Password service integration and management method and device, management platform and storage medium

Abstract

The application discloses a password service integration and management method and device, a management platform and a storage medium, and relates to the technical field of password service integration and management. The method comprises the following steps: determining the connection mode provided by a password device according to the password device type and the password device interaction mode; developing the password service integrated with the password device by using a micro-service architecture mode according to the connection mode provided by the password device; and uniformly managing the password service integrated with the password device in the mode of the micro-service architecture, and providing a unified gateway as a unified service calling entrance. The application simplifies the calling process of the password device on the basis of the standard unified interface password service, reduces the secondary development cost of using the password device connection interface or SDK for password operation, and removes the differences and complicated processes of identity access of different manufacturers and different types of password devices. Only registration on the unified management platform is needed to complete the service access.

Description

TECHNICAL FIELD

[0001] The present application relates to a password service integration and management method, device, management platform and storage medium, and belongs to the field of computer software-application systems. BACKGROUND

[0002] The existing environment lacks a method for unified management of devices and services in an environment with multiple password devices and password services, making it impossible to efficiently manage password services and devices in a scenario with multiple password device calls, record service interface calls and manage services.

[0003] There is a lack of an entry for unified management of service interfaces and basic service information. At the same time, when the application system calls the password device, it needs to be developed separately according to different manufacturers and different types of password devices, resulting in the problem of high development cost of integrating password devices and using password operation streets.

[0004] In the existing scenario, there is a lack of a way to view and a window for the details of the application system calling the password service and the record. Users cannot view the real-time service interface calling situation of the application system, and cannot timely discover abnormal conditions of the password device or the application system. SUMMARY

[0005] Therefore, the present application provides a password service integration and management method, system, computer device and storage medium, which adopts a micro-service architecture and can manage multiple types and quantities of password devices in the environment in the form of password services.

[0006] A first object of the present application is to provide a password service integration and management method.

[0007] A second object of the present application is to provide a password service integration and management device.

[0008] A third object of the present application is to provide a management platform.

[0009] A fourth object of the present application is to provide a storage medium.

[0010] The first object of the present application can be achieved by adopting the following technical solutions:

[0011] A password service integration and management method applied to a management platform, the method comprising:

[0012] determining the docking mode provided by the password device according to the password device type and the password device interaction mode;

[0013] developing the password service integrated with the password device by using a micro-service architecture mode according to the docking mode provided by the password device.

[0014] The cryptographic services of the integrated cryptographic device are uniformly managed in a micro-service architecture mode, and a uniform gateway is provided as a uniform service calling entrance.

[0015] Further, the cryptographic services of the integrated cryptographic device are developed in a micro-service architecture mode according to the interfacing mode provided by the cryptographic device, and specifically include:

[0016] The cryptographic services are developed according to the interfacing mode provided by the cryptographic device, so that the cryptographic services integrate the cryptographic interfaces of the cryptographic device through the interfacing mode provided by the cryptographic device;

[0017] The cryptographic services are configured and a management client is added according to a micro-service framework;

[0018] According to whether the interfacing mode provided by the cryptographic device supports calling of the cryptographic device cluster mode, the cryptographic services are configured with an IP address of a single cryptographic device or an IP address list of the cryptographic device cluster mode.

[0019] Further, after the cryptographic services of the integrated cryptographic device are uniformly managed in a micro-service architecture mode and a uniform gateway is provided as a uniform service calling entrance, the method further includes:

[0020] According to the micro-service architecture, multiple cryptographic services in an environment are accessed through the uniform gateway;

[0021] The gateway receives a request for calling the cryptographic services, acquires a key field of an access service as an identifier according to routing content of the request, and interacts with a service registry center through the identifier;

[0022] The service registry center receives the service identifier, queries available service instances, and acquires a service instance list;

[0023] The service registry center processes the service instance list by using a load balancing strategy, and outputs an address and port information of a single available service instance to the gateway;

[0024] The gateway receives basic information of the service instance, forwards a cryptographic operation request to the service instance, and enables the service instance to send the request to a single cryptographic device or a cryptographic device cluster for processing according to configuration information of the service instance.

[0025] Further, after the cryptographic services of the integrated cryptographic device are uniformly managed in a micro-service architecture mode and a uniform gateway is provided as a uniform service calling entrance, the method further includes:

[0026] According to the micro-service architecture, multiple cryptographic services in an environment are accessed through the uniform gateway;

[0027] Intercept the request for calling the password service through the gateway, authenticate the request, and release the request meeting the authentication requirement.

