Intelligent Heterogeneous Cryptographic Resource Pool System

Abstract

The present invention relates to the technical field of information system security, and specifically discloses an intelligent heterogeneous password resource pool system, which includes a synchronization module, a general server, and several password devices; the synchronization module is used to synchronize key resources of the same type of password devices after the password devices are connected to the network; the general server is deployed with a virtual module and a load balancing module, the load balancing module is used to connect the password devices after key resource synchronization, and the virtual module is used to virtualize the physical resources of the password devices into different types of resource clouds through virtualization technology. The technical solution of the present invention can improve scalability, achieve flexible networking, and support password devices from different manufacturers.

Description

Technical Field

[0001] The present invention relates to the technical field of information system security, and in particular to an intelligent heterogeneous cryptographic resource pool system. Background Art

[0002] In the complex cybersecurity environment, cryptographic technology has been widely applied in various business processes, including network security identity authentication, digital signatures, and data encryption. Cryptographic service systems, as a crucial component of security application systems, are becoming increasingly important and complex. Currently, cryptographic service systems primarily operate in clusters using devices of the same manufacturer, type, and model. However, due to the inconsistent construction cycles of various cryptographic service systems and the use of devices from different manufacturers, types, and models, the development and deployment of multiple cryptographic service systems is necessitated. This results in weak service capabilities and poor scalability, making it difficult to meet the needs of expanding business operations.

[0003] To this end, an intelligent heterogeneous cryptographic resource pool system with high scalability and flexible networking is needed. Summary of the Invention

[0004] The present invention provides an intelligent heterogeneous cryptographic resource pool system, which can improve scalability and realize flexible networking to support cryptographic devices from different manufacturers.

[0005] In order to solve the above technical problems, this application provides the following technical solutions:

[0006] Intelligent heterogeneous cryptographic resource pool system, including synchronization module, general server and several cryptographic devices;

[0007] The synchronization module is used to synchronize key resources of cryptographic devices of the same type after they are connected to the network;

[0008] The general server is deployed with a virtual module and a load balancing module. The load balancing module is used to connect the cryptographic device after key resources are synchronized. The virtual module is used to virtualize the physical resources of the cryptographic device into different types of resource clouds through virtualization technology.

[0009] The basic scheme principles and beneficial effects are as follows:

[0010] In this solution, the virtualization module, based on virtualization technology, combines cryptographic device resources into a heterogeneous resource cloud. This allows for integration of cryptographic devices from different vendors and types, providing a unified interface service and providing resource clouds by type. This addresses the drawback of existing plans that require clustering of devices from the same vendor, type, and model. Cryptographic devices can be flexibly networked, facilitating reuse, minimizing waste of existing resources, and reducing costs. Furthermore, the details of the cryptographic device resource composition are shielded, improving operational efficiency and reducing O&M complexity.

[0011] Further, it also includes a service gateway, which is used to obtain the call application of the third-party application service interface; it is also used to parse the call application and determine the service requests for different resource clouds according to the parsed results;

[0012] The load balancing module is also used to perform load balancing judgment after receiving the service request and determine the password device to be sent;

[0013] The password device is used to respond to the service request after receiving it; send the response result to the resource cloud, and the load balancing module is also used to send the response result to the service gateway; the service gateway is also used to send the response result to the corresponding third-party application through the service interface.

[0014] Further, the resource cloud includes an encryption service cloud and a signature verification cloud.

[0015] Further, the password device includes an encryption machine, a signature and verification server; the synchronization module is also used to synchronize the key resources of the encryption machine and is also used to synchronize the visa key resources of the signature and verification server.

[0016] Further, the virtual module is used to pool the physical resources of the password device through virtualization technology to form a resource pool, and virtualize the resource pool into different types of resource clouds.

