A key synchronization method and system for VSM cold migration

Abstract

The present invention provides a key synchronization method and system for VSM cold migration, the system includes a cryptographic resource pool management system, a cloud server cryptographic machine I, and a cloud server cryptographic machine II, and is used to migrate VSM from cloud server cryptographic machine I to cloud server cryptographic machine II; the cryptographic resource pool management system includes a VSM management system, a server component OMkeeper, and a key management system KMS, the cloud server cryptographic machine I includes a client component deployed with a client component OMrunner1, and the cloud server cryptographic machine II is deployed with a client component OMrunner2. The present invention supports the implementation of the VSM cold migration process, uses a reasonable asynchronous strategy in the migration process combined with a maximum effort notification mechanism and data retransmission to ensure successful key data synchronization, achieves final consistency in the key data migration process, and ensures the availability of the business system after migration.

Description

Technical Field

[0001] The present invention relates to the technical field of VSM migration, and in particular to a key synchronization method and system for VSM cold migration. Background Art

[0002] When a virtual server cryptographic machine (Virtual Security Machine, VSM) virtualized by a cloud server cryptographic machine encounters an exception or has insufficient resources, it is often necessary to migrate the VSM from one hardware device node to another. Similar to the traditional cloud computing virtual machine migration method, VSM migration is divided into two methods: cold migration and hot migration.

[0003] Starting from the scenario of VSM cold migration, migrate the virtual machines that do not use shared storage. After the migration, in addition to ensuring the normal operation of the virtual machines, the availability of encryption and decryption services must also be guaranteed. If the availability of encryption and decryption services needs to be guaranteed, in addition to ensuring the normal operation of the VSM and the cryptographic services on it, it is also necessary to implement key migration and synchronization to ensure that the VSM is consistent with the application layer status before the migration. Figure 4 The figure shows a block diagram of the existing VSM migration principle.

[0004] In the application scenario of traditional hardware server cryptographic machines, there are two ways to synchronize keys:

[0005] 1) Manual copying: This method requires the use of external storage devices to manually back up and copy key data, and then import the relevant data on the destination host in a specified manner. Although it can be copied across the network, this method is cumbersome, the execution process is prone to errors, and this method is not suitable for large-scale production scenarios in data centers;

[0006] 2) Automatic copying under plain text transmission. In the case of traditional automatic synchronization, the data transmitted between the source host and the destination host are usually in plain text, which makes the key data to be migrated at risk of data leakage (or tampering) during the migration process, and thus makes the key data between the source host and the destination host unable to be synchronized.

[0007] During the VSM migration process, the safe, complete and effective migration of core key data is an important guarantee for VSM migration. As a distributed system, the cloud server cryptographic machine cluster needs to follow the CAP principle (also known as the CAP theorem, which refers to consistency, availability, and partition tolerance in a distributed system). In the scenario of migration transactions, the cloud server cryptographic machine and cryptographic resource pool management system not only need to ensure the normal operation of the migration transaction, but also need to monitor various tasks such as data synchronization, hardware device management, and VSM management. They cannot be blocked by a certain type of transaction. Therefore, each business system should not adopt a strong consistency migration transaction strategy.

[0008] Therefore, during the VSM migration process, if the strong consistency strategy is used, it will result in:

[0009] 1. The cryptographic resource pool management system is strongly coupled with the cloud server cryptographic machine, which is not conducive to system decoupling and leads to insufficient system scalability;

[0010] 2. Strong consistency transaction mechanism can easily lead to system blockage in the event of network or data anomalies, affecting the normal operation of other businesses in the entire system.

[0011] In order to solve the above problems, people have been seeking an ideal technical solution. Summary of the invention

[0012] In view of this, in order to solve the above-mentioned deficiencies in the prior art, an object of the present invention is to provide a key synchronization method and system for VSM cold migration.

[0013] To achieve the above object, the technical solution adopted by the present invention is:

[0014] A first aspect of the present invention provides a key synchronization method for VSM cold migration, the key synchronization method for VSM cold migration comprising the following steps:

[0015] S1, the VSM management system of the password resource pool management system generates a cold migration task instruction and sends it to the server component OMkeeper of the password resource pool management system;

[0016] The key data migration side corresponding to the cold migration task instruction is the cloud server cryptographic machine I;

[0017] S2, after receiving the cold migration task instruction, the server component OMkeeper selects available physical nodes as physical nodes for deploying the cloud server cryptographic machine II;

[0018] Wherein, the cloud server cryptographic machine II is the key data migration side corresponding to the cold migration task instruction;

[0019] S3, after selecting the physical node where the cloud server cryptographic machine II is deployed, the server component OMkeeper sends the cold migration task instruction to the client component OMrunner1 of the cloud server cryptographic machine I;

[0020] S4, in response to the received cold migration task instruction, the client component OMrunner1 exports the key data in the source virtual server cryptographic machine in the cloud server cryptographic machine I;

[0021] S5, the client component OMrunner1 conducts security negotiation with the server component OMkeeper, and the server component OMkeeper synchronizes the cold migration encryption key to the client component OMrunner1 using a best effort notification mechanism;

[0022] The client component OMrunner1 encrypts the key data using the cold migration encryption key to obtain a ciphertext of the key data;

[0023] S6, the client component OMrunner1 transmits the ciphertext of the key data to the client component OMrunner2 of the cloud server cryptographic machine II, and notifies the server component OMkeeper;

[0024] S7, the server component OMkeeper sends a shutdown instruction to the client component OMrunner1; wherein the shutdown instruction is used to make the client component OMrunner1 shut down the source virtual server password;

[0025] The client component OMrunner1 exports the non-sensitive data in the virtual server cryptographic machine and migrates it to the client component OMrunner2;

[0026] After receiving the non-sensitive data, the client component OMrunner2 creates a new virtual server cryptographic machine;

[0027] S8, after creating a new virtual server cryptographic machine, the client component OMrunner2 requests the server component OMkeeper for a cold migration decryption key;

[0028] S9, the client component OMrunner2 conducts security negotiation with the server component OMkeeper, and the server component OMkeeper synchronizes the cold migration decryption key to the client component OMrunner2 using a best effort notification mechanism;

[0029] The client component OMrunner2 decrypts the key data ciphertext using the cold migration decryption key to obtain the key data plaintext;

[0030] S10, the client component OMrunner2 imports the decrypted key data in plain text into the new virtual server cryptographic machine, and notifies the server component OMkeeper;

[0031] S11, the server component OMkeeper sends a startup instruction to the client component OMrunner2 to start a new virtual server cryptographic machine.