[0028] Further, after the password service of the integrated password device is uniformly managed in the mode of the micro-service architecture and the unified gateway is provided as the unified service calling entrance, the method further includes:

[0029] According to the micro-service architecture, the plurality of password services in the environment are accessed through the unified gateway.

[0030] Intercept the request for calling the password service through the gateway, parse and acquire the calling result of the request response information returned by the password service according to the result, and generate calling information record and store it in the database or the storage component.

[0031] Further, the method further includes:

[0032] Record the request flow passing through the service calling entrance when the password service is called, and control the flow of the password service.

[0033] Further, the flow control of the password service specifically includes:

[0034] According to the configuration, the request passing through the gateway is monitored, when the attribute of the flow meets the configuration requirement, a processing mechanism is triggered, the flow of the password service is limited or the password service is fused, and the subsequent access request is blocked.

[0035] The second object of the application can be achieved by adopting the following technical solutions:

[0036] A password service integration and management device applied to a management platform, the device includes:

[0037] A determination unit configured to determine the connection mode provided by the password device according to the password device type and the password device interaction mode.

[0038] A development integration unit configured to develop and integrate the password service of the password device in the mode of the micro-service architecture according to the connection mode provided by the password device.

[0039] A unified management unit configured to uniformly manage the password service of the integrated password device in the mode of the micro-service architecture, and provide a unified gateway as a unified service calling entrance.

[0040] The third object of the application can be achieved by adopting the following technical solutions:

[0041] A management platform comprises a processor and a memory for storing programs executable by the processor, wherein the processor implements the cryptographic service integration and management method when executing the programs stored in the memory.

[0042] The fourth object of the present application can be achieved by adopting the following technical solution:

[0043] A storage medium stores a program, which, when executed by a processor, implements the cryptographic service integration and management method.

[0044] The present application has the following beneficial effects relative to the prior art:

[0045] 1. The present application simplifies the calling process of cryptographic devices based on standard unified interface cryptographic services, reduces the secondary development cost of application systems using cryptographic device docking interfaces or SDKs for cryptographic operations, and removes the differences and cumbersome processes of identity access of different manufacturers and different types of cryptographic devices through unified calling entry for identity authentication.

[0046] 2. The present application integrates the same type of cryptographic devices of different manufacturers through a unified standard cryptographic service interface, and application systems only need to focus on the interface information itself when calling cryptographic services, without switching due to different cryptographic devices; at the same time, if new cryptographic devices need to be introduced into the environment, the application system does not need to be changed at all.

[0047] 3. The present application collects calling record information through the unified calling entry of cryptographic services, can provide data display of calling records and calling relationships for managers and operation and maintenance personnel, and can help operation and maintenance personnel locate potential risks through the display content, or can discover abnormalities of services or systems at the first time. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained from the structures shown in the drawings without creative labor.

[0049] Figure 1 The interaction schematic diagram between the management platform of the first embodiment of the present application and the cryptographic devices.

[0050] Figure 2Flow chart of the password service integration and management method of embodiment 1 of the present application.

[0051] Figure 3 Structure block diagram of the password service integration and management device of embodiment 2 of the present application.

[0052] Figure 4 Structure block diagram of the management platform of embodiment 3 of the present application. DETAILED DESCRIPTION

[0053] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in connection with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0054] Embodiment 1

[0055] Before the specific content of the present embodiment is described, the abbreviations and key terms are defined as follows:

[0056] Password: a technology for encrypting, analyzing, identifying and confirming information and managing keys; generally involving data encryption, decryption, digital signature, hash operation, etc.

[0057] Micro-service architecture: a service-oriented software development architecture, which divides a single application into a group of small services, and realizes the final function of the software program through mutual coordination and cooperation between the services. Each service runs in an independent process and communicates with each other through a lightweight communication mechanism.

[0058] Password device: a password device refers to a device with certain password functions or completing certain password tasks, such as a server password machine, a signature verification server, and a timestamp server.

[0059] Password service: a running program or software that can continuously provide password operation processing capabilities to specified users or application systems.

[0060] Load balancing: distributing service requests or traffic to multiple operation units for execution, so as to achieve common completion of work tasks.

[0061] RESTful: a set of architectural constraints and principles. Application programs or designs that meet these constraints and principles are RESTful. It is mainly used for client and server exchange software, and software designed based on this style can be more concise, hierarchical, and easier to implement caching mechanisms.