[0017] Further, it also includes a learning database, which is used to obtain the device status data of the password device, classify and store the device status data, and the classified device status data includes device load data and device fault data;

[0018] Further, it also includes a scheduling module. The scheduling module pre-stores an AI model. The scheduling module is used to obtain the resource consumption of different password devices and the overall system resource usage through the device load data; the scheduling module trains the AI model through the resource consumption of different password devices and the overall system resource usage, and predicts the device resource load and the overall system resource usage of different password devices in a future period through the trained load balancing configuration model;

[0019] If the difference obtained by subtracting the product of the current overall system resource multiplied by the system security redundancy coefficient from the predicted overall system resource is greater than the resource capacity of a certain password device, the virtual module is also used to set the password device as a spare device, and the load balancing module is also used to transfer the service requests on the password device to other password devices, so as to turn off the device.

[0020] If the difference obtained by subtracting the predicted overall system resource used in a future period from the quotient of the current overall system resource divided by the system security redundancy coefficient is less than 0, the virtual module is also used to start the password device in the closed state.

[0021] Furthermore, the system security redundancy factor is 1.2 - 1.3. Description of the Drawings

[0022] Figure 1 It is a logical block diagram of the intelligent heterogeneous cryptographic resource pool system of Embodiment 1. Detailed Implementation Manner

[0023] The following is a further detailed description through specific implementation manners:

[0024] Embodiment 1

[0025] As Figure 1 shown, the intelligent heterogeneous cryptographic resource pool system of this embodiment includes a service gateway, a synchronization module, a general server, a learning database, a scheduling module, and several cryptographic devices.

[0026] The synchronization module is used to synchronize key resources of the same type of cryptographic devices after the cryptographic devices are connected to the network. For example, for encryption machines, cryptographic cards, etc., key synchronization is involved; for timestamps, signature verification, etc., certificate synchronization is involved, and for other cryptographic devices, the key resources to be synchronized are determined according to the nature of the devices.

[0027] The general server is deployed with a virtual module and a load balancing module. The load balancing module is used to connect the cryptographic devices after key resource synchronization. The virtual module is used to pool the physical resources of the cryptographic devices through virtualization technology to form a resource pool, and virtualize the resource pool into different types of resource clouds to shield the underlying implementation. The resource clouds include an encryption service cloud, a signature verification cloud, a dynamic password cloud, etc. In this embodiment, the load balancing module runs on the general server. In other embodiments, a load balancing cluster can also be constructed according to actual situations for hot standby and performance expansion. The load balancing module adopts a pipeline technology and cooperates with a caching mechanism to improve the concurrency of the system.

[0028] The service gateway serves as a service entry, and is used to obtain a call application for a third-party application service interface; it is also used to parse the call application and determine the internal interface to be called according to the parsed result, that is, a service request for different resource clouds. Specifically, the service gateway determines whether the call application is an authorization request according to the call application. If it is a non-authorization request, the call application is rejected to implement call permission control, that is, an authorization request is allowed to be called, and an unauthorized call is not allowed.

[0029] The service gateway is also used to send service interface call data to the learning database for storage, realizing bypass drainage and avoiding increasing the burden on the system when obtaining call data from the main data path.

[0030] The learning database is also used to obtain the device status data of the cryptographic devices.

[0031] The scheduling module pre-stores an AI model. The scheduling module is used to call data and device status data through a service interface to train the AI model, so that the AI model obtains the resource trend of the cryptographic device, and thus can predict the resource cloud load and device resource load conditions within a certain period of time in the future to optimize the load balancing configuration. The scheduling module is also used to correct the AI model according to the difference between the actual result and the predicted result after the training data reaches the set quantity, so as to improve the prediction accuracy of the AI model. In this embodiment, the set quantity is at the level of 100,000.

[0032] The load balancing module is also used to perform load balancing judgment after receiving a service request: obtain a preliminary result according to the load balancing algorithm preset for different types of cryptographic devices, and then compare and correct the preliminary result with the predicted result obtained by the AI model to obtain an optimal result to determine the cryptographic device to be sent; then perform service request distribution. The optimal result is the smallest resource overhead, meeting the maximum demand and obtaining the most satisfactory result. In other words, it is the greatest benefit.