[0032] The second aspect of the present invention provides a cryptographic resource pool management system, the system includes a VSM management system, a server component OMkeeper and a key management system KMS, the server component OMkeeper is connected to the VSM management system and the key management system KMS respectively; wherein,

[0033] The VSM management system is used to generate a cold migration task instruction and send it to the server component OMkeeper; wherein the key data migration side corresponding to the cold migration task instruction is the cloud server cryptographic machine I;

[0034] The server-side component OMkeeper is used to select available physical nodes as physical nodes for deploying cloud server cryptographic machine II after receiving the cold migration task instruction from the VSM management system; it is also used to send the cold migration task instruction to the client component OMrunner1 of the cloud server cryptographic machine I after selecting the physical nodes for deploying cloud server cryptographic machine II; it is also used to negotiate with the client component OMrunner1 securely and synchronize the cold migration encryption key to the client component OMrunner1 using the best effort notification mechanism; it is also used to send a shutdown instruction to the client component OMrunner1 after receiving the key data ciphertext synchronization result from the client component OMrunner1; it is also used to respond to the cold migration decryption key acquisition request from the client component OMrunner2, and negotiate with the client component OMrunner2 securely and synchronize the cold migration decryption key to the client component OMrunner2 using the best effort notification mechanism; it is also used to send a startup instruction to the client component OMrunner2 after receiving the VSM migration result from the client component OMrunner2 to start the new virtual server cryptographic machine;

[0035] The cloud server cryptographic machine II is the key data migration side corresponding to the cold migration task instruction, and the shutdown instruction is used to make the client component OMrunner1 shut down the source virtual server cryptographic machine;

[0036] The key management system KMS is used to transmit the cold migration encryption key and the cold migration decryption key to the server component OMkeeper.

[0037] The third aspect of the present invention provides a key synchronization system for VSM cold migration, the system comprising a cryptographic resource pool management system, a cloud server cryptographic machine I and a cloud server cryptographic machine II, the cryptographic resource pool management system comprising a VSM management system, a server component OMkeeper and a key management system KMS, the cloud server cryptographic machine I side is deployed with a client component OMrunner1 and a virtual server cryptographic machine, the cloud server cryptographic machine II side is deployed with a client component OMrunner2;

[0038] The VSM management system is connected to the server component OMkeeper, and the server component OMkeeper is respectively connected to the VSM management system, the client component OMrunner1 and the client component OMrunner2, and the steps of the above-mentioned VSM cold migration key synchronization method are executed to migrate the VSM from the cloud server cryptographic machine I to the cloud server cryptographic machine II.

[0039] The beneficial effects of the present invention are:

[0040] 1) The present invention deploys a migration scheduling service in the physical node of the cryptographic resource pool management system, and combines the client component for migration scheduling deployed on the cloud server cryptographic machine side to support the cold migration task of VSM. In the process of implementing the VSM cold migration task, a reasonable asynchronous strategy is used in combination with a best effort notification mechanism and a data retransmission mechanism to achieve safe, complete and effective cold migration of key data and non-sensitive data between VSMs, thereby avoiding the leakage or tampering of key data to be migrated during the migration process, ensuring the synchronization of key data between the source virtual server cryptographic machine and the destination virtual server cryptographic machine, so as to ensure that the VSM is consistent with the application layer state before the migration;

[0041] 2) The present invention automatically and quickly executes the cold migration task according to the cold migration task instruction, and can ensure the availability of the encryption and decryption service system after the cold migration task is completed, thereby ensuring the continuity of the encryption and decryption service, and is suitable for large-scale production scenarios in data centers;

[0042] 3) In the present invention, key data and non-sensitive data are synchronized step by step using different strategies, which prevents business coupling and blocking and ensures the normal operation of system business. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0044] Figure 1 The principle flow of the key synchronization method for VSM cold migration of the present invention Figure 1 ;

[0045] Figure 2 The principle flow of the key synchronization method for VSM cold migration of the present invention Figure 2 ;

[0046] Figure 3 It is a principle block diagram of the key synchronization system of VSM cold migration of the present invention;

[0047] Figure 4 Migrate the existing VSM to the schematic diagram. DETAILED DESCRIPTION

[0048] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0049] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0050] QGA, the full name of which is qemu guest agent, is a common application running inside a virtual machine. It enables communication between the host libvirt and the virtual machine. The host can control the virtual machine by sending commands to qga in the virtual machine.