[0062] Key: a parameter used in the algorithm for converting plaintext into ciphertext or vice versa, which is divided into symmetric key and asymmetric key.

[0063] Data signature / verification: in information transmission, the sender of the information generates a digital string that cannot be forged by others through cryptographic operation, and sends the digital string together with the original information, and the receiver of the information can check the digital string, that is, the signature, through cryptographic operation to determine whether the information comes from the sender and whether the information is tampered during transmission.

[0064] Data hash: also known as data hash or data hash, which is to convert input data of arbitrary length into output of fixed length through hash algorithm, and the output is the hash value, also known as hash value or hash value.

[0065] As shown in Figure 1 , it is a schematic diagram of interaction between each part of the management platform and the cryptographic device. Through the management platform of the embodiment, the service management and governance function including the functions of registration center, management center and gateway can be provided, the cryptographic service integrated with the cryptographic device is managed in the mode of micro service architecture, a unified service calling entrance is provided, and the request flow through the service calling entrance when calling the cryptographic service is recorded and the situation statistics function is provided. The specific description is as follows:

[0066] 1) According to the type of cryptographic device and the interaction mode of cryptographic device, the connection mode is determined, the cryptographic interface and configuration information of the integrated device are developed, and the cryptographic service is developed;

[0067] 2) The cryptographic service is integrated with the micro service architecture, and the service registration center component / client is added;

[0068] 3) The service name identifier of the service in the service registration center is configured, the service is run, and it is registered to the registration center;

[0069] 4) The application system encapsulates the cryptographic service calling request according to the unified interface standard, and sends the request to the unified entrance of the gateway;

[0070] 5) The gateway performs security authentication on the service request, and returns a failure response to the application system if the authentication fails;

[0071] 6) After the security authentication is passed, the gateway parses the request and sends the service identifier to the service registration center;

[0072] 7) The service registration center receives the service identifier and queries the service instance information list corresponding to the service identifier;

[0073] 8) The service registry center, based on the load balancing strategy, identifies a single service instance from the service instance information list and returns the service instance information to the gateway;

[0074] 9) The gateway receives the service instance information and forwards the request to that service instance;

[0075] 10) The service instance accepts the request and forwards it to a single cryptographic device (a single cryptographic device) or a cluster (a cluster of cryptographic devices) according to the configuration;

[0076] 11) The cryptographic device resolves the request, performs cryptographic operations, and returns the processing result;

[0077] 12) The unified gateway intercepts the response results, generates and stores call record information, and uses it for functions such as service and device call status statistics and display;

[0078] 13) The gateway returns the response result to the application system, and the application system receives the call result.

[0079] like Figure 2 As shown, this embodiment provides a method for integrating and managing cryptographic services. This method is mainly implemented through the aforementioned management platform and includes the following steps:

[0080] S201. Determine the interface method provided by the cryptographic device based on the type of cryptographic device and the interaction method of the cryptographic device.

[0081] In this embodiment, the cryptographic device can provide a connection method such as a connection interface or an SDK (Software Development Kit).

[0082] S202. Based on the interface method provided by the cryptographic device, develop cryptographic services that integrate with the cryptographic device using a microservice architecture pattern.

[0083] Furthermore, step S202 specifically includes:

[0084] S2021. Develop cryptographic services based on the interface provided by the cryptographic device, so that the cryptographic services can be integrated with the cryptographic interface of the cryptographic device through the interface provided by the cryptographic device.

[0085] S2022. Configure the password service and add management clients according to the microservice framework so that the password service can register with the service registry.

[0086] In this embodiment, configuring the cryptographic service includes scheduling and discovery of service instances, and allocation of service instance weights.

[0087] S2023, according to whether the connection mode provided by the cryptographic device supports calling the cryptographic device cluster mode, configure the cryptographic service with the IP address of a single cryptographic device or the IP address list of the cryptographic device cluster mode, so that the cryptographic service can access the interface of the single cryptographic device or the cryptographic device cluster, and implement cryptographic operation.

[0088] In this embodiment, according to whether the connection mode provided by the cryptographic device supports calling the cryptographic device cluster mode, if the connection mode supports calling the cryptographic device cluster mode, configure the cryptographic service with the IP address list of the cryptographic device cluster mode, and if the connection mode does not support calling the cryptographic device cluster mode, configure the cryptographic service with the IP address of a single cryptographic device.

