Cryptographic machine operation control method and apparatus, electronic device, and storage medium

Abstract

The method for controlling the operation of the encryption machine provided by the embodiments of the present disclosure comprises: obtaining operation state information of a first virtual encryption machine formed based on a hardware encryption machine and operation data generated by the first virtual encryption machine; storing the operation data into a preset storage cluster; determining whether the first virtual encryption machine is faulty according to the operation state information; and when the first virtual encryption machine is faulty, performing a virtual encryption recovery operation based on the operation data of the first virtual encryption machine stored in the preset storage cluster. Here, by automatically determining whether the first virtual encryption machine is faulty and performing a virtual encryption machine recovery operation based on the operation data of the first virtual encryption machine stored in the preset storage cluster after the first virtual encryption machine is faulty, the efficiency of virtual encryption machine fault detection, backup and automatic recovery can be improved compared with manually operating the encryption machine in the machine room.

Description

Technical Field

[0001] This disclosure relates to, but is not limited to, the field of data processing, and particularly to a method, apparatus, electronic device, and storage medium for controlling the operation of an encryption machine. Background Technology

[0002] With the rapid development of network technology, network data contains a large amount of sensitive personal information in various scenarios such as online transactions, online payments, and electronic vouchers, facing multiple cybersecurity threats. It is necessary to ensure the security, authenticity, and integrity of network data processing within regulatory requirements. Therefore, hardware cryptographic machines certified by the State Cryptography Administration, which can perform encryption and decryption operations to ensure the security, authenticity, and integrity of network data processing, are being used more and more widely.

[0003] However, existing hardware encryption machines are expensive to use and difficult to deploy. Furthermore, hardware encryption machines are usually monitored and managed manually in a data center setting. This includes regular inspections, backups, and troubleshooting. Manual monitoring and management of encryption machines is often inefficient and costly. Summary of the Invention

[0004] In view of this, the present disclosure provides a method, apparatus, electronic device and storage medium for controlling the operation of an encryption machine.

[0005] According to a first aspect of the present disclosure, a method for controlling the operation of an encryption machine is provided, the method comprising:

[0006] Obtain the operating status information of the first virtual encryption machine formed based on the hardware encryption machine and the operation data generated by the first virtual encryption machine;

[0007] The operational data is stored in a preset storage cluster;

[0008] Based on the operating status information, determine whether the first virtual encryption machine is malfunctioning;

[0009] When the first virtual encryption machine fails, a virtual encryption recovery operation is performed based on the operation data of the first virtual encryption machine stored in the preset storage cluster.

[0010] In one embodiment, the step of performing a virtual encryption machine recovery operation based on the operation data of the first virtual encryption machine stored in the preset storage cluster when the first virtual encryption machine fails includes: establishing a second virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster when the first virtual encryption machine fails; or restarting the first virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster when the first virtual encryption machine fails.

[0011] In one embodiment, the method further includes: storing the mirror version information of the operation data and the identification data of the first virtual encryption machine in a distributed application coordination service cluster in a preset storage cluster; when the first virtual encryption machine fails, obtaining the operation data of the first virtual encryption machine stored in the object storage cluster based on the mirror version information in the distributed application coordination service cluster and the identification data of the first virtual encryption machine.

[0012] In one embodiment, the operating status information includes at least one of the following: operating status information of the hardware encryption machine; operating status information of the first virtual encryption machine; and mapping relationship information between the first virtual encryption machine and the hardware encryption machine.

[0013] In one embodiment, the step of establishing a second virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster when the first virtual encryption machine fails includes: obtaining available resource status information of a virtual encryption machine resource pool, wherein the virtual encryption machine resource pool includes encryption machine resources, storage resources, and / or network resources; determining configuration parameters of the first virtual encryption machine based on the available resource status information of the virtual encryption machine resource pool when the first virtual encryption machine fails; obtaining first scheduling information based on the configuration parameters of the first virtual encryption machine, wherein the scheduling information is used to schedule the resources of the virtual encryption machine resource pool; and establishing a second virtual encryption machine in the virtual encryption machine resource pool based on the first scheduling information and the operation data of the first virtual encryption machine stored in the preset storage cluster.

[0014] In one embodiment, before the first virtual encryption machine runs, the method further includes: receiving user subscription request information; obtaining configuration parameters of the first virtual encryption machine based on the user subscription request information; obtaining second scheduling information based on the configuration parameters of the first virtual encryption machine; and establishing the first virtual encryption machine in the virtual encryption machine resource pool based on the second scheduling information.

[0015] In one embodiment, the method further includes: outputting alarm information when the first virtual encryption machine fails.

[0016] Secondly, embodiments of this disclosure provide an encryption machine operation control device, the device comprising:

[0017] The acquisition module is used to acquire the running status information of the first virtual encryption machine formed based on the hardware encryption machine and the operation data generated by the first virtual encryption machine;

[0018] A storage module is used to store the operational data into a preset storage cluster;

[0019] The determination module is used to: determine whether the first virtual encryption machine is faulty based on the operating status information;

[0020] The execution module is used to: when the first virtual encryption machine fails, perform a virtual encryption recovery operation based on the operation data of the first virtual encryption machine stored in the preset cluster.

