryptographic card with an idle channel as the target cryptographic card according to the channel states of the all encryption channels; allocating the target encryption channel to the target virtual cryptographic machine from the idle channel of the target cryptographic card according to the encryption card occupation unit and a preset encryption card carrying unit corresponding to a preset single channel.
9. The method of claim 1, wherein, The method further comprises: generating an encryption resource configuration file of the target virtual cryptographic machine according to the current resource specification level, information of the target processing resource, information of the target memory resource, information of the target cryptographic card and information of the target encryption channel; copying the encryption resource configuration file to a container of the target virtual cryptographic machine to load the encryption resource configuration file when the target virtual cryptographic machine starts.
10. A cloud server, characterized by, The cloud server is connected with a physical cryptographic machine, the physical cryptographic machine is configured with a plurality of virtual cryptographic machines, a plurality of cryptographic cards are plugged into the physical cryptographic machine, and the cloud server is configured to execute the resource allocation method of the virtual cryptographic machine according to any one of claims 1-9.