[0033] In this embodiment, the load balancing algorithm obtains the monitoring result of the cryptographic device resources and specifically uses the minimum pressure algorithm to obtain a preliminary result. Taking a server cipher machine as an example, at 12:00 on the Xth day of X month, the system received a service request. At this time, the load balancing module obtained that device A has the smallest current pressure through the minimum pressure algorithm. At this time, the preliminary result is to plan to forward the request to device A; however, according to the prediction of the AI model, since device A has a serious shortage of resources, it will automatically shut down and go offline through the dynamic resource pool mechanism in the future. Therefore, after comparison, this request will be transferred to other devices; for another example, although device A has a small pressure at this time, the required request exceeds the capacity of device A, and although device B does not have the smallest pressure at this time, but it is predicted that the resources of device B can be released at the next moment, then the system will still forward the request to device B at this time.

[0034] The cryptographic device is used to respond to the service request after receiving it and send the response result to the cache of the resource cloud. The load balancing module is also used to send the response result in the cache to the service gateway; the service gateway sends the response result to the corresponding third-party application through the service interface. In this embodiment, the purpose of setting the cache is to improve the request response speed of the system and increase the TPS (number of transactions processed per second by the server) value.

[0035] Specifically, the learning database is also used to classify and store the device status data. In this embodiment, the classified device status data includes device load data and device fault data.

[0036] The AI model includes several types, including an interface call prediction model, a device status prediction model, a fault and problem handling model, a load balancing configuration model, etc. in this implementation. In this embodiment, the above models are constructed by combining a clustering analysis model and a time series model.

[0037] The scheduling module is used to train the interface call prediction model by learning the service interface call data in the database, so that the interface call prediction model obtains the call trend of the service interface according to the time distribution, so as to be able to predict the interface call trend in a future period of time.

[0038] The scheduling module is also used to analyze according to the prediction results of the interface call prediction model to obtain the interface service call frequency, interface concurrency, data traffic, and peak period warning throughout the day. It is also used to alarm IPs or third-party applications whose abnormal call status times exceed the set value.

[0039] The scheduling module is also used to read the device status data from the learning database. Specifically, the device status prediction model is trained through the device load data, so that the device status prediction model obtains the resource trend of the password device, so as to be able to predict the device resource load in a future period of time.

[0040] The scheduling module is also used to analyze according to the prediction results of the device status prediction model to obtain the daily operation of the password device, including the device resource load, peak period, idle period, CPU utilization rate in each period, memory occupancy in each period, and TPS. Thus, it can give an early warning for the peak period.

[0041] The scheduling module is also used to train the fault and problem handling model through the device fault data, so that the fault and problem handling model obtains the fault trend of the password device, so as to be able to predict the device fault probability in a future period of time.

[0042] The scheduling module is also used to judge whether the device fault probability is higher than the threshold according to the prediction result of the fault and problem handling model, that is, the device fault probability in a future period of time. If it is higher than the threshold, an abnormal alarm is made before a system error occurs.

[0043] The scheduling module is also used to train the load balancing configuration model by invoking data through the service interface and device load data, so that the load balancing configuration model can obtain the resource trend of the cryptographic device, and thus can predict the resource cloud load situation and device resource load situation within a certain period of time in the future. The load balancing module is also used to dynamically configure and adjust the load balancing scheme of the resource cloud according to the prediction results of the load balancing configuration model to achieve the optimization of resource utilization. The future period of time can be set according to the actual situation, such as 3 hours, 6 hours, 12 hours, 24 hours, 48 hours, 72 hours, 168 hours, etc. Considering the data fluctuations brought by weekends and holidays, a correction factor can also be added for correction.

[0044] Based on the above intelligent heterogeneous cryptographic resource pool system, this embodiment also provides a method for using a heterogeneous cryptographic resource pool, including the following steps:

[0045] S1. The service gateway receives the call application of the third-party application through the unified service interface;

[0046] S2. Parse the call application, determine the internal interface to be called according to the parsed result, and forward the service request of the third-party application to the resource cloud corresponding to the internal interface; after the service request is forwarded to the resource cloud, the service request is immediately disconnected and the resources are released (the disconnection in this embodiment is based on the pipeline technology, and the connections in the pre-established connection pool will not be released, the same below), for other service requests

[0047] S3. The load balancing module obtains the preliminary result according to the load balancing algorithm preset for different types of cryptographic devices, and then compares and corrects the preliminary result with the prediction result obtained by the load balancing configuration model to determine the distributed cryptographic device;