[0021] Thirdly, embodiments of this disclosure provide an electronic device, the electronic device comprising: a processor and a memory for storing a computer program capable of running on the processor; wherein, when the processor runs the computer program, it performs the steps of the methods described in one or more of the foregoing technical solutions.

[0022] Fourthly, embodiments of this disclosure provide a computer-readable storage medium storing computer-executable instructions; when executed by a processor, the computer-executable instructions can implement the methods described in one or more of the foregoing technical solutions.

[0023] The encryption machine operation control method provided in this embodiment includes: acquiring the operation status information of a first virtual encryption machine formed based on a hardware encryption machine and the operation data generated by the first virtual encryption machine; storing the operation data in a preset storage cluster; determining whether the first virtual encryption machine is faulty based on the operation status information; and performing a virtual encryption recovery operation based on the operation data of the first virtual encryption machine stored in the preset storage cluster when the first virtual encryption machine is faulty.

[0024] Here, by automatically determining whether the first virtual encryption machine is faulty and performing a virtual encryption machine recovery operation based on the operation data of the first virtual encryption machine stored in the preset storage cluster after the first virtual encryption machine fails, the efficiency of virtual encryption machine fault detection, backup and automatic recovery can be improved compared with manual operation of the encryption machine in the computer room. Attached Figure Description

[0025] Figure 1 A flowchart illustrating an encryption machine operation control method provided in this embodiment of the present disclosure. Figure 1 .

[0026] Figure 2 A flowchart illustrating an encryption machine operation control method provided in this embodiment of the present disclosure. Figure 2 .

[0027] Figure 3 A flowchart illustrating an encryption machine operation control method provided in this embodiment of the present disclosure. Figure 3 .

[0028] Figure 4A flowchart illustrating an encryption machine operation control method provided in this embodiment of the present disclosure. Figure 4 .

[0029] Figure 5 This is a schematic diagram of an encryption machine operation control system provided in an embodiment of this disclosure.

[0030] Figure 6 This is a schematic diagram of an encryption machine operation control device provided in an embodiment of this disclosure. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this disclosure clearer, the disclosure will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this disclosure. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0032] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0033] In the following description, the terms “first, second, third” are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that “first, second, third” may be interchanged in a specific order or sequence where permitted, so that the embodiments of this disclosure described herein can be implemented in an order other than that illustrated or described herein.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The terminology used herein is for the purpose of describing embodiments of this disclosure only and is not intended to be limiting of this disclosure.

[0035] To better understand the embodiments of this disclosure, the following examples illustrate some scenarios:

[0036] In one embodiment, the encryption device can provide multiple functions such as data encryption and decryption, signature verification, key management and / or access control. Through various encryption algorithms, the encryption device can prevent the leakage and tampering of plaintext data. Furthermore, by securely managing keys, verifying signatures, and controlling access, it can ensure the security of business data and meet regulatory compliance requirements.

[0037] In one embodiment, the encryption machine can be applied to various portal websites and system applications such as government affairs and / or e-commerce and / or social networking.

[0038] In one embodiment, the encryption device performs various operations during the payment process to ensure the security, integrity, and confidentiality of the payment transaction. The payment transaction may include: internet payment, prepaid card payment, point-of-sale (POS) payment, and third-party payment. The various operations of the encryption device may include: encryption and decryption of payment data transmission and storage, authentication of payment identity, and ensuring the non-repudiation of the payment process through signature certificates.

[0039] In one embodiment, the encryption device can ensure the security, integrity, and confidentiality of systems such as social security card systems, city smart card systems, public transport card systems, fuel card systems, and / or financial IC card systems.

[0040] In one embodiment, the encryption device can ensure the security and integrity of electronic invoice data during production, transmission, and / or storage, as well as the authenticity of the electronic invoice user's identity, thereby meeting regulatory compliance requirements. The electronic invoices may include electronic medical records, electronic invoices, electronic contracts, and / or electronic insurance policies, etc.

[0041] In one embodiment, the hardware encryption machine is typically deployed and managed manually in a data center. This includes: regularly inspecting and confirming the operational status of the hardware encryption machine; regularly backing up the encryption machine's operational data; and when the hardware encryption machine malfunctions, manually saving the latest operational data of the malfunctioning hardware encryption machine. If saving is not possible, the regularly backed-up operational data is retrieved, and the encryption machine is deployed and restored based on the operational data. The data within the encryption machine is then verified to confirm its integrity. This requires specialized encryption machine operators, resulting in high labor costs. Furthermore, the restoration process is complex, and human error may lead to restoration failure.

[0042] like Figure 1 As shown in the figure, this disclosure provides a method for controlling the operation of an encryption machine, the method comprising:

[0043] Step S101: Obtain the running status information of the first virtual encryption machine formed based on the hardware encryption machine and the operation data generated by the first virtual encryption machine;

[0044] Step S102: Store the operational data in a preset storage cluster;

[0045] Step S103: Determine whether the first virtual encryption machine is faulty based on the operating status information;

[0046] Step S104: When the first virtual encryption machine fails, a virtual encryption recovery operation is performed based on the operation data of the first virtual encryption machine stored in the preset storage cluster.

[0047] In one embodiment, cloud computing virtualization technology can virtualize a single hardware encryption machine into one or more independently running virtual encryption machines. This virtualization technology can transform the physical resources of one or more computers, such as servers, networks, and storage, into abstract, divisible virtualized resources. These virtualized resources are then integrated to form one or more logical virtual encryption machine resource pools, allowing for unified scheduling and allocation of resources. These virtual encryption machines, also known as cloud encryption machines, can perform data encryption and decryption, signature verification, key management, and / or access control.

