Distributed password service system and method based on interlayer interface decoupling

Abstract

The invention discloses a distributed password service system and method based on interlayer interface decoupling. The distributed password service system comprises a hardware layer, a service layer and an interface layer, the hardware layer comprises a security processor, and the security processor is used for providing business and management capability and externally providing a channel with interaction capability through a hardware interface; the service layer is used for a password operation service, a password management service and a middle layer API (Application Program Interface); and the interface layer is used for providing a password operation service and a password management service provided by the password suite for an external system in a unified interface mode, and when the interface layer interacts with the external system, the interface layer provides a function of processing and authenticating request data so as to ensure the security of interface access. According to the invention, triple technical effects are realized through the architecture of ''interlayer interface decoupling + service separation'', the collaborative breakthrough of safety, performance and expansibility is finally achieved, and a new generation of infrastructure support is provided for high-concurrency and cross-platform distributed password services.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a distributed cryptographic service system and method based on middleware interface decoupling. Background Technology

[0002] Distributed cryptographic service systems, as an evolution of traditional centralized cryptographic devices, aim to reduce network transmission overhead and improve overall system performance and reliability by bringing cryptographic capabilities closer to the business end. A typical distributed cryptographic service system usually consists of cryptographic modules (such as cryptographic cards and software cryptographic modules) deployed on various computing nodes and a unified management platform, providing cryptographic operation support for distributed business applications through a collaborative working mechanism.

[0003] Distributed cryptographic service systems are primarily used in high-security sectors such as fintech, e-government, healthcare, and the industrial internet. In these sectors, distributed cryptographic service systems play a crucial role as core infrastructure, providing standardized cryptographic computation support for business applications, ensuring end-to-end security protection of sensitive data; enabling unified scheduling and flexible allocation of cryptographic resources to improve overall system resource utilization; and establishing robust security audit and compliance mechanisms to meet relevant regulatory requirements.

[0004] However, existing distributed cryptographic service systems still have significant limitations in their architectural design and technical implementation. For example, Chinese patent application CN120017282A proposes a distributed cryptographic service framework system and cryptographic service processing method. Although this system achieves collaboration between business applications and local cryptographic modules, it lacks a hardware abstraction layer, resulting in strong coupling between cryptographic services and the underlying hardware. In practical applications, especially in scenarios such as core financial transaction systems and government data exchange platforms that require support for hardware devices from multiple vendors, this system struggles to achieve smooth migration of cryptographic capabilities and resource pooling scheduling, limiting system scalability and operational flexibility.

[0005] Chinese patent application CN118138287A discloses a distributed cryptographic service system and method based on confidential computing technology. This system relies on a secure processor to achieve secure key storage and cryptographic operations, effectively improving the security and efficiency of local calls. However, this system concentrates cryptographic operations into a single cryptographic suite, failing to implement multi-process parallel processing of the computation service. This makes it difficult to meet the low-latency, high-throughput cryptographic operation requirements in high-concurrency business scenarios, such as internet financial payments and telecommunications authentication gateways, resulting in a performance bottleneck.

[0006] Chinese patent application CN115225269A proposes a key management method, device, and system for distributed cryptographic cards. It achieves unified key distribution and caching management through a central server, reducing the complexity of key management. However, this system lacks a robust interface-level authorization management system, making it difficult to achieve fine-grained access control for cryptographic service calls. In scenarios involving multi-tenancy and sensitive data processing, such as government cloud and medical image sharing, there is a risk of unauthorized access and misuse of cryptographic resources.

[0007] In summary, existing distributed cryptographic service systems have shortcomings in key areas such as hardware adaptability, service parallelization, and interface-level authorization management, making it difficult to meet the comprehensive needs of modern distributed systems in terms of cross-platform deployment, high-performance concurrency, and refined security management. Therefore, there is an urgent need to build a new distributed cryptographic service architecture with hardware decoupling, service layering, and unified authorization capabilities to support the higher requirements for cryptographic services in various industries during their digital transformation. Summary of the Invention

[0008] To address the shortcomings of existing technologies, this invention aims to provide a distributed cryptographic service system and method based on middleware interface decoupling.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] A distributed cryptographic service system based on middleware interface decoupling includes a hardware layer, a service layer, and an interface layer;

[0011] The hardware layer includes a security processor, which provides business and management capabilities and provides an interactive channel to the outside world through a hardware interface.

