Secret computation environment creation method, cryptographic operation method, and related devices

Abstract

Embodiments of the present application provide a confidential computing environment creation method, a cryptographic operation method and related equipment. The confidential computing environment creation method is applied to a cryptographic module manager and includes obtaining image information of a cryptographic module; determining hardware resources required for running the cryptographic module based on the image information of the cryptographic module; generating a confidential computing environment creation request based on the hardware resources required for running the cryptographic module; and sending the confidential computing environment creation request to enable a confidential environment manager to create a confidential computing environment matching the running requirements of the cryptographic module based on the confidential computing environment creation request, wherein the running requirements of the cryptographic module are adapted to the hardware resources required for running the cryptographic module. The confidential computing environment created in the embodiments of the present application can meet the performance requirements of the cryptographic module, avoid waste of hardware resources, and improve the overall performance of the electronic device.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a method for creating a confidential computing environment, a cryptographic operation method, and related equipment. Background Technology

[0002] Cryptography is a technology for ensuring information confidentiality and has wide applications in computer use. Its main application is cryptographic operations, such as encrypting and decrypting data to prevent malicious theft, and digitally signing data to guarantee its authenticity and security. In modern computer architectures, cryptographic operations can be implemented using dedicated cryptographic modules (CMs), which are configured within electronic devices to perform cryptographic calculations. Against this backdrop, providing technical solutions to improve the overall performance of electronic devices has become a pressing technical problem for those skilled in the art. Summary of the Invention

[0003] In view of this, embodiments of this application provide a method for creating a confidential computing environment, a cryptographic operation method, and related equipment to improve the overall performance of electronic devices.

[0004] In a first aspect, embodiments of this application provide a method for creating a confidential computing environment, applied to a cryptographic module manager, comprising:

[0005] Obtain the image information of the cryptographic module;

[0006] Based on the image information of the cryptographic module, determine the hardware resources required to run the cryptographic module;

[0007] Based on the hardware resources required to run the cryptographic module, a confidential computing environment creation request is generated;

[0008] Send the confidential computing environment creation request so that the confidential environment manager can create a confidential computing environment that matches the operating requirements of the cryptographic module, the operating requirements of the cryptographic module being adapted to the hardware resources required to run the cryptographic module.

[0009] Optionally, determining the hardware resources required to run the cryptographic module based on the image information of the cryptographic module includes:

[0010] Based on the image information of the cryptographic module, determine the performance configuration file of the cryptographic module;

[0011] Based on the performance profile, determine the number of processor cores and memory resources required to run the cryptographic module.

[0012] Optionally, generating a confidential computing environment creation request based on the hardware resources required to run the cryptographic module specifically involves generating a confidential computing environment creation request based on the number of processor cores and memory resources required to run the cryptographic module.

[0013] Optionally, after sending the confidential computing environment creation request, the method further includes:

[0014] The image information of the cryptographic module is sent so that the confidential environment manager loads the image information of the cryptographic module into the created confidential computing environment, so that the cryptographic module runs in the confidential computing environment.

[0015] Secondly, embodiments of this application provide a method for creating a confidential computing environment, applied to a confidential environment manager, including:

[0016] Obtain a confidential computing environment creation request sent by the cryptographic module manager; wherein, the confidential computing environment creation request is generated by the cryptographic module manager based on the hardware resources required to run the cryptographic module, and the hardware resources required to run the cryptographic module are determined by the cryptographic module manager based on the obtained image information of the cryptographic module;

[0017] Based on the confidential computing environment creation request, a confidential computing environment matching the operational requirements of the cryptographic module is created, wherein the operational requirements of the cryptographic module are adapted to the hardware resources required to run the cryptographic module.

[0018] Optionally, the confidential computing environment creation request includes the number of processor cores and memory resources required to run the cryptographic module.

[0019] Optionally, the step of creating a confidential computing environment that matches the operational requirements of the cryptographic module based on the confidential computing environment creation request includes:

[0020] Based on the number of processor cores, the corresponding number of processor cores are configured into the confidential computing environment;

[0021] Based on the memory resources, the corresponding memory addresses are configured to the confidential computing environment.

[0022] Optionally, after creating a confidential computing environment that matches the operational requirements of the cryptographic module, the method further includes:

[0023] Obtain the image information of the cryptographic module sent by the cryptographic module manager, and load the image information of the cryptographic module into the confidential computing environment to run the cryptographic module in the confidential computing environment.

[0024] Thirdly, embodiments of this application provide a cryptographic operation method applied to a confidential computing environment created by the confidential computing environment creation method described in the first aspect and / or the second aspect above, the method comprising:

[0025] The cryptographic module obtains the key file and derives the key for cryptographic operations based on the key file;

[0026] The cryptographic application sends a verification request to the cryptographic module to verify the integrity of the cryptographic module;

[0027] If the cryptographic module is complete, the cryptographic application calls the cryptographic module to perform cryptographic operations.

[0028] Optionally, the cryptographic module includes a sealing key;

[0029] The cryptographic module obtains the key for cryptographic operations based on the key file by using the sealing key to decrypt the cryptographic file and obtain the key for cryptographic operations.

[0030] Optionally, the cryptographic module utilizes a cryptographic operation module to assist in performing cryptographic operations;

[0031] The cryptographic application calls the cryptographic module to perform cryptographic operations, specifically: the cryptographic application calls the cryptographic module; the cryptographic module uses the cryptographic operation module to perform cryptographic operations.

[0032] Fourthly, embodiments of this application provide a cryptographic computing system, which includes at least a cryptographic application, a cryptographic module, a cryptographic module manager, and a confidential environment manager. The cryptographic module manager and the confidential environment manager are used to create a confidential computing environment that matches the operational requirements of the cryptographic module.

[0033] The cryptographic module is used to obtain a key file and obtain a key for cryptographic operations based on the key file in the confidential computing environment.

[0034] The cryptographic application is used to send a verification request to the cryptographic module in the confidential computing environment to verify the integrity of the cryptographic module; wherein, if the cryptographic module is intact, the cryptographic application calls the cryptographic module to perform cryptographic operations.

[0035] Optionally, the password module manager includes:

[0036] The information acquisition unit is used to acquire the image information of the cryptographic module;

[0037] The resource determination unit is used to determine the hardware resources required to run the cryptographic module based on the image information of the cryptographic module.