[0048] Users can purchase the cloud encryption machines they need from the cloud encryption machine resource pool according to their needs, without having to purchase, install, and maintain hardware encryption machines. This reduces the cost of using encryption machines for users and improves the resource utilization efficiency of encryption machines.

[0049] The user interface of the virtual encryption machine allows users to set templates for example operations for reference and editing, reducing the learning cost for users.

[0050] In one embodiment, network security components can be set up in the cloud network where the virtual encryption machine resides to filter attacks and invalid requests sent to the virtual encryption machine.

[0051] In one embodiment, the encryption machine operating status information can indicate the normal and abnormal states of the first virtual encryption machine; wherein, the abnormal state can include: restart state, abnormal shutdown state, network abnormal state, storage abnormal state and / or response abnormal state, etc.

[0052] The normal state here is: the first virtual encryption machine can perform encryption and / or decryption operations; the abnormal state is: the first virtual encryption machine cannot perform encryption and / or decryption operations.

[0053] In one embodiment, the operation data generated by the first virtual encryption machine may include data generated by users performing encryption operations, decryption operations, managing keys and / or managing permissions on the first virtual encryption machine. The operation data generated by the first virtual encryption machine may also include a snapshot image of the operation data generated by the first virtual encryption machine, wherein the snapshot image can be obtained by a virtual machine encapsulating the operation data.

[0054] In one embodiment, the preset storage cluster may include: an object storage cluster and / or a distributed application coordination service cluster, etc.

[0055] The distributed application coordination service cluster may include a ZooKeeper cluster. The ZooKeeper cluster can achieve distributed coordination through shared storage and can be used for various purposes such as publish / subscribe, load balancing, naming services, cluster management, and / or distributed locks. The ZooKeeper cluster stores data through nodes, and the node model resembles a hierarchical tree structure similar to a file system, allowing operations such as creating, deleting, reading, and modifying nodes.

[0056] The object storage cluster can store data based on objects, each object having a unique identifier used for retrieving and accessing the object. In this embodiment, the object can be the operation data of the first virtual encryption machine, and the object's identifier can include the identification information of the first virtual encryption machine's operation data.

[0057] Step S102 may include: storing the operation data of the first virtual encryption machine into the object storage cluster in the preset storage cluster, and using the identification information of the operation data of the first virtual encryption machine as the object identifier; and storing the identification information of the operation data of the first virtual encryption machine into the distributed application coordination service cluster in the preset storage cluster.

[0058] The identification information can be a globally unique value that identifies the operation data of the first virtual encryption machine. The identification information may include: digital identification information randomly obtained according to a random number generation algorithm, identification information obtained by combining the identification (id, Identity document) data of the first virtual encryption machine with time, or identification information obtained by combining the identification data of the first virtual encryption machine with the mirror version information of the operation data, etc.

[0059] In this way, the operation data of the virtual encryption machine can be stored through the preset storage cluster, realizing automatic backup of the virtual encryption machine. Compared with manual backup, the backup efficiency of the virtual encryption machine can be improved. Compared with manually searching and checking the encryption machine backup, when the first encryption machine fails, the identification information can be quickly determined in the distributed application coordination service cluster. The operation data required to restore the first virtual encryption machine can be quickly retrieved from the object storage cluster using the identification information, which improves the efficiency of restoring the failed first virtual encryption machine.

[0060] In one embodiment, the object storage cluster may include multiple geographically distributed object storage clusters. These clusters enable backup of operational data within the object storage clusters and off-site disaster recovery backup. For example, the operational data of the first virtual encryption machine can be stored in the Suzhou object storage cluster and synchronized to the Wuxi object storage cluster. This way, if the Suzhou object storage cluster experiences a problem, the operational data of the first virtual encryption machine can still be retrieved from the Wuxi object storage cluster, thereby ensuring the security and integrity of the operational data.

[0061] In one embodiment, determining whether the first virtual encryption machine is faulty based on the operating status information of the first virtual encryption machine in step S103 may include, but is not limited to, at least one of the following:

[0062] When the operating status information of the first virtual encryption machine indicates an abnormal state, it is determined that the first virtual encryption machine is faulty;

[0063] When the operating status information of the first virtual encryption machine indicates a normal state, it is determined that the first virtual encryption machine is operating normally and has no faults.

[0064] In one embodiment, the system may periodically acquire the operating status information of the first virtual encryption machine and the operation data generated by the first virtual encryption machine; store the operation data in a preset storage cluster; determine whether the first virtual encryption machine is faulty based on the operating status information; and when the first virtual encryption machine is faulty, perform a virtual encryption machine recovery operation based on the operation data of the first virtual encryption machine stored in the preset storage cluster. Thus, periodically acquiring the operating status information and operation data of the first virtual encryption machine allows for timely backup of the operation data and timely detection and recovery of first virtual machine faults, improving the efficiency of monitoring and managing the encryption machine.

[0065] In one embodiment, such as Figure 5 As shown, the encryption machine operation control method can be executed by the encryption machine operation control system, which may include: a resource manager, an encryption machine monitoring agent, an object storage cluster, a distributed application coordination service ZooKeeper cluster, a database (MySQL) cluster, and a virtual encryption machine resource pool, etc.