[0012] The service layer provides cryptographic suites and middleware APIs. The cryptographic suites include cryptographic computation services and cryptographic management services. The cryptographic computation services provide cryptographic-related business computing capabilities. The cryptographic management services provide scheduling and management functions for underlying cryptographic hardware devices, implement key distribution and management, and manage and monitor processor information and the processor environment. The middleware APIs define and encapsulate the functional interfaces for cryptographic computation.

[0013] The interface layer is used to provide the cryptographic operation and management services provided by the cryptographic suite to external systems through a unified interface. When interacting with external systems, the interface layer provides the functions of processing and authenticating request data to ensure the security of interface access.

[0014] Furthermore, the application system obtains cryptographic operation services from the cryptographic suite through a unified interface, and ensures the timeliness and stability of the cryptographic operation services through the decoupling design principle; the confidential computing device management system obtains cryptographic management services through JAVA-SDK to manage the processor in real time and monitor its status, ensuring the processor runs smoothly and effectively.

[0015] Furthermore, the cryptographic operation service is executed by an HTTP server that supports multi-process or asynchronous concurrency. The HTTP server can receive and process multiple cryptographic operation requests in parallel. The cryptographic management service runs as a TCP server, communicating with the confidential computing device management system via the TCP protocol to receive and execute management instructions.

[0016] The present invention also provides a method for operating the above system, the specific process of which is as follows:

[0017] The distributed confidential computing management center pre-enters information about business application systems and authorizes interfaces. The information includes the system's identity identifier (appid). Each interface has a corresponding serial number, and the authorization status of each interface is represented by 0 and 1, where 1 indicates authorized and 0 indicates unauthorized. When authorizing interfaces of a business application system, the interfaces are selected according to their serial numbers. The authorization status of all interfaces is combined into a string based on the serial numbers, which is the interface permission field of the business application system. This string is stored in the local database through the password management service of the cryptographic suite.

[0018] When a business application system calls the cryptographic computation service of the cryptographic suite through the interface provided by the interface layer, it is necessary to first verify whether the business application system has the right to call the cryptographic computation service:

[0019] When a business application system calls the cryptographic computation service through an interface, the cryptographic computation service obtains the application system's identity identifier (appid) from the parameters transmitted by the application system. Then, based on the appid, it queries the corresponding interface permission field in the local database in real time. It checks the interface's authorization status based on the interface's sequence number. If the application system is found to be authorized to call the interface, the processor calls the cryptographic computation service to complete the cryptographic computation and returns the result. The cryptographic computation service records the information from this call and stores the relevant information. If the application system is found to be unauthorized to call the interface, it immediately returns an "unauthorized" error message to the application system.

[0020] This invention also provides another method for operating the above system, the specific process of which is as follows:

[0021] The distributed confidential computing management center obtains business keys from an external key management system and distributes the keys to confidential computing servers through a secure channel. The confidential computing servers receive the key data through the confidential computing device management system they deploy and forward it to the password management service. After receiving the key data, the password management service calls the security processor interface to securely inject the key into the hardware-layer security processor, completing the key distribution and storage.

[0022] After the security processor successfully receives and stores the key injected by the password management service, it will assign a unique, non-repeating identifier to the key in its protected internal storage area, i.e., the key slot. This identifier is the key index number.

[0023] The business application system requests its own identity identifier (appid) and authentication key through the confidential computing device management system in advance; the confidential computing device management system forwards the request results, including the business application system's identity identifier (appid) and key information, to the password management service; the password management service binds the key index number corresponding to the key to the business application system's identity identifier and persistently stores it in the local database;

[0024] Then, the distributed confidential computing management center pre-authorizes the interfaces of the business application system, and the password management service stores the interface authorization information of the business application system in the local database.