[0038] The request generation unit is used to generate a confidential computing environment creation request based on the hardware resources required to run the cryptographic module;

[0039] The request sending unit is used to send the confidential computing environment creation request, so that the confidential environment manager can create a confidential computing environment that matches the operation requirements of the cryptographic module based on the confidential computing environment creation request, wherein the operation requirements of the cryptographic module are adapted to the hardware resources required to run the cryptographic module.

[0040] Optionally, the confidential environment manager includes:

[0041] The request retrieval unit is used to retrieve the confidential computing environment creation request sent by the cryptographic module manager;

[0042] The environment creation unit is used to create a confidential computing environment that matches the operational requirements of the cryptographic module based on the confidential computing environment creation request.

[0043] Optionally, it may also include: a cryptographic operation module, which is used to assist the cryptographic module in performing cryptographic operations in the confidential computing environment.

[0044] Fifthly, embodiments of this application provide an electronic device, including at least one memory and at least one processor, wherein the memory stores one or more computer-executable instructions, and the processor invokes the one or more computer-executable instructions to execute the confidential computing environment creation method as described in the first aspect and / or the second aspect, and / or the cryptographic operation method as described in the third aspect.

[0045] Sixthly, embodiments of this application provide a storage medium that stores one or more computer-executable instructions. When the one or more computer-executable instructions are executed, they implement the confidential computing environment creation method as described in the first aspect and / or the second aspect, and / or the cryptographic operation method as described in the third aspect.

[0046] The confidential computing environment creation method provided in this application embodiment is applied to a cryptographic module manager. It obtains the image information of a cryptographic module, and then determines the hardware resources required to run the cryptographic module based on the image information. Based on the hardware resources required to run the cryptographic module, it generates a confidential computing environment creation request and sends the request, so that the confidential environment manager creates a confidential computing environment that matches the operating requirements of the cryptographic module, whereby the operating requirements of the cryptographic module are adapted to the hardware resources required to run the cryptographic module.

[0047] As can be seen, in this embodiment, the cryptographic module manager determines the hardware resources required to run the cryptographic module based on the module's image information, and generates a confidential computing environment creation request. This allows the confidential computing environment manager to create a confidential computing environment that matches the cryptographic module's operational requirements, thus ensuring that the confidential computing environment meets the performance requirements of the cryptographic module. Furthermore, the confidential computing environment's matching of the cryptographic module's operational requirements with the hardware resources needed to run the cryptographic module prevents waste of hardware resources and improves the overall performance of the electronic device. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0049] Figure 1 This is a schematic diagram of the optional structure of a processor in an electronic device;

[0050] Figure 2 This is a schematic diagram of an optional architecture of the cryptographic operation system provided in the embodiments of this application;

[0051] Figure 3 This is a schematic diagram of the internal structure of the cryptographic module provided in an embodiment of this application;

[0052] Figure 4 This is an optional flowchart of the confidential computing environment creation method provided in the embodiments of this application;

[0053] Figure 5 This is an optional schematic diagram of step S31 provided in the embodiments of this application;

[0054] Figure 6 This is an optional schematic diagram of step S35 provided in the embodiments of this application;

[0055] Figure 7 This is an optional flowchart of the cryptographic operation method provided in the embodiments of this application;

[0056] Figure 8 This is a schematic diagram of another optional architecture of the cryptographic operation system provided in the embodiments of this application;

[0057] Figure 9 This is a schematic diagram of an optional structure of the cryptographic module manager provided in an embodiment of this application;

[0058] Figure 10 This is a schematic diagram of an optional structure of the confidential environment manager provided in an embodiment of this application;

[0059] Figure 11 This is another optional architecture diagram of the cryptographic operation system provided in the embodiments of this application;

[0060] Figure 12 This is an optional block diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0061] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0062] As described in the background section, in modern computer architectures, cryptographic operations can be implemented based on dedicated cryptographic modules (CMs). By configuring the corresponding cryptographic modules in electronic devices, the cryptographic modules can be invoked to perform cryptographic operations.

[0063] As an optional implementation, the cryptographic module can be configured based on high-security hardware in the electronic device to ensure the operational security of the cryptographic module while performing cryptographic operations. Figure 1 An exemplary schematic diagram of an optional architecture for a processor (Central Processing Unit, CPU) in an electronic device is shown. Figure 1 As shown, the processor may include: processor core 110 and security processor 120.

[0064] It is understood that the security processor 120 is a hardware device independent of and isolated from the processor core 110. Furthermore, the processor core 110 cannot access the hardware resources of the security processor 120, such as its internal storage. Because the security processor has independent executable resources, it can form a closed executable environment. Therefore, except for data actively shared externally by the security processor, external entities cannot access the data of the security processor itself. Thus, when performing cryptographic operations on data, the cryptographic modules can perform these operations based on the closed executable environment provided by the security processor, ensuring the security of the cryptographic operations.

[0065] In a specific example, a cryptographic module 121 can be set up based on the security processor 120. The security processor 120 provides a command interface for the cryptographic module 121, enabling the cryptographic module 121 to interact with the processor core 110 for use by applications on the processor core 110. In one example, the program that uses the cryptographic module can be referred to as a cryptographic application.

[0066] However, the inventors discovered that due to limitations in processor hardware architecture, the number of security processors integrated within a processor is fixed. Therefore, when facing constantly changing cryptographic computation requirements in a system, setting up cryptographic modules based on security processors cannot achieve flexible configuration of cryptographic modules, thus affecting cryptographic performance. For example, when handling more encryption and data protection tasks, a fixed number of security processors may result in insufficient processing power for different types of cryptographic operations. Conversely, when the cryptographic computation requirements of cryptographic applications on the processor decrease, a fixed number of security processors with cryptographic modules may lead to a waste of processor hardware resources. Furthermore, since security processors are dedicated to security functions and focus on performing security-related operations, they do not need to handle high-performance computing tasks compared to the main processor. This results in security processors typically having lower performance in terms of data processing frequency and caching, thereby limiting the performance of cryptographic modules and ultimately reducing the overall performance of the electronic device.

[0067] Additionally, it's important to note that integrating a security processor within the processor presents a technical prerequisite: the processor must provide hardware support for the security processor, such as encryption / decryption engines and caching. However, most processor chips do not offer this support, further limiting the versatility of applications that place cryptographic modules within a security processor, allowing the security processor to provide a secure and executable environment for cryptographic operations.