[0066] The encryption machine monitoring agent can monitor and obtain the operating status information of the virtual encryption machine and / or the hardware encryption machine, monitor and obtain the operation data generated by the virtual encryption machine, and summarize and send the operating status information of all encryption machines and the operation data generated by the virtual encryption machine to the resource manager.

[0067] The resource manager can view, manage, and control the encryption machine monitoring agent, object storage cluster, distributed application coordination service cluster, and database cluster. The resource manager obtains the running status information of all encryption machines and the operation data generated by the virtual encryption machines; stores the operation data in a preset storage cluster; determines whether the first virtual encryption machine is faulty based on the running status information; and when the first virtual encryption machine is faulty, it can schedule the encryption machine monitoring agent to perform a recovery operation on the virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster.

[0068] The resource manager and the encryption machine monitoring agent can determine the validity of their connection through a heartbeat mechanism. The execution of the heartbeat mechanism may include:

[0069] A heartbeat data packet is sent periodically; the data structure of the heartbeat data packet can be custom-defined or determined based on relevant technologies.

[0070] The periodic sending of a custom heartbeat data packet may include, but is not limited to: the resource manager and the encryption machine monitoring agent periodically sending message control protocol request messages (ICMP, Internet Control Message Protocol).

[0071] Here, when the first virtual encryption machine fails, a virtual encryption machine recovery operation is performed based on the operation data of the first virtual machine stored in the preset storage cluster. Compared with manual encryption machine recovery, this avoids recovery failures caused by operational errors during manual encryption machine recovery. The recovery operation can be performed automatically when the encryption machine fails, improving the speed and success rate of encryption machine recovery. This allows for recovery without the user's awareness, ensuring the continuity and availability of user services.

[0072] In some embodiments, when the first virtual encryption machine fails, performing a recovery operation on the virtual encryption machine based on the operation data of the first virtual machine stored in the preset storage cluster includes:

[0073] When the first virtual encryption machine fails, a second virtual encryption machine is established based on the operation data of the first virtual encryption machine stored in the preset storage cluster.

[0074] Alternatively, when the first virtual encryption machine fails, the first virtual encryption machine can be restarted based on the operation data of the first virtual encryption machine stored in the preset storage cluster.

[0075] In one embodiment, based on the abnormal state of the first virtual encryption machine when it fails, and the operation data of the first virtual encryption machine stored in the preset storage cluster, it can be determined whether to establish a second virtual encryption machine or restart the first virtual encryption machine.

[0076] For example, determine whether the abnormal state can be resolved by restarting the first virtual encryption machine;

[0077] If possible, restart the first virtual encryption machine;

[0078] If not, establish a second virtual encryption machine.

[0079] For example, when the attribute of the first virtual encryption machine is set to power off, the first virtual encryption machine is in an abnormal state. This fault can be resolved by setting the attribute to power on.

[0080] When the first virtual encryption machine is in an abnormal state of insufficient memory, it cannot be resolved by restarting the first virtual encryption machine. Based on the operation data of the first virtual encryption machine stored in the preset storage cluster, a second virtual encryption machine with a larger memory capacity is established.

[0081] In one embodiment, establishing a second virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster may include: establishing a second virtual encryption machine according to the operation data of the first virtual encryption machine, so that the second virtual encryption machine can replace the first virtual encryption machine to continue working.

[0082] like Figure 2 As shown, in some embodiments, the method further includes:

[0083] Step S201: Store the mirror version information of the operation data and the identification data of the first virtual encryption machine in the distributed application coordination service cluster in the preset storage cluster.

[0084] Step S202: When the first virtual encryption machine fails, obtain the operation data of the first virtual encryption machine stored in the object storage cluster based on the image version information in the distributed application coordination service cluster and the identification data of the first virtual encryption machine.

[0085] In one embodiment, the distributed application coordination service ZooKeeper cluster can use the encryption machine's identifier (id, identity document) data as a root directory node, and create subdirectory nodes under the root node for the image version information corresponding to the encryption machine. The encryption machine identifier data root directory node can serve as a checkpoint for the image version information, which can be used to retrieve the image version information from the object storage cluster and restore the first virtual encryption machine.

[0086] In one embodiment, the subdirectory nodes of the image version information are set as sequential nodes, that is, sequential identifiers are set for the subdirectory nodes of the image version information, and the sequence numbers in the sequence identifiers are monotonically increasing. Based on the sequence identifiers, the subdirectory nodes of the image version information under the root directory node of the encryption machine's identifier data can be globally sorted, and the subdirectory node with the largest sequence number is the latest image version information. Thus, compared to viewing the information of all subdirectory nodes and comparing the storage times of the subdirectory nodes to determine the latest subdirectory node, the latest image version information subdirectory node can be quickly retrieved through sequential nodes, improving the efficiency of determining the latest image version information of the virtual encryption machine.

[0087] In one embodiment, the object storage cluster can use image version information and the identification data of the first virtual encryption machine as object identifiers for object storage data, and query and call the snapshot image of the first virtual encryption machine based on the object identifiers.