[0051] Example 1

[0052] Attached Figure 1 and attached Figure 2 A flow chart showing a key synchronization method for VSM cold migration is shown;

[0053] The key synchronization method of VSM cold migration performs the following steps to migrate VSM from cloud server cryptographic machine I to cloud server cryptographic machine II through the server component OMkeeper of the cryptographic resource pool management system, the client component OMrunner1 of cloud server cryptographic machine I, and the client component OMrunner2 of cloud server cryptographic machine II:

[0054] S1, the VSM management system of the password resource pool management system generates a cold migration task instruction and sends it to the server component OMkeeper of the password resource pool management system;

[0055] The key data migration side corresponding to the cold migration task instruction is the cloud server cryptographic machine I;

[0056] S2, after receiving the cold migration task instruction, the server component OMkeeper selects available physical nodes as physical nodes for deploying the cloud server cryptographic machine II;

[0057] Wherein, the cloud server cryptographic machine II is the key data migration side corresponding to the cold migration task instruction;

[0058] It can be understood that before the server-side component OMkeeper receives the cold migration task instruction, the physical node where the key data is migrated to (cloud server cryptographic machine II) is not determined; in response to the received cold migration task instruction, the server-side component OMkeeper selects an available physical node as the physical node for deploying the cloud server cryptographic machine II according to requirements such as physical resources, memory size, and processing power;

[0059] S3, after selecting the physical node where the cloud server cryptographic machine II is deployed, the server component OMkeeper sends the cold migration task instruction to the client component OMrunner1 of the cloud server cryptographic machine I;

[0060] S4, in response to the received cold migration task instruction, the client component OMrunner1 calls the local application QGA to export the key data in the source virtual server cryptographic machine VSMn1 in the cloud server cryptographic machine I;

[0061] S5, the client component OMrunner1 conducts security negotiation with the server component OMkeeper, and the server component OMkeeper synchronizes the cold migration encryption key to the client component OMrunner1 using a best effort notification mechanism;

[0062] The client component OMrunner1 calls the PCIE card, encrypts the key data using the cold migration encryption key, and obtains the key data ciphertext;

[0063] S6, the client component OMrunner1 calls the data synchronization interface of the client component OMrunner2, transmits the key data ciphertext to the client component OMrunner2 of the cloud server cryptographic machine II, and transmits the key data ciphertext synchronization result to the server component OMkeeper, so as to notify the server component OMkeeper at the same time;

[0064] S7, after receiving the key data ciphertext synchronization result, the server component OMkeeper sends a shutdown command to the client component OMrunner1, and records the resource consumption of the cloud server cryptographic machine II;

[0065] The key data ciphertext synchronization result means that the key data ciphertext has been synchronized, and the shutdown instruction is used to make the client component OMrunner1 shut down the source virtual server cryptographic machine VSMn1;

[0066] The client component OMrunner1 exports the non-sensitive data in the virtual server cryptographic machine VSMn1 and migrates it to the client component OMrunner2;

[0067] After receiving the non-sensitive data, the client component OMrunner2 creates a new virtual server cryptographic machine VSMn2;

[0068] S8, after creating a new virtual server cryptographic machine VSMn2, the client component OMrunner2 requests the server component OMkeeper for a cold migration decryption key;

[0069] Wherein, the cold migration decryption key is set corresponding to the cold migration encryption key;

[0070] S9, the client component OMrunner2 conducts security negotiation with the server component OMkeeper, and the server component OMkeeper synchronizes the cold migration decryption key to the client component OMrunner2 using a best effort notification mechanism;

[0071] The client component OMrunner2 calls the PCIE card and uses the cold migration decryption key to decrypt the key data ciphertext to obtain the key data plaintext;

[0072] S10, the client component OMrunner2 imports the decrypted key data in plain text into the new virtual server cryptographic machine VSMn2 by calling the local application QGA, and transmits the VSM migration result to the server component OMkeeper to notify the server component OMkeeper;

[0073] S11, after receiving the VSM migration result, the server component OMkeeper sends a startup instruction to the client component OMrunner2 to start the new virtual server cryptographic machine VSMn2;

[0074] The server component OMkeeper also transmits a notification that the VSM cold migration task has been completed to the VSM management system;

[0075] Among them, the VSM migration result means that the VSM cold migration task has been completed (the key synchronization task of migrating VSM from cloud server cryptographic machine I to cloud server cryptographic machine II has been completed).

[0076] Specifically, the non-sensitive data refers to memory status, CPU status, disk status, I / O devices, and network resources, etc., and the key data refers to basic key data used to generate keys required for encryption and decryption services.

[0077] It can be understood that during the execution of a cold migration task instruction, the key data exported from the source virtual server cryptographic machine VSMn1 and the plaintext key data imported into the new virtual server cryptographic machine VSMn2 need to be ensured to be consistent. Ensuring the consistency of the two can ensure the availability and continuity of the encryption and decryption services between cloud server cryptographic machine I and cloud server cryptographic machine II.

[0078] In this embodiment, since the encryption and decryption keys transmitted during the execution of the cold migration task instruction need to ensure final consistency, the cold migration encryption key in step S5 and the cold migration decryption key in step S9 are both transmitted using the best effort notification mechanism; the message queue cannot be used for the transmission of encryption and decryption keys because the message queue may persist the encryption and decryption keys, which may lead to the leakage of encryption and decryption keys. For other data interactions except step S5 and step S9, since they are mostly asynchronous, the consistency is guaranteed by the message queue.

[0079] Furthermore, the step S1 includes the following steps:

[0080] S101, the VSM management system of the cryptographic resource pool management system generates a cold migration task instruction and transmits it to the server-side component OMkeeper of the cryptographic resource pool management system; wherein the migration task corresponding to the cold migration task instruction is configured to be executed asynchronously;

[0081] S102, the server component OMkeeper generates a VSM migration transaction ID corresponding to the cold migration task instruction using a snowflake algorithm, and persists the VSM migration transaction ID, transaction type and transaction status to a local database of the server component OMkeeper;

[0082] The transaction type is Migration, and the initial state of the transaction state is pending notification;

[0083] S103, the server-side component OMkeeper adds the migration task corresponding to the cold migration task instruction to the local task execution queue, executes the migration task in the task order, and returns the VSM migration transaction ID corresponding to the cold migration task instruction to the VSM management system for the VSM management system to query the migration task status;

[0084] Among them, the migration task status includes completed, in progress and to be executed. In progress, it includes that the cold migration encryption key has been synchronized, the key data ciphertext has been synchronized, the non-sensitive data has been synchronized, the cold migration decryption key has been synchronized, the new virtual server cryptographic machine VSMn2 has been initialized, the source virtual server cryptographic machine VSMn1 has been deleted, and the VSM cold migration task has been completed.