[0025] When an application system calls the cryptographic operation service of the cryptographic suite through the unified interface provided by the interface layer, it needs to perform identity authentication and authorization authentication on the business application system in each call. The specific process is as follows:

[0026] When the cryptographic computation service receives a cryptographic computation request (i.e., an HTTP request) from the business application system, it first verifies the identity of the request source. If the verification is successful, it retrieves the key index number bound to that identity and the interface authorization information from the local database based on the identity identifier of the request source. The cryptographic computation service then verifies the interface authorization information to determine whether the call is valid. If the verification fails, it returns a failure error code to the business application system. If the verification is successful, the cryptographic computation service calls the middleware API, sending the key index number information. The middleware API parses the cryptographic computation request and sends it along with the key index number to the security processor. The security processor finds the corresponding key in its internal storage area based on the cryptographic computation request and the key index number, performs cryptographic computation, and returns the computation result to the cryptographic computation service. The cryptographic computation service then returns the computation result to the business application system.

[0027] Furthermore, after obtaining the computation result, the cryptographic operation service records the result of this call and pushes the result to the data storage area of ​​the confidential computing device management system in asynchronous mode. The confidential computing device management system pushes the call records in the data storage area to the distributed confidential computing management center. The distributed confidential computing management center collects and integrates the call record logs, parses them, and forms statistical information and displayable data.

[0028] Furthermore, when the cryptographic operation service receives a device or key management request (i.e., a TCP request) initiated by the confidential computing device management system, the cryptographic management service calls the middleware API. The middleware API parses the device or key management request and sends it to the security processor. After completing the relevant request, the security processor returns the result to the cryptographic management service, which then returns it to the confidential computing device management system.

[0029] The beneficial effects of this invention are as follows:

[0030] (1) Performance leap

[0031] In this invention, the service layer separates the cryptographic computation service from the cryptographic management service. This decoupled architecture allows the cryptographic computation service to be deployed and optimized as an independent component focused on high-concurrency processing. The cryptographic computation service itself operates using a multi-process model, enabling it to receive and process cryptographic computation requests from multiple clients in parallel. This lays the foundation for high-concurrency processing at the system architecture level, avoiding performance bottlenecks caused by monolithic services or coupling with management functions.

[0032] Furthermore, this invention employs an HTTP server that supports multi-process or asynchronous concurrency to perform cryptographic operations, enabling dynamic scheduling of multiple worker processes. This multi-process dynamic scheduling mechanism ensures that a large number of concurrent requests can be responded to and processed in a timely manner, rather than being serially blocked, thereby directly translating the parallel capabilities of the architecture into actual high throughput performance.

[0033] (2) Enhanced security

[0034] In this invention, the hardware layer includes a secure processor with a trusted execution environment. This structure provides a hardware-level isolated security boundary for key storage and cryptographic operations, ensuring that keys and sensitive data are processed only within the secure area of ​​the secure processor, fundamentally preventing the plaintext key from being exposed to the host operating system. Simultaneously, the independent cryptographic management service in the service layer, as a separate control module from the cryptographic operation service, is specifically responsible for key distribution and management. This structure eliminates the need for core key materials to circulate between business applications over the network.

[0035] (3) Elastic expansion

[0036] This invention can abstract heterogeneous hardware instructions through a middleware API, support seamless switching of security processors for business applications, and dynamically load national cryptographic algorithms through standardized interfaces to meet the elastic scaling requirements of cloud-native environments.

[0037] This invention achieves triple technical effects through the "interface decoupling of the middle layer + service separation" architecture, ultimately achieving a synergistic breakthrough in security, performance, and scalability, and providing a new generation of infrastructure support for high-concurrency, cross-platform distributed cryptographic services. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of the overall architecture of the system in Embodiment 1 of the present invention;

[0039] Figure 2 This is a flowchart of the method in Embodiment 2 of the present invention;

[0040] Figure 3 This is a flowchart of the method in Embodiment 3 of the present invention. Detailed Implementation

[0041] The present invention will be further described below with reference to the accompanying drawings. It should be noted that this embodiment is based on the present technical solution and provides detailed implementation methods and specific operation processes, but the protection scope of the present invention is not limited to this embodiment.

[0042] Example 1

[0043] This embodiment provides a distributed cryptographic service system based on middleware interface decoupling, such as... Figure 1 As shown, it includes a hardware layer, a service layer, and an interface layer;

[0044] The hardware layer includes a security processor, which provides business and management capabilities and provides interactive channels to the outside world through hardware interfaces.