[0088] In one embodiment, the identification data of the first virtual encryption machine is bound to the image version information of the operation data, and stored accordingly in the distributed application coordination service cluster in a preset storage cluster. When the first virtual encryption machine fails, the latest snapshot image version information of the child node under the identification data node of the first virtual encryption machine is queried in the distributed application coordination service based on the identification data of the first virtual encryption machine to obtain the latest snapshot image version information of the first virtual encryption machine; based on the image version information and the identification data of the first virtual encryption machine, the latest snapshot image of the first virtual encryption machine is retrieved from the object storage cluster to perform the virtual encryption recovery operation of the first virtual encryption machine.

[0089] Here, the mirror version information of the operation data and the identification data of the first virtual encryption machine are stored in the distributed application coordination service cluster. Compared with storing other data, the faulty virtual encryption machine can be quickly found based on the unique identification data of the virtual encryption machine, and the node with the latest mirror version information can be found in the root directory node of the identification data, which improves the efficiency of determining the operation data of the first virtual encryption machine.

[0090] Here, by storing the image version information of the identification data and operation data of the virtual encryption machine in the distributed application coordination service cluster, compared to storing only the image version information of the identification data and operation data of the virtual encryption machine in the object storage cluster, the latest image version information of the first virtual machine that failed can be quickly retrieved by the distributed application coordination service cluster, thereby calling the image to perform recovery operations more quickly and improving the speed and efficiency of encryption machine recovery.

[0091] In some embodiments, the operating status information includes at least one of the following: operating status information of the hardware encryption machine, operating status information of the first virtual encryption machine, and / or mapping relationship information between the first virtual encryption machine and the hardware encryption machine.

[0092] In one embodiment, when the operating status information of the first virtual encryption machine indicates an abnormal state, the first hardware encryption machine corresponding to the mapping relationship between the first virtual encryption machine and the hardware encryption machine is determined based on the mapping relationship information between the first virtual encryption machine and the hardware encryption machine, and it is checked whether the operating status information of the first hardware encryption machine indicates an abnormal state. If the operating status information of the first hardware encryption machine indicates an abnormal state, the abnormal state of the first virtual encryption machine may be caused by the abnormal state of the first hardware encryption machine, and simply restarting the first virtual encryption machine or creating a second virtual encryption machine mapped to the first hardware encryption machine cannot restore the virtual encryption machine to a normal working state.

[0093] In one embodiment, the first virtual encryption machine can be determined to be faulty based on its abnormal state. The step of performing a virtual encryption machine recovery operation based on the operation data of the first virtual machine stored in the preset storage cluster may include: establishing a second virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster, wherein the second virtual encryption machine maps to a hardware encryption machine in a normal state other than the first hardware encryption machine; or, restarting the first hardware encryption machine. If the restarted first hardware encryption machine returns to a normal state, the first virtual encryption machine is restarted or a second virtual encryption machine is established based on the operation data of the first virtual encryption machine stored in the preset storage cluster.

[0094] Here, based on the operating status information of the detected hardware encryption machine, the operating status information of the first virtual encryption machine, and / or the mapping relationship information between the first virtual encryption machine and the hardware encryption machine, compared to only detecting the operating status information of the virtual encryption machine, the operating status of the hardware encryption machine and the virtual encryption machine can be monitored and controlled simultaneously. This allows for timely detection and resolution of virtual encryption machine failures caused by hardware encryption machine failures, improving the efficiency of encryption machine operation control and fault recovery, and ensuring the stability of the encryption machine for users and the smoothness of the user experience.

[0095] like Figure 3 As shown, in some embodiments, when the first virtual encryption machine fails, establishing a second virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster includes:

[0096] Step S301: Obtain the available resource status information of the virtual encryption machine resource pool, wherein the virtual encryption machine resource pool includes encryption machine resources, storage resources and / or network resources;

[0097] Step S302: When the first virtual encryption machine fails, determine the configuration parameters of the first virtual encryption machine based on the available resource status information of the virtual encryption machine resource pool;

[0098] Step S303: Obtain first scheduling information according to the configuration parameters of the first virtual encryption machine, wherein the scheduling information is used to schedule the resources of the virtual encryption machine resource pool;

[0099] Step S304: Based on the first scheduling information and the operation data of the first virtual encryption machine stored in the preset storage cluster, establish a second virtual encryption machine in the virtual encryption machine resource pool.

[0100] In one embodiment, the available resource status information of the encryption machine resource pool may include: available encryption machine resources, available storage resources, and / or available network resources.

[0101] The available encryption machine resources may include: available hardware encryption machines, the type of available encryption machines, the region where the available encryption machines are located, and / or the number of available encryption machines, etc.

[0102] The storage resources may include: a central processing unit (CPU), memory, and / or a hard disk, etc.

[0103] The network resources may include: optional bandwidth, Virtual Private Cloud (VPC) Internet Protocol (IP) network segments and Internet Protocol IP addresses and / or network transmission capabilities, etc.

[0104] The information regarding the hardware encryption device may include the manufacturer and model number. The encryption device type can be categorized as a Financial Data Encryption Module (EVSM, Electronic Virtual Security Module), a Sign Verification Encryption Module (SVSM), or a General Virtual Security Module (GVSM), etc. Since encryption devices are often used in private virtual private networks (VPCs), the geographical location of the encryption device must be the same as the geographical location of the user's business.