[0068] Therefore, it is particularly necessary to provide solutions to improve the overall performance of electronic devices.

[0069] In view of this, the embodiments of this application propose an improved technical solution. Based on the image information of the cryptographic module, the cryptographic module manager determines the hardware resources required to run the cryptographic module and generates a confidential computing environment creation request. This enables the confidential computing environment manager to create a confidential computing environment that matches the operational requirements of the cryptographic module, thereby ensuring that the confidential computing environment created by the confidential environment manager meets the performance requirements of the cryptographic module. Simultaneously, the operational requirements of the cryptographic module matched by the confidential computing environment are adapted to the hardware resources required to run the cryptographic module, thus avoiding waste of hardware resources and improving the overall performance of the electronic device.

[0070] in, Figure 2 An exemplary schematic diagram of an optional architecture of the cryptographic operation system provided in an embodiment of this application is shown. For example... Figure 2 As shown, the cryptographic operation system includes at least: a Crypto Module (CM) 20, a Crypto Module Manager (also known as a "CM Manager") 21, and a Confidential Environment Manager (also known as a "CCE Manager") 22.

[0071] Among them, the cryptographic module 20 is a module with cryptographic operation functions, which performs cryptographic operations based on the calls of cryptographic applications. For example... Figure 3 The diagram illustrates the internal structure of the cryptographic module 20. The cryptographic module 20 may include a key management unit 201 and a cryptographic operation unit 202. The key management unit 201 manages the entire lifecycle of the key, including key generation, storage, use, update, and destruction. Typically, the plaintext of the key can only appear within the cryptographic module; if the key leaves the module, it needs to be encrypted. The cryptographic operation unit 202 implements various standard cryptographic algorithms, including encryption, decryption, signing, signature verification, MAC message verification code calculation (shown as a hash in the diagram), key generation, and key negotiation. The MAC message verification code calculation can, for example, use a hash function. The original message and the key are input into the hash function to obtain the verification code, which can be a fixed-length value used to verify the integrity and authenticity of the message.

[0072] The cryptographic module manager 21 manages the cryptographic module 20 that performs cryptographic operations. Furthermore, the cryptographic module manager 21 can use the confidential environment manager 22 to create a confidential computing environment (CCE) for the cryptographic module 20 to perform cryptographic operations. Moreover, this confidential computing environment is isolated from the current operating environment of the processor, making the cryptographic operation process performed by the cryptographic module 20 in this confidential computing environment confidential and completely invisible to the outside. The outside can only see its input and output to the cryptographic operation system, thereby effectively ensuring the security of cryptographic operations.

[0073] The Confidential Environment Manager 22 manages confidential computing environments and has the authority to create or destroy confidential computing environments.

[0074] It should be noted that when the cryptographic computing system of this application creates a confidential computing environment isolated from the processor's current operating environment, the processor needs to provide hardware mechanism support. Existing processor hardware mechanisms are generally capable of supporting confidential computing environments, thus ensuring the confidentiality, integrity, and authenticity of cryptographic applications running in the confidential computing environment. The hardware mechanisms provided by the processor can include, for example, hardware security modules, memory protection, and secure boot. In an optional example, secure virtualization technology can be used to create the confidential computing environment through a virtual machine.

[0075] Based on the cryptographic operation system architecture described above, the confidential computing environment creation scheme of this application embodiment will be described in detail below.

[0076] Figure 4 An exemplary flowchart of an optional method for creating a confidential computing environment provided in an embodiment of this application is shown. The method flow can be... Figure 2 The cryptographic module, cryptographic module manager, and confidential environment manager in the illustrated cryptographic operation system are implemented. For example... Figure 4 As shown, the method flow may include the following steps.

[0077] Step S30: The password module manager obtains the image information of the password module.

[0078] The cryptographic module can be in a standby state, such as when the system is not powered on or when it is not invoked by a cryptographic application. Furthermore, the cryptographic module can have different types depending on its external interface, including standard interface types such as the "GM / T0018-2012 Cryptographic Device Application Interface Specification" and the "GM / T 0016-2012 Smart Cryptographic Key Cryptographic Application Interface Specification," as well as custom interface types.

[0079] When a cryptographic module needs to be started, the cryptographic module manager can obtain the module's image information. This module can be the one that the cryptographic application needs to call. The image information of the cryptographic module is a file copy containing the module's related program code. Different image information can exist depending on the purpose of the cryptographic module, and different image information can also be developed according to user needs. This image information can also be referred to as a program image.

[0080] In one example, the mirror information of a cryptographic module typically includes: an encryption algorithm program, such as symmetric encryption algorithms (e.g., AES, DES), asymmetric encryption algorithms (e.g., RSA, ECC), hash algorithms (e.g., MD5, SHA-256), etc., for the cryptographic module to perform operations such as encryption, decryption, signing, and verification; a key management program, for the cryptographic module to generate, store, and manage keys, where the keys can be symmetric or asymmetric keys, for encrypting and decrypting data; an authentication and authorization program, for the cryptographic module to authenticate users and control their access to system resources according to their permissions; secure communication protocols, such as SSL / TLS and IPsec, for the cryptographic module to protect the security and integrity of data during communication; and a secure storage program, for the cryptographic module to protect the storage of sensitive data.

[0081] It should be noted that the image information of the cryptographic module is stored on the hard disk. The cryptographic module manager can directly read the image information of the corresponding cryptographic module from the hard disk as needed, or read the image information from the hard disk through the processor. This application embodiment does not limit this and can be set accordingly according to actual needs.

[0082] Step S31: The cryptographic module manager determines the hardware resources required to run the cryptographic module based on the image information of the cryptographic module.

[0083] It is understandable that different cryptographic modules have different cryptographic operation performance. In the embodiments of this application, based on the cryptographic module-related program code contained in the image information of the cryptographic module, the performance of the cryptographic module can be determined, and thus the hardware resources required to run the cryptographic module can be determined. For example, the higher the performance of the cryptographic module, the more it can serve cryptographic applications on multiple different processor cores, thereby storing the data content of different cryptographic applications; or, the lower the performance of the cryptographic module, the more it can serve cryptographic applications on a single processor core, thereby storing the data content of the cryptographic application on that processor core, so that the hardware resources allocated to the cryptographic module are adapted to the performance requirements of the cryptographic module.

[0084] Step S32: The cryptographic module manager generates a confidential computing environment creation request based on the hardware resources required to run the cryptographic module.