[0045] The service layer provides cryptographic suites and a middleware API. The cryptographic suites provide cryptographic computation services (CCS_HTTP) and cryptographic management services (CCMS_TCP). The cryptographic computation services provide cryptographic-related business computation capabilities, including encryption / decryption, random number generation, HMAC calculation, certificate-based PKCS1 and PKCS7 signature verification, digital envelope encryption and decryption, etc., enabling various cryptographic operations to meet the cryptographic needs of upper-layer application systems. The cryptographic management services provide scheduling and management functions for underlying cryptographic hardware devices, including CCP (cryptographic coprocessor, an independent cryptographic hardware module within the Hygon CPU) internal key configuration, CCP internal key authorization configuration, CCP device information management, and other comprehensive management functions. Additionally, the cryptographic management services manage processor information and monitor the processor environment, providing multifaceted monitoring and management functions. The middleware API is based on the confidential and non-confidential business implementations of Hygon TKM (a key management module implemented in Hygon CPUs), defining and encapsulating cryptographic computation functional interfaces to maximize the performance of cryptographic services while enabling decoupled operation.

[0046] The interface layer is used to provide the cryptographic operation and management services provided by the cryptographic suite to external systems through a unified interface. When interacting with external systems, the interface layer provides the functions of processing and authenticating request data to ensure the security of interface access.

[0047] The application system obtains cryptographic computation services from the cipher suite through a unified interface, and the timeliness and stability of the cryptographic computation services are ensured through decoupling design principles. The management system obtains cryptographic management services through the JAVA-SDK to manage the processor in real time and monitor its status, ensuring the processor's stable and efficient operation.

[0048] In this embodiment, the cryptographic operation service is executed by an HTTP server that supports multi-process or asynchronous concurrency. The HTTP server can receive and process multiple cryptographic operation requests in parallel. The cryptographic management service runs as a TCP server, communicating with the confidential computing device management system through a proprietary TCP protocol to receive and execute management instructions.

[0049] Example 2

[0050] This embodiment provides a method for operating the system described in Embodiment 1.

[0051] The distributed confidential computing management center pre-enters information about business application systems and authorizes interfaces. The information includes the system's identity identifier (appid). Each interface has a corresponding serial number, and the authorization status of each interface is represented by 0 and 1, where 1 indicates authorized and 0 indicates unauthorized. When authorizing interfaces of a business application system, the interfaces are selected according to their serial numbers. The authorization status of all interfaces is combined into a string based on the interface serial numbers, which is the interface permission field of the business application system. This string is stored in the local database through the password management service of the cryptographic suite.

[0052] like Figure 2 As shown, the interface permission field "1101011100001" corresponding to appid-1 contains a string representing the authorization status of all interfaces of the business application system appid-1. Specifically, the interface permission field "1101011100001" indicates that interfaces with serial numbers 1, 2, 4, 6, 7, 8, and 13 have been authorized for the business application system appid-1.

[0053] When a business application system calls the cryptographic computation service of the cryptographic suite through the interface provided by the interface layer, it is necessary to first verify whether the business application system has the right to call the cryptographic computation service. The specific process is as follows: Figure 2 As shown:

[0054] When a business application system calls the cryptographic computation service through an interface, the cryptographic computation service obtains the application system's identity identifier (appid) from the parameters transmitted by the application system. Then, based on the appid, it queries the corresponding interface permission field in the local database in real time. It checks the authorization status of the interface based on its sequence number (i.e., whether the authorization status corresponding to the interface's sequence number is 1). If the application system is found to be authorized to call the interface, the processor calls the cryptographic computation service to complete the cryptographic computation and returns the result. The cryptographic computation service records the information from this call and stores the relevant information. If the application system is found to be unauthorized to call the interface, it immediately returns an "unauthorized" error message to the application system.

[0055] Example 3

[0056] This embodiment provides another way of working the system described in Embodiment 1.

[0057] The distributed confidential computing management center obtains business keys from an external key management system and distributes the keys to confidential computing servers through a secure channel. The confidential computing servers receive the key data through their deployed confidential computing device management system and forward it to the password management service (CCMS_TCP). After receiving the key data, the password management service calls the security processor interface to securely inject the key into the hardware layer's security processor, completing the key distribution and storage.

[0058] After the security processor successfully receives and stores the key injected by the password management service, it will assign a unique, non-repeating identifier to the key in its protected internal storage area, i.e., the key slot. This identifier is the key index number.