[0105] In one embodiment, determining the configuration parameters of the first virtual encryption machine in step S302 based on the available resource status information of the virtual encryption machine resource pool may include: determining the amount of computing resources, storage resources, and / or bandwidth resources occupied by the first virtual encryption machine based on the amount of available computing resources, storage resources, and / or bandwidth resources in the virtual encryption machine resource pool.

[0106] In some embodiments, the available resource status information may further include: available IP address resources, etc. If there are enough available IP addresses, a separate IP address can be configured for the newly added first virtual encryption machine. If there are not enough available IP addresses, the newly added first virtual encryption machine and other virtual encryption machines can be configured to use the same IP address, but use different port numbers.

[0107] In summary, the configuration parameters can be parameters that describe various attributes and performance of the first virtual encryption machine.

[0108] In one embodiment, the first scheduling information may include: information on resources in a predetermined regional resource pool that correspond to the configuration parameters of the first virtual encryption machine.

[0109] In one embodiment, obtaining the first scheduling information based on the configuration parameters of the first virtual encryption machine may include: obtaining the first scheduling information based on the configuration parameters of the first virtual encryption machine, available resource status information, and abnormal status information of the first virtual encryption machine.

[0110] For example, the abnormal state of the first virtual encryption machine is caused by the abnormal state of the hardware encryption machine. The configuration parameters of the first virtual encryption machine may include: the location is Suzhou, the manufacturer and model of the hardware encryption machine is Jiangnan Tianan SJJ1528, the private network IP segment is 192.168.0.0 / 16, and the memory is 4G. Then, according to the available resource status information, there is an available hardware encryption machine Jiangnan Tianan SJJ1528 in the Suzhou encryption machine resource pool. There is also an available IP address in the private network IP segment 192.168.0.0 / 16 in the IP address pool of the Suzhou encryption machine resource pool. The available memory is 100G. Then, the first scheduling information can dynamically allocate a hardware encryption machine as a mapping of the virtual encryption machine, call 4G memory, and dynamically allocate a private network IP address for the virtual encryption machine in the network segment 192.168.0.0 / 16 for the available hardware encryption machine Jiangnan Tianan SJJ1528 in the Suzhou encryption machine resource pool.

[0111] In one embodiment, establishing the second virtual encryption machine in step S304 may include: creating a second virtual encryption machine in the virtual encryption machine resource pool according to the first scheduling information; configuring the second virtual encryption machine, wherein configuring the second encryption machine may include: importing the operation data of the first virtual encryption machine stored in the preset storage cluster into the second virtual encryption machine; and starting the second virtual encryption machine.

[0112] In one embodiment, the method further includes: storing available resource status information of the encryption machine resource pool in a database, and obtaining available resource status information from the database. After establishing the second virtual encryption machine based on the first scheduling information, the first scheduling information and the available resource status information of the scheduled encryption machine resource pool are also stored in the database.

[0113] like Figure 4 As shown, in some embodiments, before the first virtual encryption machine runs, the method further includes:

[0114] Step S401: Receive user order request information;

[0115] Step S402: Obtain the configuration parameters of the first virtual encryption machine based on the user order request information;

[0116] Step S403: Obtain the second scheduling information based on the configuration parameters of the first virtual encryption machine;

[0117] Step S404: Establish a first virtual encryption machine in the virtual encryption machine resource pool according to the second scheduling information.

[0118] In one embodiment, the user order request information may include a user order request message, which may include parameters such as: region, device manufacturer, memory, bandwidth, encryption machine type, encryption algorithm and computing power supported by the encryption machine, quantity and / or purchase duration.

[0119] In one embodiment, the parameter information in the user's order request information is used as the configuration parameters of the first virtual encryption machine.

[0120] In one embodiment, second scheduling information for scheduling resources in the virtual encryption machine resource pool is obtained based on the available resource status information in the encryption machine resource pool and the configuration parameters of the first virtual encryption machine. The method may include: dynamically scheduling resources in the encryption machine resource pool that conforms to the configuration parameters of the first virtual encryption machine to obtain the second scheduling information.

[0121] For example, a predetermined number of virtual encryption machines are dynamically selected from the encryption machine resource pool that meets the configuration parameters of the first virtual encryption machine, and IP addresses are determined from the private network IP address pool based on dynamic allocation.

[0122] In some embodiments, the method further includes: outputting alarm information when the first virtual encryption machine fails.

[0123] In one embodiment, the output alarm information may include: sending alarm information to staff via email and / or SMS or other communication methods to remind staff to handle the fault; and / or issuing sound or visual alarm information.

[0124] In one embodiment, the alarm information may include: the operating status information of the first virtual encryption machine, the operating status information of the first hardware encryption machine corresponding to the first virtual encryption machine, and / or possible causes of abnormal status, etc.

[0125] In this way, when the first virtual encryption machine fails, alarm information can be output in a timely manner to notify the operation and maintenance personnel, so that the operation and maintenance personnel can check the fault in a timely manner and confirm whether the virtual encryption recovery operation of the first virtual encryption machine is successful. If the fault cannot be automatically repaired, timely handling can be carried out, which further improves the efficiency of encryption machine operation and maintenance monitoring.

[0126] In one embodiment, the method can be executed by a cloud monitoring system, which can periodically obtain monitoring information from the encryption machine monitoring agent. When the first virtual encryption machine fails, the cloud monitoring system outputs alarm information.