[0085] It should be noted that the VSM management system obtains the migration task status based on the VSM migration transaction ID by querying the task status acquisition interface of the server-side component OMkeeper, so that the VSM management system can grasp the migration task status corresponding to each VSM migration transaction ID, so as to allocate VSM migration tasks when multiple migration tasks need to be executed, ensuring that each migration task is carried out in an orderly and smooth manner.

[0086] Furthermore, the step S3 includes the following steps:

[0087] S301, the server component OMkeeper of the cryptographic resource pool management system sends the cold migration task instruction and notification migration transaction to the client component OMrunner1 of the cloud server cryptographic machine I, and the notification content includes the VSM migration transaction ID, transaction type and transaction status;

[0088] S302, the server component OMkeeper determines whether a correct response is received from the client component OMrunner1.

[0089] If the server-side component OMkeeper does not receive a transaction response from the client-side component OMrunner1 within a preset time, or the received response result is incorrect (garbled or not in the preset format), the transaction status corresponding to the VSM migration transaction ID in the local database is set to unable to migrate, and the process ends;

[0090] If the server component OMkeeper receives a correct response (in a preset format) from the client component OMrunner1 within a preset time, the server component OMkeeper sets the transaction status corresponding to the VSM migration transaction ID in the local database to notified.

[0091] It can be understood that a cold migration task instruction corresponds to a VSM migration transaction ID and a physical node where the cloud server cryptographic machine II is deployed. The transaction status corresponding to the VSM migration transaction ID includes pending notification (initial status), notified, and unable to migrate.

[0092] Furthermore, the step S5 includes the following steps:

[0093] S501, the client component OMrunner1 adds the received migration transaction (from the server component OMkeeper) to the local task execution queue, and configures: the client component OMrunner1 synchronizes the task execution status to the server component OMkeeper corresponding to each stage of the migration transaction execution (cold migration encryption key synchronization stage, key data ciphertext synchronization stage, non-sensitive data synchronization stage, and source virtual server cipher machine deletion stage, etc.);

[0094] S502, the client component OMrunner1 executes the migration transaction according to the sequence of the local task execution queue, and initiates a cold migration encryption key acquisition request to the server component OMkeeper according to the migration transaction to obtain the cold migration encryption key required for VSM migration;

[0095] The server component OMkeeper adds the key synchronization task corresponding to the cold migration encryption key acquisition request to the local key synchronization task queue;

[0096] S503, the server component OMkeeper executes the key synchronization task according to the local key synchronization task queue, and initiates a symmetric key generation request to the key management system KMS; wherein the symmetric key generation request includes the VSM migration transaction ID;

[0097] In response to the received symmetric key generation request, the key management system KMS generates a cold migration encryption key required for the current VSM cold migration task, and transmits it to the server component OMkeeper;

[0098] The server-side component OMkeeper establishes a binding relationship between the VSM migration transaction ID and the physical node where the cloud server cryptographic machine II is deployed, and the cold migration encryption key establishes a binding relationship between the VSM migration transaction ID and the cold migration encryption key;

[0099] S504, after the server component OMkeeper establishes a secure channel with the client component OMrunner1, the server component OMkeeper uses a best effort notification mechanism to synchronize the cold migration encryption key with the client component OMrunner1 and performs message verification;

[0100] S505, after receiving the cold migration encryption key, the client component OMrunner1 continues to perform the migration task, uses the SM3 national encryption algorithm to perform a digest operation on the key data exported from the source virtual server cryptographic machine VSMn1, and generates summary data of the key data;

[0101] S506, the client component OMrunner1 encrypts the key data and the corresponding summary data based on the cold migration encryption key using the SM4 national encryption algorithm to generate a key data ciphertext.

[0102] It should be noted that a VSM cold migration task corresponds to a pair of cold migration encryption keys and cold migration decryption keys, and the cold migration encryption key is temporarily generated based on a symmetric key generation request trigger; one-time one-key, different VSM cold migration tasks correspond to different cold migration encryption keys and cold migration decryption keys to ensure the security and reliability of the cold migration process.

[0103] Furthermore, in step S504 of step S5, when the server component OMkeeper synchronizes the cold migration encryption key to the client component OMrunner1 using the best effort notification mechanism and performs message verification, the following is executed:

[0104] The server component OMkeeper initiates an Https request to the client component OMrunner1 to establish a secure channel between the server component OMkeeper and the client component OMrunner1;

[0105] After establishing a secure channel, the server component OMkeeper sends the cold migration encryption key and the corresponding migration transaction ID to the client component OMrunner1 through the secure channel;

[0106] After receiving the cold migration encryption key and the corresponding migration transaction ID, the client component OMrunner1 returns a data reception response to the server component OMkeeper;

[0107] If the client component OMrunner1 does not return a data reception response to the server component OMkeeper within a preset T0 second (e.g., 10 seconds), the server component OMkeeper initiates a retry, with a maximum of N retries (e.g., 3 times);

[0108] After receiving the data reception response from the client component OMrunner1 within the preset T0 seconds (for example, 10s), the server component OMkeeper initiates a message verification to the client component OMrunner1 to confirm that the client component OMrunner1 of the cloud server cryptographic machine I has received the cold migration encryption key required for the current VSM cold migration task and updates the migration task status.

[0109] It should be noted that the best effort notification mechanism used in this embodiment refers to the server component OMkeeper repeating the notification if no reply is received, and sending a confirmation request after receiving the reply to make it clear that the other party (client component OMrunner1 or client component OMrunner2) has received the notification message to ensure the final consistency of the encryption and decryption key transmission.