[0085] The confidential computing environment creation request is used to request the creation of a confidential computing environment for the cryptographic module, so that the cryptographic module runs in the corresponding confidential computing environment and ensures the security of cryptographic operations.

[0086] Since the operation of a cryptographic module requires corresponding hardware resources, the cryptographic module manager can generate a confidential computing environment creation request based on the hardware resources required to run the cryptographic module, so that the confidential computing environment can meet the performance requirements of the cryptographic module.

[0087] Step S33: The cryptographic module manager sends the confidential computing environment creation request to the confidential environment manager.

[0088] When a cryptographic module manager creates a confidential computing environment using a confidential environment manager, and the cryptographic module performs cryptographic operations within this environment, the cryptographic module manager can send a confidential computing environment creation request to the confidential environment manager. This allows the confidential environment manager to create a confidential computing environment that matches the operational requirements of the cryptographic module based on the request. The operational requirements of the cryptographic module can be adapted to the hardware resources needed to run it, thus avoiding waste of hardware resources. This fully utilizes the cryptographic module's cryptographic computation capabilities within the created confidential computing environment, improving the overall performance of the electronic device.

[0089] Step S34: The confidential environment manager obtains the confidential computing environment creation request sent by the password module manager.

[0090] Step S35: The confidential environment manager creates a confidential computing environment that matches the operational requirements of the cryptographic module based on the confidential computing environment creation request.

[0091] The operational requirements of the cryptographic module are adapted to the hardware resources required to run the cryptographic module.

[0092] Understandably, when the confidential environment manager creates a confidential computing environment for a cryptographic module based on a confidential computing environment creation request generated by the cryptographic module manager according to the hardware resources required to run the cryptographic module, the confidential computing environment can meet the performance requirements of the cryptographic module. This allows the cryptographic operations that are appropriate for the performance of the cryptographic module to be performed in the confidential computing environment, thereby giving full play to the cryptographic operation capabilities of the cryptographic module and improving the overall performance of the electronic device.

[0093] As can be seen, in this embodiment, the cryptographic module manager determines the hardware resources required to run the cryptographic module based on the module's image information, and generates a confidential computing environment creation request. This allows the confidential computing environment manager to create a confidential computing environment that matches the cryptographic module's operational requirements, thus ensuring that the confidential computing environment meets the performance requirements of the cryptographic module. Furthermore, the confidential computing environment's matching of the cryptographic module's operational requirements with the hardware resources needed to run the cryptographic module prevents waste of hardware resources and improves the overall performance of the electronic device.

[0094] In some embodiments, where the image information of the cryptographic module contains related program code, the image information can be used to determine parameters such as the performance of the cryptographic module. Figure 5As shown, step S31 can specifically include the following steps:

[0095] Step S311: Based on the image information of the cryptographic module, determine the performance configuration file of the cryptographic module;

[0096] The performance configuration file of the cryptographic module refers to the operating parameters or configuration file of the cryptographic module set based on the system's operating requirements. The operating and usage strategies, memory usage strategies, etc. of the cryptographic module can be set based on the performance configuration file.

[0097] Step S312: Based on the performance configuration file, determine the number of processor cores and memory resources required to run the cryptographic module.

[0098] The performance profile contains the cryptographic module's operation and memory usage strategies, thus reflecting the cryptographic module's ability to perform cryptographic operations.

[0099] It is understandable that electronic devices also contain hardware devices such as memory and processors. Cryptographic applications on the processor can call cryptographic modules to perform cryptographic operations, thus requiring the caching of data for these operations. Furthermore, in processors with multiple cores, cryptographic applications can reside on one or more cores. Therefore, the number of processor cores and memory resources corresponding to a cryptographic module can be determined based on its performance profile. For example, for multiple processor cores, the cryptographic module can be flexibly allocated to multiple cores based on its performance, enabling it to perform cryptographic operations on multiple cores and improving the device's cryptographic efficiency. Regarding memory, memory resources can be rationally allocated to meet the performance requirements of the cryptographic module, avoiding insufficient or excessive memory allocation.

[0100] In some embodiments, based on the determined number of processor cores and memory resources required to run the cryptographic module, step S32, generating a confidential computing environment creation request based on the hardware resources required to run the cryptographic module, can specifically be: generating a confidential computing environment creation request based on the number of processor cores and memory resources required to run the cryptographic module.

[0101] Therefore, the confidential computing environment creation request obtained by the confidential environment manager can include the number of processor cores and memory resources required to run the cryptographic module. Consequently, when the confidential environment manager creates a confidential computing environment according to the confidential computing environment creation request, the confidential computing environment it creates can meet the performance requirements of the cryptographic module.

[0102] Furthermore, if the confidential computing environment creation request obtained by the confidential environment manager includes the number of processor cores and memory resources required to run the cryptographic module, such as... Figure 6As shown, step S35 may specifically include the following steps:

[0103] Step S351: Based on the number of processor cores, configure the corresponding number of processor cores to the confidential computing environment;

[0104] Step S352: Based on memory resources, configure the corresponding memory address to the confidential computing environment.

[0105] Continue to refer to Figure 4 As shown, in some embodiments, to enable the cryptographic modules managed by the cryptographic module manager to run in the confidential computing environment created by the confidential environment manager, after the confidential computing environment manager creates the confidential computing environment, the cryptographic module manager needs to send relevant information about the cryptographic modules to the confidential environment manager. This can further include:

[0106] Step S36: The cryptographic module manager sends the image information of the cryptographic module to the confidential environment manager.

[0107] By sending the image information of the cryptographic module to the confidential environment manager through the cryptographic module manager, the confidential environment manager can load the image information of the cryptographic module into the created confidential computing environment, so that the cryptographic module runs in the confidential computing environment.

[0108] Step S37: The confidential environment manager obtains the image information of the cryptographic module sent by the cryptographic module manager, and loads the image information of the cryptographic module into the confidential computing environment to run the cryptographic module in the confidential computing environment.

[0109] It should be noted that, in the confidential computing environment created based on the confidential computing environment creation method of this application embodiment, when the cryptographic module manager needs to destroy the cryptographic module, for example, by canceling the application of the cryptographic module in the system, the cryptographic module manager can send a confidential computing environment destruction request corresponding to the cryptographic module to the confidential environment manager, so that the confidential environment manager can destroy the confidential computing environment, thereby destroying the cryptographic module running in the confidential computing environment.