[0127] In one embodiment, a cryptographic machine operation control system such as Figure 5 As shown, the flow of the encryption machine operation control method executed by the encryption machine operation control system may include:

[0128] Step 1: The resource manager receives the user's subscription request information;

[0129] Step 2: The resource manager obtains the configuration parameters of the first virtual encryption machine based on the user's order request information and the available resource status information of the resource pool in the database;

[0130] The resource manager obtains the second scheduling information based on the configuration parameters of the first virtual encryption machine, and sends the second scheduling information to the encryption machine monitoring agent;

[0131] Step 3: The encryption machine monitoring agent establishes the first virtual encryption machine in the virtual encryption machine resource pool according to the second scheduling information;

[0132] Step 4: The encryption machine monitoring agent obtains the first virtual encryption machine's operating status information and a snapshot image based on the first virtual encryption machine's operation data;

[0133] Step 5: The resource manager obtains the running status information of the first virtual encryption machine and a snapshot image of the operation data of the first virtual encryption machine based on the encryption machine monitoring agent;

[0134] Step 6: The resource manager stores the snapshot image of the operation data of the first virtual encryption machine in the object storage cluster; and stores the identification data of the first virtual encryption machine and the snapshot image version information in the distributed application coordination service ZooKeeper cluster.

[0135] Step 7: The resource manager determines whether the first virtual encryption machine is faulty based on the running status information;

[0136] Step 8: When the first virtual encryption machine fails, the resource manager queries the ZooKeeper cluster for the latest image version information of the operation data of the first virtual encryption machine based on the identification data of the first virtual encryption machine;

[0137] Step 9: Obtain the latest snapshot image of the first virtual encryption machine from the object storage cluster based on the identification data of the first virtual encryption machine and the latest image version information of the operation data;

[0138] Step 10: The resource manager obtains the available resource status information of the virtual encryption machine resource pool in the database, wherein the virtual encryption machine resource pool includes encryption machine resources, storage resources and / or network resources;

[0139] Step 11: The resource manager determines the configuration parameters of the first virtual encryption machine based on the available resource status information of the virtual encryption machine resource pool;

[0140] Step 12: The resource manager obtains the first scheduling information based on the configuration parameters of the first virtual encryption machine, wherein the scheduling information is used to schedule the resources of the virtual encryption machine resource pool;

[0141] Step 13: The resource manager sends the first scheduling information and the latest snapshot image of the first virtual encryption machine to the encryption machine monitoring agent;

[0142] Step 14: The encryption machine monitoring agent establishes a second virtual encryption machine in the virtual encryption machine resource pool based on the first scheduling information and the snapshot image of the operation data of the first virtual encryption machine. The second virtual encryption machine then replaces the first virtual encryption machine to continue working.

[0143] like Figure 6 As shown, this disclosure provides an encryption machine operation control device, the device comprising:

[0144] The acquisition module 10 is used to acquire the running status information of the first virtual encryption machine formed based on the hardware encryption machine and the operation data generated by the first virtual encryption machine;

[0145] Storage module 20 is used to store the operational data in a preset storage cluster;

[0146] The determination module 30 is used to: determine whether the first virtual encryption machine is faulty based on the operating status information;

[0147] The execution module 40 is used to: when the first virtual encryption machine fails, perform a virtual encryption recovery operation based on the operation data of the first virtual encryption machine stored in the preset cluster.

[0148] In one embodiment, the execution module 40 further includes: an establishment module 41 or a restart module 42; wherein, the establishment module 41 is configured to: when the first virtual encryption machine fails, establish a second virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster; the restart module 42 is configured to: when the first virtual encryption machine fails, restart the first virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster.

[0149] In one embodiment, the storage module 20 is further configured to: store the mirror version information of the operation data and the identification data of the first virtual encryption machine in a distributed application coordination service cluster in a preset storage cluster; the device further includes: an obtaining module 50; wherein, the obtaining module 50 is configured to: when the first virtual encryption machine fails, obtain the operation data of the first virtual encryption machine stored in the object storage cluster according to the mirror version information in the distributed application coordination service cluster and the identification data of the first virtual encryption machine.

[0150] In one embodiment, the operating status information includes at least one of the following: operating status information of the hardware encryption machine; operating status information of the first virtual encryption machine; and mapping relationship information between the first virtual encryption machine and the hardware encryption machine.

[0151] In one embodiment, the obtaining module 50 is further configured to: obtain available resource status information of the virtual encryption machine resource pool, wherein the virtual encryption machine resource pool includes encryption machine resources, storage resources and / or network resources; obtain first scheduling information based on the configuration parameters of the first virtual encryption machine, wherein the scheduling information is used to schedule the resources of the virtual encryption machine resource pool; the determining module 30 is further configured to: determine the configuration parameters of the first virtual encryption machine based on the available resource status information of the virtual encryption machine resource pool when the first virtual encryption machine fails; the establishing module 41 is further configured to: establish a second virtual encryption machine in the virtual encryption machine resource pool based on the first scheduling information and the operation data of the first virtual encryption machine stored in the preset storage cluster.

[0152] In one embodiment, the apparatus further includes: a receiving module 60; wherein the receiving module 60 is configured to receive user order request information; the obtaining module 50 is further configured to: obtain configuration parameters of the first virtual encryption machine based on the user order request information; obtain second scheduling information based on the configuration parameters of the first virtual encryption machine; and the establishing module 41 is further configured to: establish the first virtual encryption machine in the virtual encryption machine resource pool based on the second scheduling information.