[0110] Further, the step S7 includes the following steps:

[0111] S701, the client component OMrunner1 forwards the key data ciphertext synchronization result from the client component OMrunner2 to the server component OMkeeper; wherein the key data ciphertext synchronization result is generated by the client component OMrunner2 after receiving the key data ciphertext;

[0112] After receiving the key data ciphertext synchronization result, the server component OMkeeper sends a shutdown instruction to the client component OMrunner1;

[0113] In response to the received shutdown instruction, the client component OMrunner1 shuts down the source virtual server cryptographic machine VSMn1;

[0114] The client component OMrunner1 also exports and packages the non-sensitive data in the VSM hard disk of the virtual server cryptographic machine VSMn1, and calls the non-sensitive data synchronization interface of the client component OMrunner2 to transmit the non-sensitive data to the client component OMrunner2;

[0115] After the transmission is completed, the client component OMrunner2 performs a non-sensitive data integrity check and returns the integrity check result to the client component OMrunner1;

[0116] S702, after receiving the integrity check result returned by the client component OMrunner2, the client component OMrunner1 synchronizes the non-sensitive data transmission status with the server component OMkeeper;

[0117] S703, if the non-sensitive data transmission status received by the server-side component OMkeeper is completed, then notify the client-side component OMrunner2 of relevant transaction information; wherein the relevant transaction information refers to an instruction to trigger the creation of a new virtual server cryptographic machine VSMn2;

[0118] The client component OMrunner2 creates a new virtual server cryptographic machine VSMn2 based on the non-sensitive data and VSM configuration information.

[0119] The VSM configuration information comes from the server component OMkeeper, or is manually imported by a user; the specific content of the VSM configuration information is an existing technology known to those skilled in the art, and will not be described in detail here.

[0120] When the client component OMrunner2 performs non-sensitive data integrity verification, technical personnel in this field usually use MD (Message Digest), SHA (Secure Hash Algorithm) or MAC (Message Authentication Code) to verify the integrity of the data; therefore, this embodiment will not repeat the specific steps of the non-sensitive data integrity verification.

[0121] It should be noted that, in order to avoid key data leakage, after obtaining the key data ciphertext required for the current VSM cold migration task, the client component OMrunner2 does not immediately request the cold migration decryption key from the server component OMkeeper, but first saves the key data ciphertext, and only obtains the cold migration decryption key after completing the synchronization of non-sensitive data and the establishment of the new virtual server cryptographic machine VSMn2, and decrypts the key data ciphertext in the new virtual server cryptographic machine VSMn2.

[0122] Further, the step S8 includes the following steps:

[0123] S801, after the new virtual server cryptographic machine VSMn2 is created, the client component OMrunner2 initiates a cold migration decryption key acquisition request to the server component OMkeeper;

[0124] In response to the received cold migration decryption key acquisition request, the server component OMkeeper adds the key synchronization task corresponding to the cold migration decryption key acquisition request to the key synchronization task queue;

[0125] S802, the server component OMkeeper executes the key synchronization task according to the key synchronization task queue. When executing the key synchronization task, the server component OMkeeper obtains the VSM migration transaction ID based on the physical node information of the cold migration decryption key acquisition request and the binding relationship;

[0126] The binding relationship refers to the binding relationship between the VSM migration transaction ID established by the server-side component OMkeeper and the physical node where the cloud server cryptographic machine II is deployed;

[0127] S803, the server component OMkeeper requests the cold migration decryption key (required for the current VSM cold migration task) from the key management system KMS based on the obtained VSM migration transaction ID;

[0128] S804, the key management system KMS searches for the corresponding cold migration encryption key based on the pre-established binding relationship between the VSM migration transaction ID and the cold migration encryption key, and returns it as the cold migration decryption key to the server component OMkeeper.

[0129] Furthermore, the step S9 includes the following steps:

[0130] S901, the server component OMkeeper establishes a secure channel with the client component OMrunner2, and the server component OMkeeper uses a best effort notification mechanism to synchronize the cold migration decryption key (required for the VSM cold migration task) to the client component OMrunner2, and finally completes the proofreading;

[0131] S902, after receiving the cold migration decryption key, the client component OMrunner2 uses the cold migration decryption key to decrypt the key data ciphertext to obtain the key data plaintext and corresponding summary data;

[0132] S903, the client component OMrunner2 uses the SM3 national encryption algorithm to perform a digest operation on the decrypted key data plaintext, and determines whether the calculated digest data is consistent with the decrypted digest data;

[0133] It can be understood that the client component OMrunner2 determines whether the calculated summary data is consistent with the decrypted summary data. If they are consistent, it means that the key data received by the client component OMrunner2 has not been tampered with, and the VSM cold migration task can continue to be executed; otherwise, the VSM cold migration task is suspended and the business is rolled back.

[0134] It should be noted that the cold migration decryption key and the cold migration encryption key corresponding to the same VSM cold migration task are the same. When executing the key synchronization task, the key management system KMS does not need to generate the key again. The key management system KMS can read the cold migration decryption key required for the current VSM cold migration task according to the VSM migration transaction ID, thereby shortening the cold migration decryption key synchronization time and improving the execution efficiency of the cold migration task.

[0135] Furthermore, in step S903 of step S9, the process of synchronizing the cold migration decryption key to the client component OMrunner2 by the server-side component OMkeeper using the maximum effort notification mechanism is similar to the process of synchronizing the cold migration encryption key to the client component OMrunner1 by the server-side component OMkeeper using the maximum effort notification mechanism in step S504 of step S5, and will not be repeated here.