[0089] S203, for the cryptographic service integrated with the cryptographic device, unified management is performed in the mode of micro-service architecture, and a unified gateway is provided as a unified service calling entrance.

[0090] In order to call multiple cryptographic devices and cryptographic services, the embodiment can further include, after step S203:

[0091] S204, according to the micro-service architecture, access multiple cryptographic services in the environment through the unified gateway.

[0092] S205, receive a request for calling a cryptographic service through the gateway, obtain a key field for accessing the service as an identifier according to the routing content of the request, and interact with the service registry center through the identifier.

[0093] S206, receive the service identifier through the service registry center, query available service instances, and obtain a service instance list.

[0094] S207, process the service instance list through the service registry center by using a load balancing strategy, and output the address and port information of a single available service instance to the gateway.

[0095] S208, receive the basic information of the service instance through the gateway, forward the cryptographic operation request to the service instance, and make the service instance send the request to a single cryptographic device or a cryptographic device cluster for processing according to the configuration information of the service instance.

[0096] In order to perform unified authentication management on multiple cryptographic devices, the embodiment can further include, after step S203:

[0097] S204, according to the micro-service architecture, access multiple cryptographic services in the environment through the unified gateway.

[0098] S209, intercept the request for calling the cryptographic service through the gateway, authenticate the request, and release the request meeting the authentication requirement.

[0099] In this embodiment, based on the basis that all requests for calling the password service are forwarded through the gateway, the gateway can intercept the request, authenticate the request, and if the authentication requirement is met, the request is released, and then the steps S205-S208 can be performed, if the authentication requirement is not met, the failure is returned.

[0100] In order to collect password device and password service call records, the embodiment can further include, after step S203:

[0101] S204, according to the architecture of micro services, access multiple password services in the environment through a unified gateway.

[0102] S210, intercept the request for calling the password service through the gateway, parse and obtain the calling result of the request response information returned by the password service, generate a call information record according to the result, and store it in the database or storage component.

[0103] Further, the password service integration and management method of the embodiment can further include:

[0104] S211, record the request flow through the service call entrance when calling the password service, and control the flow of the password service.

[0105] It is easy to understand that this step S211 can be performed after S204, and the flow control of the password service includes limiting the flow of the service instance access, fusing and degrading the service instance, limiting the access to the service. Specifically, according to the configuration, the request flowing through the gateway is monitored, when the properties of the flow meet the configuration requirements, the processing mechanism is triggered, the flow of the password service is limited or the password service is fused, and the subsequent access request is blocked.

[0106] The parameters of the flow control configuration generally include:

[0107] 1) Resource name (may be the name of a specific interface);

[0108] 2) Threshold size (generally the size of qps);

[0109] 3) Trigger operation type (subsequent operation after reaching the threshold).

[0110] Example: configure a threshold of 500 qps for the interface with the name / user / login, and configure the trigger operation type as rejection. When the number of accesses to the interface reaches the threshold, the access to the interface will be limited, and the requests exceeding the threshold will be directly rejected without subsequent operation.

[0111] Therefore, the embodiment builds a unified management platform for centralized management of password services, designs a unified standard password service interface to form different types of password services by integrating different types of password devices in the environment, provides a unified password service calling entry, all password devices in the environment call through the access gateway, and provides traffic limitation according to the service type, designs a system for managing password devices and password services according to the type of password devices and the manufacturer of password devices, and realizes management of a plurality of types of password devices in the environment in the form of password services.

[0112] It should be noted that although the method operations of the above embodiments are described in a particular, sequential order, this is not necessarily to be understood as a strict sequential or order dependent process, unless otherwise indicated, and that one or more of the method operations can be performed in parallel, or in a different order. In addition, or alternatively, a number of steps can be omitted, combined, moved about or performed coactively with one another, or in a different order.

[0113] Embodiment 2:

[0114] As shown in Figure 3 The embodiment provides a password service integration and management device, which is applied to a management platform and includes a determination unit 301, a development integration unit 302, and a unified management unit 303, and specific descriptions of the units are as follows:

[0115] The determination unit 301 is configured to determine the connection mode provided by the password device according to the type of the password device and the interaction mode of the password device.

[0116] The development integration unit 302 is configured to develop and integrate the password service of the password device in a micro-service architecture mode according to the connection mode provided by the password device.

[0117] The unified management unit 303 is configured to manage the password service of the integrated password device in a micro-service architecture mode, and provide a unified gateway as a unified service calling entry.