[0059] The business application system requests its own identity identifier (appid) and authentication key through the confidential computing device management system in advance. The confidential computing device management system forwards the request results, including the business application system's identity identifier (appid) and key information, to the password management service. The password management service binds the key index number corresponding to the key to the business application system's identity identifier and persistently stores it in the local database.

[0060] Then, the distributed confidential computing management center pre-authorizes the interfaces of the business application system, and the password management service stores the interface authorization information of the business application system in the local database.

[0061] like Figure 3 As shown, when an application system calls the cryptographic operation service of the cryptographic suite through the unified interface provided by the interface layer, it needs to perform identity authentication and authorization authentication on the business application system in each call. The specific process is as follows:

[0062] When the cryptographic computation service receives a cryptographic computation request (i.e., an HTTP request) from a business application system, it first verifies the identity of the request source. If the verification is successful, it retrieves the key index number bound to that identity and the interface authorization information from the local database based on the identity identifier of the request source. The cryptographic computation service then verifies the interface authorization information to determine if the call is valid. If the verification fails, it returns a failure error code to the business application system. If the verification is successful, the cryptographic computation service calls the middleware API, sending the key index number along with the request. The middleware API parses the cryptographic computation request and sends it along with the key index number to the security processor. The security processor finds the corresponding key in its internal storage area based on the request and the key index number, performs the cryptographic computation, and returns the result to the cryptographic computation service. The cryptographic computation service returns the result to the business application system, records the call result, and pushes it asynchronously to the data storage area of ​​the confidential computing device management system. The confidential computing device management system pushes the call records in the data storage area to the distributed confidential computing management center. The distributed confidential computing management center collects and integrates the call logs, parses them, and generates statistical information and displayable data.

[0063] When the cryptographic operation service receives a device or key management request (i.e., a TCP request) initiated by the confidential computing device management system, the cryptographic management service calls the middleware API. The middleware API parses the device or key management request and sends it to the security processor. After completing the relevant request, the security processor returns the result to the cryptographic management service, which then returns it to the confidential computing device management system.

[0064] It should be noted that the specific function of the key index number is as follows:

[0065] 1. Security Agent

[0066] The cryptographic computation service itself neither holds nor processes the plaintext key. Instead, it uses the obtained key index number as a credential to securely "identify" a specific key with the hardware-layer security processor. The service only passes the key index number to the intermediate-layer API and processor, thus preventing the plaintext key from appearing and being transmitted in the service layer, interface layer, or network, fundamentally eliminating the risk of key leakage during distribution and use.

[0067] 2. Visit the bridge

[0068] The key index number serves as the unique bridge connecting the identity of a business application system to the corresponding key in the hardware isolation environment via cryptographic operations. The security processor, based on the received key index number, locates the correct key within its internal secure area and performs cryptographic operations, ensuring the security principle of "keys never leave the card, operations remain internal" is achieved.

[0069] For those skilled in the art, various corresponding changes and modifications can be made based on the above technical solutions and concepts, and all such changes and modifications should be included within the protection scope of the claims of this invention.

Claims

1. A distributed cryptographic service system based on middleware interface decoupling, characterized in that, It includes the hardware layer, service layer, and interface layer; The hardware layer includes a security processor, which provides business and management capabilities and provides an interactive channel to the outside world through a hardware interface. The service layer provides cryptographic suites and middleware APIs. The cryptographic suites include cryptographic computation services and cryptographic management services. The cryptographic computation services provide cryptographic-related business computing capabilities. The cryptographic management services provide scheduling and management functions for underlying cryptographic hardware devices, implement key distribution and management, and manage and monitor processor information and the processor environment. The middleware APIs define and encapsulate the functional interfaces for cryptographic computation. The interface layer is used to provide the cryptographic operation and management services provided by the cryptographic suite to external systems through a unified interface. When interacting with external systems, the interface layer provides the functions of processing and authenticating request data to ensure the security of interface access.

2. The system according to claim 1, characterized in that, The application system obtains cryptographic operation services from the cryptographic suite through a unified interface, and ensures the timeliness and stability of the cryptographic operation services through the decoupling design principle; the confidential computing device management system obtains cryptographic management services through JAVA-SDK to manage the processor in real time and monitor its status, ensuring the processor runs smoothly and effectively.