[0136] Furthermore, the step S10 includes the following steps:

[0137] S1001, after confirming that the calculated summary data is consistent with the decrypted summary data, the client component OMrunner2 imports the decrypted key data in plain text into the new virtual server cryptographic machine VSMn2 through the local application QGA;

[0138] S1002, the new virtual server cryptographic machine VSMn2 is initialized using the key data in plain text; at this time, the new virtual server cryptographic machine VSMn2 operates normally;

[0139] The client component OMrunner2 notifies the server component OMkeeper of the new virtual server cryptographic machine VSMn2 status;

[0140] The server component OMkeeper changes the task status and sends a VSM deletion notification to the client component OMrunner1;

[0141] S1003, after receiving the VSM deletion notification, the client component OMrunner1 deletes the original virtual server cryptographic machine VSMn1, releases resources and notifies the server component OMkeeper to update the task status;

[0142] S1004, the server-side component OMkeeper updates the resource quota on the cloud server cryptographic machine I and sets the current VSM cold migration task status to completed;

[0143] At this point, the key synchronization task for the entire VSM cold migration is completed.

[0144] Furthermore, step S1002 of step S10 further includes the following steps:

[0145] In the previous VSM cold migration task process, if any step is abnormal, the migration task execution of each node will be stopped and the business will be automatically rolled back;

[0146] The server-side component OMkeeper records the task execution status, and the VSM management system re-initiates the cold migration task instruction to the server-side component OMkeeper.

[0147] It should be noted that, in this embodiment, a rollback mechanism is set during the VSM cold migration task process to ensure that the VSM cold migration task is executed smoothly and accurately, and to avoid stagnation of the entire VSM cold migration task due to an abnormality in a certain step.

[0148] Example 2

[0149] It should be noted that, based on Example 1, this example provides a specific implementation of a cryptographic resource pool management system;

[0150] Specifically, the cryptographic resource pool management system includes a VSM management system, a server component OMkeeper and a key management system KMS, wherein the server component OMkeeper is connected to the VSM management system and the key management system KMS respectively; wherein,

[0151] The VSM management system is used to generate a cold migration task instruction and send it to the server component OMkeeper; wherein the key data migration side corresponding to the cold migration task instruction is the cloud server cryptographic machine I;

[0152] The server-side component OMkeeper is used to screen out available physical nodes as physical nodes for deploying the cloud server cryptographic machine II after receiving the cold migration task instruction from the VSM management system; it is also used to send the cold migration task instruction to the client component OMrunner1 of the cloud server cryptographic machine I after screening out the physical nodes for deploying the cloud server cryptographic machine II; it is also used to respond to the cold migration encryption key acquisition request from the client component OMrunner1, to negotiate with the client component OMrunner1 securely, and to synchronize the cold migration encryption key to the client component OMrunner1 using the best effort notification mechanism; it is also used to receive the cold migration encryption key acquisition request from the client component OMrunner1, ... After receiving the key data ciphertext synchronization result of the client component OMrunner1, the server component OMkeeper sends a shutdown command to the client component OMrunner1; it is also used to respond to the cold migration decryption key acquisition request from the client component OMrunner2, and negotiate with the client component OMrunner2 securely, and use the best effort notification mechanism to synchronize the cold migration decryption key to the client component OMrunner2; it is also used to send a startup command to the client component OMrunner2 after receiving the VSM migration result from the client component OMrunner2, so as to start the new virtual server cryptographic machine VSMn2;

[0153] The cloud server cryptographic machine II is the key data migration side corresponding to the cold migration task instruction, and the shutdown instruction is used to make the client component OMrunner1 shut down the source virtual server cryptographic machine VSMn1;

[0154] The key management system KMS is used to generate a cold migration encryption key, and transmit the cold migration encryption key and the cold migration decryption key to the server component OMkeeper.

[0155] It should be noted that the server-side component OMkeeper is also specifically used for:

[0156] Generate a VSM migration transaction ID corresponding to the cold migration task instruction, and establish a binding relationship between the VSM migration transaction ID and the physical node where the cloud server cryptographic machine II is deployed;

[0157] Acquire the VSM migration transaction ID based on the physical node information of the sending cold migration decryption key acquisition request and the binding relationship;

[0158] A cold migration decryption key application request carrying the VSM migration transaction ID is sent to the key management system KMS.

[0159] Example 3

[0160] It should be noted that, based on Example 1, this example provides a specific implementation of a key synchronization system for VSM cold migration, as shown in the attached figure. Figure 3 As shown;

[0161] The key synchronization system of the VSM cold migration includes a cryptographic resource pool management system, a cloud server cryptographic machine I and a cloud server cryptographic machine II. The cryptographic resource pool management system includes a VSM management system, a server component OMkeeper and a key management system KMS. The cloud server cryptographic machine I is deployed with a client component OMrunner1 and a virtual server cryptographic machine VSMn1, and the cloud server cryptographic machine II is deployed with a client component OMrunner2.

[0162] The VSM management system is connected to the server component OMkeeper, and the server component OMkeeper is respectively connected to the VSM management system, the client component OMrunner1 and the client component OMrunner2, and the steps of the key synchronization method for VSM cold migration in Example 1 are executed to migrate the VSM from cloud server cryptographic machine I to cloud server cryptographic machine II.

[0163] It can be understood that the system specifically deploys the migration scheduling service in the physical node of the cryptographic resource pool management system, and combines the client components for migration scheduling deployed on the cloud server cryptographic machine side to support the cold migration process of VSM. During the migration process, a reasonable asynchronous strategy is used in combination with the maximum effort notification mechanism and data retransmission to ensure the successful synchronization of key data, achieve the final consistency of the key data migration process, and ensure the availability of the business system after migration.

[0164] It can be understood that the server-side component OMkeeper is located in the physical node of the cryptographic resource pool management system and provides migration scheduling services. The server-side component OMkeeper combines with the client components OMrunner1 and OMrunner2 provided on the cloud server cryptographic machine side to support the cold migration process of VSM; the key management system KMS is used to implement key requests and synchronization between the server-side component OMkeeper and the client components OMrunner1 and OMrunner2.

[0165] Further, when an exception occurs in the VSM cold migration task, the VSM management system, the server component OMkeeper, the key management system KMS, the client component OMrunner1 or the client component OMrunner2 stops executing the migration task and performs a business rollback;

[0166] The server-side component OMkeeper records the task execution status, and the VSM management system re-initiates the cold migration task instruction to the server-side component OMkeeper.