[0110] As can be seen, in this embodiment, the cryptographic module manager determines the hardware resources required to run the cryptographic module based on the module's image information, and generates a confidential computing environment creation request. This allows the confidential computing environment manager to create a confidential computing environment that matches the cryptographic module's operational requirements, thus ensuring that the confidential computing environment meets the performance requirements of the cryptographic module. Furthermore, the confidential computing environment's matching of the cryptographic module's operational requirements with the hardware resources needed to run the cryptographic module prevents waste of hardware resources and improves the overall performance of the electronic device.

[0111] Based on the confidential computing environment created by the above-described confidential computing environment creation method, this application embodiment also provides a cryptographic operation method, which can be applied to the confidential computing environment.

[0112] As an optional implementation Figure 7 An exemplary flowchart of an optional cryptographic operation method provided in an embodiment of this application is shown. This method can be implemented by a cryptographic module and a cryptographic application. Figure 7 As shown, the method flow may include the following steps.

[0113] Step S71: The cryptographic module obtains the key file and obtains the key for cryptographic operations based on the key file.

[0114] A key file is a file that stores the keys required to perform cryptographic operations. There is a correspondence between key files and cryptographic modules, and this correspondence is maintained by the cryptographic module manager. When a cryptographic module needs to be run, it can accurately obtain the key file based on the correspondence between cryptographic modules and key files maintained by the cryptographic module manager.

[0115] In an optional example, to ensure the integrity and security of the key file, the key file can be an encrypted file. To obtain the key used for cryptographic operations recorded in the key file, the cryptographic module can include a sealing key, which corresponds to the encryption key in the key file. Thus, the cryptographic module can use the sealing key to decrypt the key file and obtain the key for cryptographic operations. The key file of the cryptographic module can be stored on a hard disk, allowing the corresponding key file to be read directly from the hard disk as needed, or it can be read from the hard disk by a processor. This embodiment of the application does not impose limitations on this, and corresponding settings can be made according to actual needs.

[0116] It should be noted that the sealing key of the cryptographic module is bound to the program running the cryptographic module within the confidential computing environment (i.e., the mirror image information of the cryptographic module). The sealing key can only be obtained within the confidential computing environment and cannot be obtained or forged outside of it. Furthermore, the sealing key can be specifically bound to the integrity of the cryptographic module's running program. If the integrity of the cryptographic module's running program is compromised, its corresponding sealing key becomes unusable and cannot decrypt the key file. If the sealing key is usable and can decrypt the key file, it indicates that the mirror image information file of the cryptographic module is complete and has not been tampered with, thus ensuring the security of the key obtained by decrypting the key file using the sealing key.

[0117] Furthermore, when the sealing key is bound to a cryptographic module program running within a confidential computing environment, the sealing key can be obtained based on the image information loaded into the confidential computing environment. For example, the sealing key can be generated from the hash value of the cryptographic module's image information. Thus, when the image information of the cryptographic module changes, the sealing key associated with the cryptographic module changes accordingly. The method of generating the sealing key for the cryptographic module can be determined by the hardware characteristics of the processor supporting the confidential computing environment. Different processors have different generation methods, as long as it is bound to the characteristic value of the cryptographic module program running within the confidential computing environment supported by the processor.

[0118] In one example, the key file may contain user keys. When a user calls the cryptographic module to change the user key, the cryptographic module can use the sealing key to encrypt the changed user key and store it in the key file to update the user key stored in the key file and ensure the integrity of the key stored in the key file.

[0119] Step S72: The cryptographic application sends a verification request to the cryptographic module to verify the integrity of the cryptographic module.

[0120] When a cryptographic application needs to use a cryptographic module, in order to ensure the accuracy of cryptographic operations, the cryptographic application can first verify the authenticity of the confidential computing environment and the integrity of the cryptographic module to ensure the accuracy of the data within the cryptographic module, that is, that the data has not been missing or tampered with, and then send a verification request to the cryptographic module.

[0121] In a specific example, the cryptographic application can remotely authenticate the cryptographic module using a confidential computing-based remote authentication mechanism. The application sends a remote authentication request to the cryptographic module through the confidential computing environment. The cryptographic module receives the request and generates an authentication report using the hardware mechanism of the confidential computing environment provided by the processor. This report may include information such as the cryptographic module's mirror image measurement value, and is signed with a key that identifies the confidential computing environment. The cryptographic module then sends the signed authentication report to the cryptographic application through the confidential computing environment. After receiving the authentication report, the cryptographic application first verifies the signature of the confidential computing environment to confirm the report's authenticity, and then verifies information such as the cryptographic module's mirror image measurement value within the report to confirm the cryptographic module's integrity.

[0122] It should be noted that the above example is only an optional implementation of the password application to verify the integrity of the password module. Corresponding settings can be made according to requirements, and this application embodiment does not limit this.

[0123] If the cryptographic application verifies that the cryptographic module is complete, then step S73 can be executed, whereby the cryptographic application calls the cryptographic module to perform cryptographic operations.

[0124] In some embodiments, to provide efficient cryptographic computation capabilities, the cryptographic module can utilize a cryptographic computation module to assist in performing cryptographic computations. This cryptographic computation module can be a hardware module with cryptographic computation capabilities, capable of performing various standard-compliant cryptographic algorithms, such as encryption, decryption, signing, signature verification, MAC message verification code calculation, key generation, and key negotiation. Therefore, based on the auxiliary role of the cryptographic computation module, the cryptographic application calling the cryptographic module to perform cryptographic computations can specifically be as follows: the cryptographic application calls the cryptographic module, and the cryptographic module utilizes the cryptographic computation module to perform cryptographic computations.

[0125] As can be seen, the embodiments of this application can realize the cryptographic operation of the code module in a confidential computing environment, ensuring the security of the cryptographic operation. Furthermore, when the confidential computing environment matches the operating requirements of the cryptographic module, it can effectively meet the performance requirements of the cryptographic module, without wasting hardware resources, and improve the overall performance of the electronic device.

[0126] This application also provides a cryptographic operation system. Figure 8 An exemplary schematic diagram of another optional structure of the cryptographic operation system provided in this application embodiment is shown. For example... Figure 8 As shown, the cryptographic computing system may include at least a cryptographic module 81, a cryptographic application 82, a cryptographic module manager 83, and a confidential environment manager 84. The cryptographic module manager 83 and the confidential environment manager 84 can be used to create a confidential computing environment that matches the operational requirements of the cryptographic module 81.