3. The system according to claim 1, characterized in that, The cryptographic operation service is executed by an HTTP server that supports multi-process or asynchronous concurrency. The HTTP server can receive and process multiple cryptographic operation requests in parallel. The cryptographic management service runs as a TCP server, communicating with the confidential computing device management system through the TCP protocol to receive and execute management instructions.

4. A method of operating the system according to any one of claims 1-3, characterized in that, The specific process is as follows: The distributed confidential computing management center pre-enters information about business application systems and authorizes interfaces. The information includes the system's identity identifier (appid). Each interface has a corresponding serial number, and the authorization status of each interface is represented by 0 and 1, where 1 indicates authorized and 0 indicates unauthorized. When authorizing interfaces of a business application system, the interfaces are selected according to their serial numbers. The authorization status of all interfaces is combined into a string based on the serial numbers, which is the interface permission field of the business application system. This string is stored in the local database through the password management service of the cryptographic suite. When a business application system calls the cryptographic computation service of the cryptographic suite through the interface provided by the interface layer, it is necessary to first verify whether the business application system has the right to call the cryptographic computation service: When a business application system calls the cryptographic computation service through an interface, the cryptographic computation service obtains the application system's identity identifier (appid) from the parameters transmitted by the application system. Then, based on the appid, it queries the corresponding interface permission field in the local database in real time. It checks the interface's authorization status based on the interface's sequence number. If the application system is found to be authorized to call the interface, the processor calls the cryptographic computation service to complete the cryptographic computation and returns the result. The cryptographic computation service records the information from this call and stores the relevant information. If the application system is found to be unauthorized to call the interface, it immediately returns an "unauthorized" error message to the application system.

5. A method of operating the system according to any one of claims 1-3, characterized in that, The specific process is as follows: The distributed confidential computing management center obtains business keys from an external key management system and distributes the keys to the confidential computing server through a secure channel; the confidential computing server receives the key data through its deployed confidential computing device management system and forwards it to the password management service. After receiving the key data, the password management service calls the security processor interface to securely inject the key into the hardware layer security processor, thus completing the key distribution and storage. After the security processor successfully receives and stores the key injected by the password management service, it will assign a unique, non-repeating identifier to the key in its protected internal storage area, i.e., the key slot. This identifier is the key index number. Business application systems request their own identity identifier (appid) and authentication key in advance through the confidential computing device management system; The confidential computing device management system forwards the results of the request, including the identity identifier (appid) and key information of the business application system, to the password management service. The password management service binds the key index number corresponding to the key to the identity identifier of the business application system and persists it in the local database; Then, the distributed confidential computing management center pre-authorizes the interfaces of the business application system, and the password management service stores the interface authorization information of the business application system in the local database. When an application system calls the cryptographic operation service of the cryptographic suite through the unified interface provided by the interface layer, it needs to perform identity authentication and authorization authentication on the business application system in each call. The specific process is as follows: When the cryptographic operation service receives a cryptographic operation request from a business application system, i.e. an HTTP request, it first verifies the identity of the request source. If the verification is successful, it retrieves the key index number information and interface authorization information bound to the identity identifier from the local database based on the identity identifier of the request source. The cryptographic operation service verifies the interface authorization information to determine whether the call is valid; if the verification fails, it returns a failure error code to the business application system. If the verification is successful, the cryptographic operation service calls the intermediate layer API and sends the key index number information; The middle-layer API parses the cryptographic operation request and sends it along with the key index number to the security processor. The security processor finds the corresponding key in its internal storage area based on the cryptographic operation request and the key index number, performs the cryptographic operation, and returns the operation result to the cryptographic operation service. The cryptographic operation service then returns the operation result to the business application system.

6. The working method according to claim 5, characterized in that, After obtaining the computation result, the cryptographic operation service records the result of this call and pushes it to the data storage area of ​​the confidential computing device management system in asynchronous mode. The confidential computing device management system pushes the call records in the data storage area to the distributed confidential computing management center. The distributed confidential computing management center collects and integrates the call record logs, parses them, and generates statistical information and displayable data.

7. The working method according to claim 5, characterized in that, When the cryptographic operation service receives a device or key management request (i.e., a TCP request) initiated by the confidential computing device management system, the cryptographic management service calls the middleware API. The middleware API parses the device or key management request and sends it to the security processor. After completing the relevant request, the security processor returns the result to the cryptographic management service, which then returns it to the confidential computing device management system.

Images