[0167] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A key synchronization method for VSM cold migration, characterized in that: The following steps are involved: S1, the VSM management system of the password resource pool management system generates a cold migration task instruction and sends it to the server component OMkeeper of the password resource pool management system; The key data migration side corresponding to the cold migration task instruction is the cloud server cryptographic machine I; S2, after receiving the cold migration task instruction, the server component OMkeeper selects available physical nodes as physical nodes for deploying the cloud server cryptographic machine II; Wherein, the cloud server cryptographic machine II is the key data migration side corresponding to the cold migration task instruction; S3, after selecting the physical node where the cloud server cryptographic machine II is deployed, the server component OMkeeper sends the cold migration task instruction to the client component OMrunner1 of the cloud server cryptographic machine I; S4, in response to the received cold migration task instruction, the client component OMrunner1 exports the key data in the source virtual server cryptographic machine in the cloud server cryptographic machine I; S5, the client component OMrunner1 conducts security negotiation with the server component OMkeeper, and the server component OMkeeper synchronizes the cold migration encryption key to the client component OMrunner1 using a best effort notification mechanism; The client component OMrunner1 encrypts the key data using the cold migration encryption key to obtain a ciphertext of the key data; S6, the client component OMrunner1 transmits the ciphertext of the key data to the client component OMrunner2 of the cloud server cryptographic machine II, and notifies the server component OMkeeper; S7, the server component OMkeeper sends a shutdown instruction to the client component OMrunner1; wherein the shutdown instruction is used to make the client component OMrunner1 shut down the source virtual server password; The client component OMrunner1 exports the non-sensitive data in the virtual server cryptographic machine and migrates it to the client component OMrunner2; After receiving the non-sensitive data, the client component OMrunner2 creates a new virtual server cryptographic machine; S8, after creating a new virtual server cryptographic machine, the client component OMrunner2 requests the server component OMkeeper for a cold migration decryption key; S9, the client component OMrunner2 conducts security negotiation with the server component OMkeeper, and the server component OMkeeper synchronizes the cold migration decryption key to the client component OMrunner2 using a best effort notification mechanism; The client component OMrunner2 decrypts the key data ciphertext using the cold migration decryption key to obtain the key data plaintext; S10, the client component OMrunner2 imports the decrypted key data in plain text into the new virtual server cryptographic machine, and notifies the server component OMkeeper; S11, the server component OMkeeper sends a startup instruction to the client component OMrunner2 to start a new virtual server cryptographic machine.

2. The key synchronization method for VSM cold migration according to claim 1, characterized in that: The step S1 comprises the following steps: S101, the VSM management system of the cryptographic resource pool management system generates a cold migration task instruction and transmits it to the server-side component OMkeeper of the cryptographic resource pool management system; wherein the migration task corresponding to the cold migration task instruction is configured to be executed asynchronously; S102, the server component OMkeeper generates a VSM migration transaction ID corresponding to the cold migration task instruction, and persists the VSM migration transaction ID, transaction type and transaction status to a local database; S103, the server-side component OMkeeper adds the migration task corresponding to the cold migration task instruction to the local task execution queue, executes the migration task in the task order, and returns the VSM migration transaction ID corresponding to the cold migration task instruction to the VSM management system for the VSM management system to query the migration task status.

3. The key synchronization method for VSM cold migration according to claim 2, characterized in that: The step S3 comprises the following steps: S301, the server component OMkeeper of the cryptographic resource pool management system sends the cold migration task instruction and notification migration transaction to the client component OMrunner1 of the cloud server cryptographic machine I, and the notification content includes the VSM migration transaction ID, transaction type and transaction status; S302, if the server-side component OMkeeper does not receive a transaction response from the client component OMrunner1 within a preset time, or the received response result is incorrect, the transaction state corresponding to the VSM migration transaction ID in the local database is set to unable to migrate, and the process ends; If the server-side component OMkeeper receives a correct response from the client-side component OMrunner1 within a preset time, the server-side component OMkeeper sets the transaction status corresponding to the VSM migration transaction ID in the local database to notified.

4. The key synchronization method for VSM cold migration according to claim 3, characterized in that: The step S5 comprises the following steps: S501, the client component OMrunner1 adds the received migration transaction to the local task execution queue; S502, the client component OMrunner1 executes the migration transaction according to the order of the local task execution queue, and initiates a cold migration encryption key acquisition request to the server component OMkeeper according to the migration transaction; The server component OMkeeper adds the key synchronization task corresponding to the cold migration encryption key acquisition request to the key synchronization task queue; S503, the server component OMkeeper executes the key synchronization task according to the key synchronization task queue, and initiates a symmetric key generation request to the key management system KMS; wherein the symmetric key generation request includes the VSM migration transaction ID; In response to the received symmetric key generation request, the key management system KMS generates a cold migration encryption key required for the VSM cold migration task and transmits it to the server component OMkeeper; The server-side component OMkeeper establishes a binding relationship between the VSM migration transaction ID and the physical node where the cloud server cryptographic machine II is deployed, and the cold migration encryption key establishes a binding relationship between the VSM migration transaction ID and the cold migration encryption key; S504, after the server component OMkeeper establishes a secure channel with the client component OMrunner1, the server component OMkeeper synchronizes the cold migration encryption key to the client component OMrunner1 using a best effort notification mechanism; S505, after receiving the cold migration encryption key, the client component OMrunner1 uses the SM3 national encryption algorithm to perform a digest operation on the key data exported from the source virtual server cryptographic machine to generate summary data of the key data; S506, the client component OMrunner1 encrypts the key data and the corresponding summary data based on the cold migration encryption key using the SM4 national encryption algorithm to generate a key data ciphertext.