[0153] In one embodiment, the device further includes an output module 70; wherein the output module 70 is configured to output alarm information when the first virtual encryption machine fails.

[0154] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0155] This disclosure also provides an electronic device, which includes a processor and a memory for storing a computer program that can run on the processor. When the processor runs the computer program, it performs the steps of the methods described in one or more of the foregoing technical solutions.

[0156] This disclosure also provides a computer-readable storage medium storing computer-executable instructions. When executed by a processor, the computer-executable instructions can implement the methods described in one or more of the foregoing technical solutions.

[0157] The computer storage medium provided in this embodiment may be a non-transient storage medium. In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods, such as multiple units or components being combined, integrated into another system, or some features being ignored or not executed. Furthermore, the coupling, direct coupling, or communication connection between the various components shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0158] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0159] In addition, each functional unit in the various embodiments of this disclosure can be integrated into one processing module, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0160] In some cases, where any two of the above technical features do not conflict, they can be combined to form a new method or technical solution.

[0161] In some cases, where any two of the above technical features do not conflict, they can be combined to form a new equipment technical solution.

[0162] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0163] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. A method for controlling the operation of an encryption machine, characterized in that, The method includes: Obtain the operating status information of the first virtual encryption machine formed based on the hardware encryption machine and the operation data generated by the first virtual encryption machine; The operational data is stored in a preset storage cluster; Based on the operating status information, determine whether the first virtual encryption machine is malfunctioning; When the first virtual encryption machine fails, a second virtual encryption machine is established based on the operation data of the first virtual encryption machine stored in the preset storage cluster to perform a virtual encryption recovery operation. Wherein, when the first virtual encryption machine fails, establishing a second virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster includes: Obtain information on the available resource status of the virtual encryption machine resource pool, which includes encryption machine resources, storage resources, and / or network resources; When the first virtual encryption machine fails, the configuration parameters of the first virtual encryption machine are determined based on the available resource status information of the virtual encryption machine resource pool. Based on the configuration parameters of the first virtual encryption machine, first scheduling information is obtained, and the scheduling information is used to schedule the resources of the virtual encryption machine resource pool; Based on the first scheduling information and the operation data of the first virtual encryption machine stored in the preset storage cluster, a second virtual encryption machine is established in the virtual encryption machine resource pool.

2. The method according to claim 1, characterized in that, When the first virtual encryption machine fails, after storing the operation data of the first virtual encryption machine in the preset storage cluster, the method further includes: Restart the first virtual encryption machine.

3. The method according to claim 1, characterized in that, The method further includes: The mirror version information of the operation data and the identification data of the first virtual encryption machine are stored in the distributed application coordination service cluster in the preset storage cluster. When the first virtual encryption machine fails, the operation data of the first virtual encryption machine stored in the object storage cluster is obtained based on the image version information in the distributed application coordination service cluster and the identification data of the first virtual encryption machine.

4. The method according to claim 1, characterized in that, The operational status information includes at least one of the following: Operating status information of the hardware encryption machine; The operating status information of the first virtual encryption machine; The mapping relationship information between the first virtual encryption machine and the hardware encryption machine.

5. The method according to claim 1, characterized in that, Before the first virtual encryption machine runs, the method further includes: Receive user order request information; Based on the user's order request information, obtain the configuration parameters of the first virtual encryption machine; Based on the configuration parameters of the first virtual encryption machine, the second scheduling information is obtained; A first virtual encryption machine is established in the virtual encryption machine resource pool according to the second scheduling information.

6. The method according to claim 4, characterized in that, The method further includes: When the first virtual encryption machine fails, an alarm message is output.

7. A control device for the operation of an encryption machine, characterized in that, The device includes: The acquisition module is used to acquire the running status information of the first virtual encryption machine formed based on the hardware encryption machine and the operation data generated by the first virtual encryption machine; acquire the available resource status information of the virtual encryption machine resource pool, wherein the virtual encryption machine resource pool includes encryption machine resources, storage resources and / or network resources; and acquire first scheduling information according to the configuration parameters of the first virtual encryption machine, wherein the scheduling information is used to schedule the resources of the virtual encryption machine resource pool. A storage module is used to store the operational data into a preset storage cluster; The determination module is used to: determine whether the first virtual encryption machine is faulty based on the running status information; when the first virtual encryption machine is faulty, determine the configuration parameters of the first virtual encryption machine based on the available resource status information of the virtual encryption machine resource pool; The execution module is configured to: when the first virtual encryption machine fails, establish a second virtual encryption machine based on the operation data of the first virtual encryption machine stored in the preset storage cluster to perform a virtual encryption recovery operation; and establish a second virtual encryption machine in the virtual encryption machine resource pool according to the first scheduling information and the operation data of the first virtual encryption machine stored in the preset storage cluster.

8. An electronic device, characterized in that, The electronic device includes: a processor and a memory for storing a computer program capable of running on the processor, wherein when the processor runs the computer program, it performs the steps of the encryption machine operation control method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions; when the computer-executable instructions are executed by a processor, they can implement the encryption machine operation control method as described in any one of claims 1 to 6.

Images