[0127] The cryptographic module 81 is used to obtain a key file and obtain a key for cryptographic operations based on the key file in the confidential computing environment.

[0128] The cryptographic application 82 is used to send a verification request to the cryptographic module in the confidential computing environment to verify the integrity of the cryptographic module; wherein, if the cryptographic module is intact, the cryptographic application calls the cryptographic module to perform cryptographic operations.

[0129] Optionally, the cryptographic module 81 may include a sealing key;

[0130] The specific steps of the cryptographic module 81 in obtaining the key for cryptographic operations based on the key file are as follows: decrypting the cryptographic file using the sealing key to obtain the key for cryptographic operations.

[0131] Optionally, the cryptographic module 81 may utilize a cryptographic operation module to assist in performing cryptographic operations;

[0132] The step of the cryptographic application 82 calling the cryptographic module to perform cryptographic operations is as follows: the cryptographic application calls the cryptographic module, and the cryptographic module uses the cryptographic operation module to perform cryptographic operations.

[0133] It should be noted that the cryptographic module, cryptographic application, cryptographic module manager, and confidential environment manager are software functional modules required by the cryptographic computing system to implement the confidential computing environment creation method and / or cryptographic computing method provided in the embodiments of this application. The cryptographic computing system in the embodiments of this application may also include, Figure 8 The hardware components shown are processor 100, system memory 200, and hard disk 300.

[0134] The processor 100's hardware supports confidential computing features, allowing a confidential environment manager to create or destroy isolated runtime environments (i.e., confidential computing environments) as needed within the processor's current runtime environment. Furthermore, the processor 100's hardware mechanisms guarantee the confidentiality, integrity, and authenticity of programs running within this confidential computing environment. The processor 100 can be, for example, a CPU (Central Processing Unit).

[0135] System memory 200 is a physical device in a computer used to store data and programs, including running memory 210, which may be memory allocated based on a confidential computing environment. Therefore, processor 100 can perform confidentiality and integrity protection on the running memory 210 allocated to the confidential computing environment within system memory 200, ensuring that only programs running within the confidential computing environment can access the running memory 210 normally, and preventing unauthorized access to the running memory 210 by programs outside the confidential computing environment.

[0136] The hard disk 300 includes information such as a program image 310 of the cryptographic module and a key file 320. The program image 310 is a file copy containing the program code related to the cryptographic module, which can be referred to as the image information of the cryptographic module. Based on the program image 310, the sealing key of the cryptographic module can be obtained. For example, the sealing key is generated based on the hash value of the program image. Furthermore, when the program image changes, the sealing key associated with the cryptographic module also changes accordingly. Therefore, the sealing key can be bound to the program image. Thus, when the cryptographic module runs in a confidential computing environment, the sealing key can only be obtained within the confidential computing environment and cannot be obtained or forged outside of it. In a specific example, the sealing key can be bound to the integrity of the cryptographic module's running program. If the integrity of the cryptographic module's running program is compromised, its corresponding sealing key becomes unusable. Additionally, the method of generating the sealing key can be determined by the hardware characteristics of the processor supporting the confidential computing environment. Different processors have different generation methods, as long as they satisfy the requirement of binding to the characteristic value of the cryptographic module program running within the confidential computing environment supported by the processor. Key file 320 is a file storing the keys required by the cryptographic module to perform cryptographic operations, and it has a corresponding relationship with the cryptographic module. Furthermore, key file 320 is information that needs to be persistently stored; to ensure file security, key file 320 can be an encrypted file. In one example, based on the correspondence between key file 320 and cryptographic module 81, when generating the sealing key for the cryptographic module, the sealing key can be used to encrypt key file 320, thereby storing the encrypted key file 320 on hard disk 300. In a specific example, the sealing key can be bound to the integrity of the cryptographic module's running program. If the integrity of the cryptographic module's running program is compromised, its corresponding sealing key becomes unusable, and the key file cannot be decrypted; if the sealing key is available, it can be used to decrypt the key file.

[0137] In some embodiments, a confidential computing environment matching the operational requirements of the cryptographic module is created. Figure 9 An exemplary schematic diagram of an optional structure of a cryptographic module manager provided in an embodiment of this application is shown. For example... Figure 9 As shown, the password module manager may include: an information acquisition unit 91, a resource determination unit 92, a request generation unit 93, and a request sending unit 94.

[0138] The information acquisition unit 91 is used to acquire the image information of the cryptographic module;

[0139] The resource determination unit 92 is used to determine the hardware resources required to run the cryptographic module based on the image information of the cryptographic module.

[0140] The request generation unit 93 is used to generate a confidential computing environment creation request based on the hardware resources required to run the cryptographic module.

[0141] The request sending unit 94 is used to send the confidential computing environment creation request, so that the confidential environment manager creates a confidential computing environment that matches the operating requirements of the cryptographic module based on the confidential computing environment creation request, and the operating requirements of the cryptographic module are adapted to the hardware resources required to run the cryptographic module.

[0142] Optionally, the step of the resource determination unit 92 determining the hardware resources required to run the cryptographic module based on the image information of the cryptographic module includes:

[0143] Based on the image information of the cryptographic module, determine the performance configuration file of the cryptographic module;

[0144] Based on the performance profile, determine the number of processor cores and memory resources required to run the cryptographic module.

[0145] Optionally, the step of the request generation unit 93 generating a confidential computing environment creation request based on the hardware resources required to run the cryptographic module specifically involves generating a confidential computing environment creation request based on the number of processor cores and memory resources required to run the cryptographic module.

[0146] Optionally, after sending the confidential computing environment creation request, the request sending unit 94 is further configured to: send the image information of the cryptographic module, so that the confidential environment manager loads the image information of the cryptographic module in the created confidential computing environment, so that the cryptographic module runs in the confidential computing environment.

[0147] In some embodiments, a confidential computing environment matching the operational requirements of the cryptographic module is created. Figure 10 An exemplary schematic diagram of an optional structure of the confidential environment manager provided in an embodiment of this application is shown. For example... Figure 10 As shown, the confidential environment manager may include a request acquisition unit 101 and an environment creation unit 102.

[0148] The request acquisition unit 101 is used to acquire the confidential computing environment creation request sent by the cryptographic module manager.