[0048] S4. Distribute the service request according to the determined cryptographic device; after the service request is distributed, disconnect the connection and release the resources;

[0049] S5. After the cryptographic device receives the service request, process the service request;

[0050] S6. The device status prediction model outputs the prediction result of the processing completion time and sends the prediction result to the load balancing module;

[0051] S7. After receiving the prediction result, the load balancing module establishes a connection with the service gateway in advance;

[0052] S8. After the cryptographic device finishes processing the service request, send the processing result to the cache of the resource cloud;

[0053] S9. The load balancing module reads the processing result from the cache and sends it to the service gateway;

[0054] S10. The service gateway sends the processing result to the third-party application through the service interface.

[0055] In the solution of this embodiment, different manufacturers and different types of cryptographic devices are integrated internally. Based on virtualization technology, the cryptographic device resources are combined into a heterogeneous resource cloud. Externally, a unified interface service is provided, and the resource cloud is provided according to types. The cryptographic devices can be networked flexibly, which is convenient for reusing existing resources, without wasting existing resources, saving costs, shielding the details of the composition of the cryptographic device resources, improving the operation efficiency, and reducing the operation and maintenance complexity.

[0056] Through the AI model, load balancing is achieved, the purpose of intelligent dynamic scheduling is achieved, the system reliability is improved, the equipment life is extended, the operation and maintenance time is reduced, and the equipment energy consumption is reduced.

[0057] Embodiment 2

[0058] The difference between this embodiment and Embodiment 1 is that in this embodiment, in the initial stage of platform construction and operation, after the key resources of the same type of cryptographic devices are synchronized, a resource pool is formed through virtual modules.

[0059] During the operation of the system, the resource consumption of different cryptographic devices and the overall system resource usage are obtained through the device load data; in this embodiment, the overall system resource usage refers to the summary of the resource consumption of the same type of cryptographic devices.

[0060] The scheduling module performs deep learning on the load balancing configuration model through such data, and predicts the device resource load and the overall system resource usage of different cryptographic devices in a future period through the load balancing configuration model.

[0061] If the difference obtained by subtracting the product of the current overall system resource and the system security redundancy factor from the predicted overall system resource is greater than the resource capacity of a certain cryptographic device, the virtual module is also used to set the cryptographic device as a spare device, and the load balancing module is used to transfer the service requests on the cryptographic device to other cryptographic devices, so as to turn off the device, saving energy and equipment loss; the system security redundancy factor is used to ensure that the resources will not reach 100% utilization rate, and the initial value is 1.2 - 1.3.

[0062] If the difference between the quotient of the current overall system resource divided by the system security redundancy factor and the predicted overall system resource used in a future period is less than 0, the virtual module is also used to issue a resource shortage warning and automatically start the cryptographic device in the off state to increase the system resources.

[0063] In summary, through the prediction results of the load balancing configuration model, the automatic start / stop of the cryptographic devices is realized, and the purpose of dynamically constructing the resource pool is achieved.

[0064] Embodiment III

[0065] The difference between this embodiment and Embodiment II is that in this embodiment, the scheduling module is further configured to determine whether to expand the cryptographic device according to the predicted overall system resource usage in a future period of time; for example, if the overall system resource usage has been in a full-load state, it is determined that the cryptographic device needs to be expanded. Scoring is only performed after it is predicted that expansion is needed, which can make the score best reflect the current device status.

[0066] If the cryptographic device needs to be expanded, determine the order of the cryptographic devices for scoring according to the predicted device resource load conditions of different cryptographic devices within the next 3 hours, 6 hours, 12 hours, 24 hours, 48 hours, 72 hours, and 168 hours in the future. In this embodiment, sorting is performed from high to low according to the device resource load conditions. Scoring can be performed on a single cryptographic device or on multiple cryptographic devices simultaneously. The scheduling module is further configured to mark the cryptographic devices being scored. The load balancing module is further configured to, after receiving a service request, preferentially distribute the service request to the cryptographic devices being scored. When the cryptographic devices being scored cannot handle the service request, then determine the cryptographic device to send through load balancing judgment.