[0118] Further, the embodiment can further include:

[0119] The traffic control unit 304 is configured to record the request traffic passing through the service calling entry when the password service is called, and control the traffic of the password service.

[0120] It should be noted that the system provided by the embodiment is only exemplified by the division of the above functional modules, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure is divided into different functional modules to complete all or part of the above described functions.

[0121] Embodiment 3

[0122] The embodiment provides a management platform, which can be a server, such as Figure 4 As shown in the figure, the management platform comprises a processor 402, a memory and a network interface 403 connected through a system bus 401, the processor is used for providing computing and control capability, the memory comprises a non-volatile storage medium 404 and an internal memory 405, the non-volatile storage medium 404 stores an operating system, a computer program and a database, the internal memory 405 provides an environment for running of the operating system and the computer program in the non-volatile storage medium, and when the processor executes the computer program stored in the memory, the following cryptographic service integration and management method is realized:

[0123] According to the type of the cryptographic device and the interaction mode of the cryptographic device, the connection mode provided by the cryptographic device is determined;

[0124] According to the connection mode provided by the cryptographic device, the cryptographic service integrated with the cryptographic device is developed by using a micro-service architecture mode;

[0125] The cryptographic service integrated with the cryptographic device is managed in the micro-service architecture mode, and a unified gateway is provided as a unified service calling entrance.

[0126] Further, the method can further comprise the following steps: recording request flow passing through the service calling entrance when the cryptographic service is called, and performing flow control on the cryptographic service.

[0127] Embodiment 4

[0128] The embodiment provides a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and when the computer program is executed by a processor, the following cryptographic service integration and management method is realized:

[0129] According to the type of the cryptographic device and the interaction mode of the cryptographic device, the connection mode provided by the cryptographic device is determined;

[0130] According to the connection mode provided by the cryptographic device, the cryptographic service integrated with the cryptographic device is developed by using a micro-service architecture mode;

[0131] The cryptographic service integrated with the cryptographic device is managed in the micro-service architecture mode, and a unified gateway is provided as a unified service calling entrance.

[0132] Further, the method can further comprise the following steps: recording request flow passing through the service calling entrance when the cryptographic service is called, and performing flow control on the cryptographic service.

[0133] It should be noted that the computer readable storage medium in this embodiment can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0134] In this embodiment, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In this embodiment, the computer readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer readable programs. Such a propagated data signal can take many forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer readable signal medium can also be any computer readable medium other than the computer readable storage medium that can send, propagate or transmit programs for use by or in connection with an instruction execution system, apparatus or device. The computer program contained in the computer readable storage medium can be transmitted by any suitable medium, including but not limited to a wire, a cable, a RF (radio frequency) or the like, or any suitable combination of the above.

[0135] The computer readable storage medium described above can be written in one or more programming languages or a combination of the above for executing the computer program of this embodiment, including object-oriented programming languages such as Java, Python, C++, and conventional procedural programming languages such as C language or similar programming languages. The program can be executed entirely on a user computer, partially on a user computer, as a separate software package, partially on a user computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0136] In summary, the application is based on the standard unified interface password service, simplifies the calling process of the password device, reduces the secondary development cost of the application system using the password device connection interface or SDK for password operation, and removes the difference and cumbersome process of identity access of different manufacturers and different types of password devices through unified calling entrance for identity authentication. The application system only needs to be registered on the unified management platform to complete the access of the service.

[0137] The above is only the preferred embodiment of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can make equivalent replacement or change according to the technical scheme and the inventive concept of the present application within the scope disclosed by the present application, and it still belongs to the protection scope of the present application.