[0149] The confidential computing environment creation request can be generated by the cryptographic module manager based on the hardware resources required to run the cryptographic module. The hardware resources required to run the cryptographic module can be determined by the cryptographic module manager based on the image information of the acquired cryptographic module.

[0150] Environment creation unit 102 is used to create a confidential computing environment that matches the operation requirements of the cryptographic module based on the confidential computing environment creation request.

[0151] The operational requirements of the cryptographic module can be adapted to the hardware resources required to run the cryptographic module.

[0152] Optionally, the confidential computing environment creation request acquired by the request acquisition unit 101 may include the number of processor cores and memory resources required to run the cryptographic module.

[0153] Optionally, the step of the environment creation unit 102 creating a confidential computing environment matching the operational requirements of the cryptographic module based on the confidential computing environment creation request may include:

[0154] Based on the number of processor cores, the corresponding number of processor cores are configured into the confidential computing environment;

[0155] Based on the memory resources, the corresponding memory addresses are configured to the confidential computing environment.

[0156] Optionally, after the environment creation unit 102 creates a confidential computing environment that matches the operating requirements of the cryptographic module, it can also be used to: obtain the image information of the cryptographic module and load the image information of the cryptographic module into the confidential computing environment to run the cryptographic module in the confidential computing environment.

[0157] In some embodiments, Figure 11 An exemplary schematic diagram illustrates another optional architecture of the cryptographic operation system provided in this application embodiment. For example... Figure 11 As shown, the cryptographic operation system may further include: a cryptographic operation module 111.

[0158] The cryptographic operation module 111 is a module with cryptographic operation functions. Based on the cryptographic operation requirements of the cryptographic module, in an optional implementation, the cryptographic operation module 111 can be a functional module integrated inside the cryptographic module for performing cryptographic operations, that is, the cryptographic operation unit of the cryptographic module.

[0159] In another optional implementation, the cryptographic operation module 111 can be a hardware module with cryptographic operation capabilities integrated within the processor 100. It can perform various standard-compliant cryptographic algorithms, such as encryption, decryption, signing, signature verification, MAC message verification code calculation, key generation, and key negotiation, to assist the cryptographic modules managed by the cryptographic module manager in performing cryptographic operations. The cryptographic operation module can securely provide cryptographic operation capabilities to the cryptographic modules. For example, based on the processor's hardware support, the cryptographic operation module can be configured to only receive cryptographic operation requests from a specific confidential computing environment. Thus, cryptographic operation requests from cryptographic modules within that confidential computing environment will carry a tag identifying that confidential computing environment. When the cryptographic operation module receives a cryptographic operation request, it will first identify the tag of the confidential computing environment to ensure secure information exchange, thereby improving the cryptographic operation performance of the electronic device.

[0160] In an alternative example, when the cryptographic system has multiple modules with cryptographic computation functions, the cryptographic module can be selected according to requirements. For example, the cryptographic module in the cryptographic system has a built-in cryptographic computation unit, and the processor has built-in hardware for the cryptographic computation module. When the cryptographic application has high-performance computation requirements for the cryptographic module, the cryptographic module can choose to use the cryptographic computation module integrated within the processor (such as...). Figure 11 (As shown).

[0161] It should be noted that the key management unit, located within the cryptographic module, can manage the entire lifecycle of keys, including key generation, storage, use, update, and destruction. The cryptographic operation unit can implement various standard cryptographic algorithms, including encryption, decryption, signing, signature verification, MAC message verification code calculation, key generation, and key negotiation. Therefore, when the cryptographic operation module located within the processor can perform various standard cryptographic algorithms, such as encryption, decryption, signing, signature verification, MAC message verification code calculation, key generation, and key negotiation, the key management unit within the cryptographic module can choose whether to utilize the cryptographic operation module located within the processor for cryptographic operations based on the cryptographic module's own computational needs.

[0162] This application also provides an electronic device, which may include at least one memory and at least one processor. The memory stores one or more computer-executable instructions, and the processor invokes the one or more computer-executable instructions to execute the confidential computing environment creation method provided in this application, and / or the cryptographic operation method provided in this application.

[0163] As an optional implementation Figure 12 Optional block diagrams of the electronic device provided in the embodiments of this application, such as Figure 12As shown, the electronic device may include: at least one processor 1, at least one communication interface 2, at least one memory 3, and at least one communication bus 4.

[0164] In this embodiment of the application, the number of processor 1, communication interface 2, memory 3 and communication bus 4 is at least one, and processor 1, communication interface 2 and memory 3 communicate with each other through communication bus 4.

[0165] Optionally, communication interface 2 can be an interface for a communication module used for network communication.

[0166] Optionally, processor 1 may be a CPU (Central Processing Unit), GPU (Graphics Processing Unit), NPU (Embedded Neural Network Processor), FPGA (Field Programmable Gate Array), TPU (Tensor Processing Unit), AI chip, ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of this application.

[0167] Memory 3 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk drive.

[0168] The memory 3 stores one or more computer-executable instructions, and the processor 1 calls the one or more computer-executable instructions to execute the cryptographic operation method of this application embodiment.

[0169] This application also provides a storage medium that stores one or more computer-executable instructions. When the one or more computer-executable instructions are executed, they implement the confidential computing environment creation method and / or cryptographic operation method executed by an electronic device as described in this application.

[0170] The foregoing describes multiple embodiment schemes provided by the embodiments of this application. The optional methods described in each embodiment scheme can be combined and cross-referenced with each other without conflict, thereby extending to a variety of possible embodiment schemes. These can all be considered as the embodiment schemes disclosed and published by the embodiments of this application.

[0171] While the embodiments disclosed above are described in this application, this application is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of this application; therefore, the scope of protection of this application should be determined by the scope defined in the claims.