[0067] The scheduling module is further configured to score the cryptographic devices according to the device failure data of each cryptographic device, and generate a device recommendation list according to the order of the scores of the same type of cryptographic devices from high to low. When expansion is performed, it can be used as a reference for relevant personnel to select devices of appropriate manufacturers and models. For example, the failure score X = -(a*λ_1)-(b*λ_2)-(c*λ_3)+(d*λ_4), where a is the total number of failures per unit working hour, b is the total repair duration of failures per unit working hour, c is the number of failures during peak hours per unit working hour, d is the accuracy rate of the device failure probability prediction by the failure and problem handling model; λ_1, λ_2, λ_3, and λ_4 are all weight coefficients, which can be set individually according to the actual situation; in this embodiment, the unit working hour is 500 hours.

[0068] The above are only embodiments of the present invention. The invention is not limited to the fields involved in this embodiment. Common knowledge such as specific structures and characteristics known in the art is not described in detail herein. Those of ordinary skill in the art know all the common general technical knowledge in the technical field to which the invention pertains before the filing date or the priority date, are able to learn all the prior art in this field, and have the ability to apply conventional experimental means before this date. Those of ordinary skill in the art can, under the inspiration given in this application, combine their own abilities to complete and implement this solution. Some typical well-known structures or well-known methods should not be an obstacle for those of ordinary skill in the art to implement this application. It should be noted that for those skilled in the art, without departing from the structure of the present invention, several deformations and improvements can still be made, and these should also be regarded as the protection scope of the present invention, and these will not affect the implementation effect of the present invention and the practicality of the patent. The protection scope required by this application should be based on the content of its claims, and the specific implementation manners and the like recorded in the specification can be used to interpret the content of the claims.

Claims

1. An intelligent heterogeneous cryptographic resource pool system, characterized in that It includes a synchronization module, a general server, and several cryptographic devices; The synchronization module is used to synchronize the key resources of the same type of cryptographic devices after the cryptographic devices are connected to the network; The general server is deployed with a virtual module and a load balancing module. The load balancing module is used to connect to the cryptographic devices after the key resources are synchronized, and the virtual module is used to virtualize the physical resources of the cryptographic devices into different types of resource clouds through virtualization technology; It also includes a service gateway, which is used to obtain the call application of the third-party application service interface; it is also used to parse the call application and determine the service request for different resource clouds according to the parsed result; The load balancing module is also used to perform load balancing judgment after receiving the service request and determine the cryptographic device to be sent; The cryptographic device is used to respond to the service request after receiving it; send the response result to the resource cloud, and the load balancing module is also used to send the response result to the service gateway; the service gateway is also used to send the response result to the corresponding third-party application through the service interface; The resource cloud includes an encryption service cloud and a signature verification cloud; The cryptographic device includes an encryption machine, a signature and verification server; the synchronization module is also used to synchronize the key resources of the encryption machine and the visa key resources of the signature and verification server; The virtual module is used to pool the physical resources of the cryptographic device through virtualization technology to form a resource pool, and virtualize the resource pool into different types of resource clouds; It also includes a learning database, which is used to obtain the device status data of the cryptographic device, classify and store the device status data, and the classified device status data includes device load data and device fault data; It also includes a scheduling module. The scheduling module pre-stores an AI model. The scheduling module is used to obtain the resource consumption of different cryptographic devices and the overall system resource usage through the device load data; the scheduling module trains the AI model through the resource consumption of different cryptographic devices and the overall system resource usage, and predicts the device resource load and the overall system resource usage of different cryptographic devices in a future period through the trained load balancing configuration model; If the difference obtained by subtracting the product of the currently predicted overall system resources and the system security redundancy coefficient from the predicted overall system resources is greater than the resource capacity of a certain cryptographic device, the virtual module is also used to set the cryptographic device as a spare device, and the load balancing module is also used to transfer the service request on the cryptographic device to other cryptographic devices, so as to shut down the device; If the difference between the quotient of the currently overall system resources divided by the system security redundancy coefficient and the predicted overall system resources used in a future period is less than 0, the virtual module is also used to start the cryptographic device in the shutdown state.

2. The intelligent heterogeneous cipher resource pool system according to claim 1, wherein: The system security redundancy coefficient is 1.2 to 1.3.

Images