5. The key synchronization method for VSM cold migration according to claim 4, characterized in that: The step S7 comprises the following steps: S701, the client component OMrunner1 forwards the key data ciphertext synchronization result from the client component OMrunner2 to the server component OMkeeper; After receiving the key data ciphertext synchronization result, the server component OMkeeper sends a shutdown instruction to the client component OMrunner1; In response to the received shutdown instruction, the client component OMrunner1 shuts down the source virtual server password; The client component OMrunner1 also exports and packages the non-sensitive data in the VSM hard disk and transmits it to the client component OMrunner2; S702, after receiving the integrity check result returned by the client component OMrunner2, the client component OMrunner1 synchronizes the non-sensitive data transmission status with the server component OMkeeper; S703: If the non-sensitive data transmission status received by the server-side component OMkeeper is completed, the client-side component OMrunner2 is notified to create a new virtual server cryptographic machine.

6. The key synchronization method for VSM cold migration according to claim 5, characterized in that: The step S8 comprises the following steps: S801, after the new virtual server cryptographic machine is created, the client component OMrunner2 initiates a cold migration decryption key acquisition request to the server component OMkeeper; In response to the received cold migration decryption key acquisition request, the server component OMkeeper adds the key synchronization task corresponding to the cold migration decryption key acquisition request to the key synchronization task queue; S802, when executing the key synchronization task, the server component OMkeeper obtains the VSM migration transaction ID based on the physical node information of the sending cold migration decryption key acquisition request and the binding relationship; S803, the server component OMkeeper requests the cold migration decryption key from the key management system KMS based on the obtained VSM migration transaction ID; S804, the key management system KMS searches for the corresponding cold migration encryption key based on the pre-established binding relationship between the VSM migration transaction ID and the cold migration encryption key, and returns the cold migration decryption key to the server component OMkeeper.

7. The key synchronization method for VSM cold migration according to claim 6, characterized in that: The step S9 comprises the following steps: S901, after the server component OMkeeper establishes a secure channel with the client component OMrunner2, the server component OMkeeper synchronizes the cold migration decryption key to the client component OMrunner2 using a best effort notification mechanism; S902, after receiving the cold migration decryption key, the client component OMrunner2 uses the cold migration decryption key to decrypt the key data ciphertext to obtain the key data plaintext and corresponding summary data; S903, the client component OMrunner2 uses the SM3 national encryption algorithm to perform a digest operation on the decrypted key data plaintext, and determines whether the calculated digest data is consistent with the decrypted digest data; If they are inconsistent, the business will be rolled back.

8. The key synchronization method for VSM cold migration according to claim 7, characterized in that: The step S10 comprises the following steps: S1001, after confirming that the calculated summary data is consistent with the decrypted summary data, the client component OMrunner2 imports the key data in plain text into the new virtual server cryptographic machine; S1002, the new virtual server cryptographic machine uses the key data plain text to initialize VSM; The client component OMrunner2 notifies the server component OMkeeper of the new virtual server cryptographic machine status, and the server component OMkeeper changes the task status and sends a VSM deletion notification to the client component OMrunner1; S1003, after receiving the VSM deletion notification, the client component OMrunner1 deletes the source virtual server cryptographic machine, releases resources and notifies the server component OMkeeper to update the task status; S1004, the server-side component OMkeeper updates the resource quota on the cloud server cryptographic machine I and sets the current VSM cold migration task status to completed.

9. A cryptographic resource pool management system, characterized in that: It includes a VSM management system, a server component OMkeeper and a key management system KMS, wherein the server component OMkeeper is connected to the VSM management system and the key management system KMS respectively; wherein, The VSM management system is used to generate a cold migration task instruction and send it to the server component OMkeeper; wherein the key data migration side corresponding to the cold migration task instruction is the cloud server cryptographic machine I; The server-side component OMkeeper is used to select available physical nodes as physical nodes for deploying the cloud server cryptographic machine II after receiving the cold migration task instruction from the VSM management system; it is also used to send the cold migration task instruction to the client component OMrunner1 of the cloud server cryptographic machine I after selecting the physical nodes for deploying the cloud server cryptographic machine II; it is also used to respond to the cold migration encryption key acquisition request from the client component OMrunner1, and to negotiate with the client component OMrunner1 securely, and synchronize the cold migration encryption key to the client component OMrunner1 using the best effort notification mechanism; it is also used to receive After receiving the key data ciphertext synchronization result from the client component OMrunner1, the server component OMkeeper sends a shutdown command to the client component OMrunner1; it is also used to respond to the cold migration decryption key acquisition request from the client component OMrunner2, and negotiate with the client component OMrunner2 securely, and use the best effort notification mechanism to synchronize the cold migration decryption key to the client component OMrunner2; it is also used to send a startup command to the client component OMrunner2 to start the new virtual server cryptographic machine after receiving the VSM migration result from the client component OMrunner2; The cloud server cryptographic machine II is the key data migration side corresponding to the cold migration task instruction, and the shutdown instruction is used to make the client component OMrunner1 shut down the source virtual server cryptographic machine; The key management system KMS is used to transmit the cold migration encryption key and the cold migration decryption key to the server component OMkeeper.

10. A key synchronization system for VSM cold migration, characterized in that: It includes a cryptographic resource pool management system, a cloud server cryptographic machine I and a cloud server cryptographic machine II. The cryptographic resource pool management system includes a VSM management system, a server component OMkeeper and a key management system KMS. The cloud server cryptographic machine I is deployed with a client component OMrunner1 and a virtual server cryptographic machine, and the cloud server cryptographic machine II is deployed with a client component OMrunner2. The VSM management system is connected to the server-side component OMkeeper, and the server-side component OMkeeper is respectively connected to the VSM management system, the client component OMrunner1 and the client component OMrunner2, and performs the steps of the key synchronization method for VSM cold migration described in any one of claims 1 to 8 to migrate the VSM from cloud server cryptographic machine I to cloud server cryptographic machine II.

Images