Claims

1. A method for integrating and managing cryptographic services, characterized in that, The method includes: Determine the interface method provided by the cryptographic device based on the type of cryptographic device and the interaction method of the cryptographic device; Based on the interface method provided by the cryptographic device, a microservice architecture pattern is adopted to develop cryptographic services that integrate with the cryptographic device. For cryptographic services of integrated cryptographic devices, a microservice architecture is used for unified management, and a unified gateway is provided as a unified service call entry point. Based on the microservice architecture, multiple cryptographic services within the environment are accessed through a unified gateway; The gateway intercepts requests to the password service, authenticates the requests, and allows requests that meet the authentication requirements to proceed. The gateway receives requests to invoke the password service, obtains the key fields for accessing the service based on the route content of the request as an identifier, and interacts with the service registry center through the identifier; Receive service identifiers through the service registry, query available service instances, and obtain a list of service instances; The service registry uses load balancing strategies to process the list of service instances and outputs the address and port information of a single available service instance to the gateway. The gateway receives basic information about the service instance and forwards cryptographic operation requests to that service instance, enabling the service instance to send the requests to a single cryptographic device or a cluster of cryptographic devices for processing based on its own configuration information. The development of cryptographic services integrated with cryptographic devices using a microservice architecture, based on the interface provided by the cryptographic devices, specifically includes: Develop cryptographic services based on the interface provided by the cryptographic device, and integrate the cryptographic services with the cryptographic interface of the cryptographic device through the interface provided by the cryptographic device. Configure the password service and add management clients according to the microservice framework so that the password service can register with the service registry center; Depending on whether the connection method provided by the cryptographic device supports calling the cryptographic device cluster mode, configure the cryptographic service with the IP address of a single cryptographic device or a list of IP addresses for the cryptographic device cluster mode, so that the cryptographic service can access the interface of a single cryptographic device or a cryptographic device cluster to perform cryptographic operations.

2. The cryptographic service integration and management method according to claim 1, characterized in that, The cryptographic services for integrated cryptographic devices, after being uniformly managed using a microservice architecture and providing a unified gateway as a unified service call entry point, also include: Based on the microservice architecture, multiple cryptographic services within the environment are accessed through a unified gateway; The gateway intercepts requests to the password service, parses the request response information returned by the password service, obtains the call result, generates call information records based on the result, and stores them in the database or storage component.

3. The cryptographic service integration and management method according to any one of claims 1-2, characterized in that, The method further includes: Record the request traffic passing through the service call entry point when calling the password service, and perform traffic control for the password service.

4. The cryptographic service integration and management method according to claim 3, characterized in that, The traffic control for cryptographic services specifically includes: The gateway monitors requests flowing through it based on the configuration. When the traffic attributes meet the configuration requirements, a processing mechanism is triggered to restrict the traffic to the password service or to circuit break the password service, blocking subsequent access requests.

5. A cryptographic service integration and management device, characterized in that, The device includes: The determining unit is used to determine the interface method provided by the cryptographic device based on the type of cryptographic device and the interaction method of the cryptographic device; Develop an integration unit to develop cryptographic services for integrating cryptographic devices using a microservice architecture, based on the interface methods provided by the cryptographic devices. The unified management unit is used to manage cryptographic services for integrated cryptographic devices in a unified microservice architecture, and provides a unified gateway as a unified service call entry point. The access unit is used to access multiple cryptographic services within the environment through a unified gateway, based on the microservice architecture. The authentication unit is used to intercept requests for password services through the gateway, authenticate the requests, and allow requests that meet the authentication requirements to proceed. The interaction unit is used to receive requests to call the password service through the gateway, obtain the key fields for accessing the service as an identifier based on the route content of the request, and interact with the service registry center through the identifier; The query unit is used to receive service identifiers from the service registry, query available service instances, and obtain a list of service instances. The output unit is used to process the list of service instances through the service registry using load balancing strategies, and output the address and port information of a single available service instance to the gateway. The forwarding unit is used to receive basic information of the service instance through the gateway, forward the cryptographic operation request to the service instance, and enable the service instance to send the request to a single cryptographic device or a cluster of cryptographic devices for processing according to its own configuration information. The development of cryptographic services integrated with cryptographic devices using a microservice architecture, based on the interface provided by the cryptographic devices, specifically includes: Develop cryptographic services based on the interface provided by the cryptographic device, and integrate the cryptographic services with the cryptographic interface of the cryptographic device through the interface provided by the cryptographic device. Configure the password service and add management clients according to the microservice framework so that the password service can register with the service registry center; Depending on whether the connection method provided by the cryptographic device supports calling the cryptographic device cluster mode, configure the cryptographic service with the IP address of a single cryptographic device or a list of IP addresses for the cryptographic device cluster mode, so that the cryptographic service can access the interface of a single cryptographic device or a cryptographic device cluster to perform cryptographic operations.

6. A management platform, comprising a processor and a memory for storing a processor-executable program, characterized in that, When the processor executes the program stored in the memory, it implements the cryptographic service integration and management method according to any one of claims 1-4.

7. A storage medium storing a program, characterized in that, When the program is executed by the processor, it implements the cryptographic service integration and management method according to any one of claims 1-4.

Images