Claims

1. A method for creating a confidential computing environment, characterized in that, Applied to the password module manager, including: Obtain the image information of the cryptographic module, wherein the image information of the cryptographic module is a file copy containing the program code related to the cryptographic module, and the cryptographic module is a module with cryptographic operation function; Based on the image information of the cryptographic module, determine the hardware resources required to run the cryptographic module, including: based on the image information of the cryptographic module, determine the performance configuration file of the cryptographic module, wherein the performance configuration file of the cryptographic module refers to the operating parameters or configuration file of the cryptographic module set based on system operating requirements; and based on the performance configuration file, determine the number of processor cores and memory resources required to run the cryptographic module. Based on the hardware resources required to run the cryptographic module, a confidential computing environment creation request is generated, specifically: based on the number of processor cores and memory resources required to run the cryptographic module, a confidential computing environment creation request is generated; A confidential computing environment creation request is sent, causing the confidential environment manager to create a confidential computing environment that matches the operational requirements of the cryptographic module based on the request. This confidential computing environment is isolated from the processor's current operating environment. The cryptographic module runs within this environment, and the cryptographic operations performed by the module within it are confidential. The cryptographic module includes a sealing key, which changes when the module's image information changes. This sealing key is bound to the program running the module within the confidential computing environment and can only be obtained within that environment. The module uses the sealing key to decrypt a key file to obtain the key for cryptographic operations. The operational requirements of the cryptographic module are compatible with the hardware resources required to run it.

2. The method for creating a confidential computing environment according to claim 1, characterized in that, After sending the confidential computing environment creation request, the process also includes: The image information of the cryptographic module is sent so that the confidential environment manager loads the image information of the cryptographic module into the created confidential computing environment, so that the cryptographic module runs in the confidential computing environment.

3. A method for creating a confidential computing environment, characterized in that, Applied to the Confidential Environment Manager, including: The system obtains a confidential computing environment creation request sent by the cryptographic module manager. This request includes the number of processor cores and memory resources required to run the cryptographic module. The confidential computing environment creation request is generated by the cryptographic module manager based on the hardware resources required to run the cryptographic module. The hardware resources required to run the cryptographic module are determined by the cryptographic module manager based on the obtained image information of the cryptographic module. The image information of the cryptographic module is a file copy containing the relevant program code of the cryptographic module. The cryptographic module is a module with cryptographic operation functions. Based on the confidential computing environment creation request, a confidential computing environment matching the operational requirements of the cryptographic module is created. This confidential computing environment is isolated from the processor's current operating environment. The cryptographic module runs within this environment, and the cryptographic operations performed by the module within it are confidential. The cryptographic module includes a sealing key. When the module's image information changes, the sealing key also changes. The sealing key is bound to the program running the module within the confidential computing environment. The sealing key can only be obtained within the confidential computing environment. The cryptographic module uses the sealing key to decrypt the key file to obtain the key for cryptographic operations. The operational requirements of the cryptographic module are compatible with the hardware resources required to run it.

4. The method for creating a confidential computing environment according to claim 3, characterized in that, The step of creating a confidential computing environment that matches the operational requirements of the cryptographic module based on the confidential computing environment creation request includes: Based on the number of processor cores, the corresponding number of processor cores are configured into the confidential computing environment; Based on the memory resources, the corresponding memory addresses are configured to the confidential computing environment.

5. The method for creating a confidential computing environment according to claim 3, characterized in that, After creating the confidential computing environment that matches the operational requirements of the cryptographic module, the process further includes: Obtain the image information of the cryptographic module sent by the cryptographic module manager, and load the image information of the cryptographic module into the confidential computing environment to run the cryptographic module in the confidential computing environment.

6. A cryptographic operation method, characterized in that, Applied to a confidential computing environment created by the confidential computing environment creation method as described in any one of claims 1-2 and / or any one of claims 3-5, the method comprising: The cryptographic module obtains the key file and derives the key for cryptographic operations based on the key file; The cryptographic application sends a verification request to the cryptographic module to verify the integrity of the cryptographic module; If the cryptographic module is complete, the cryptographic application calls the cryptographic module to perform cryptographic operations; the cryptographic module includes a sealing key; the cryptographic module obtains the key for cryptographic operations based on the key file specifically by using the sealing key to decrypt the key file and obtain the key for cryptographic operations.

7. The cryptographic operation method according to claim 6, characterized in that, The cryptographic module utilizes the cryptographic operation module to assist in performing cryptographic operations; The cryptographic application calls the cryptographic module to perform cryptographic operations, specifically: the cryptographic application calls the cryptographic module, and the cryptographic module uses the cryptographic operation module to perform cryptographic operations.

8. A cryptographic operation system, characterized in that, It includes a cryptographic module, a cryptographic application, a cryptographic module manager, and a confidential environment manager. The cryptographic module manager and the confidential environment manager are used to create a confidential computing environment that matches the running requirements of the cryptographic module. The confidential computing environment is isolated from the current running environment of the processor. The cryptographic module runs in the confidential computing environment. The cryptographic module is a module with cryptographic operation functions. The cryptographic module is used to obtain a key file and obtain a key for cryptographic operations based on the key file in the confidential computing environment. The cryptographic module includes a sealing key. When the mirror information of the cryptographic module changes, the sealing key of the cryptographic module will also change. The sealing key of the cryptographic module is bound to the program running the cryptographic module in the confidential computing environment. The sealing key of the cryptographic module can only be obtained in the confidential computing environment. The cryptographic module uses the sealing key to decrypt the key file and obtain the key for cryptographic operations. The cryptographic application is used to send a verification request to the cryptographic module in the confidential computing environment to verify the integrity of the cryptographic module; wherein, if the cryptographic module is intact, the cryptographic application calls the cryptographic module to perform cryptographic operations; the cryptographic operations performed by the cryptographic module in the confidential computing environment are confidential; The password module manager includes: The information acquisition unit is used to acquire the image information of the cryptographic module; The resource determination unit is used to determine the hardware resources required to run the cryptographic module based on the image information of the cryptographic module. The request generation unit is used to generate a confidential computing environment creation request based on the hardware resources required to run the cryptographic module; The request sending unit is used to send the confidential computing environment creation request, so that the confidential environment manager can create a confidential computing environment that matches the operation requirements of the cryptographic module based on the confidential computing environment creation request, wherein the operation requirements of the cryptographic module are adapted to the hardware resources required to run the cryptographic module.

9. The cryptographic operation system according to claim 8, characterized in that, The confidential environment manager includes: The request retrieval unit is used to retrieve the confidential computing environment creation request sent by the cryptographic module manager; The environment creation unit is used to create a confidential computing environment that matches the operational requirements of the cryptographic module based on the confidential computing environment creation request.

10. The cryptographic operation system according to claim 8, characterized in that, Also includes: A cryptographic operation module is used to assist the cryptographic module in performing cryptographic operations in the confidential computing environment.

11. An electronic device, characterized in that, It includes at least one memory and at least one processor, the memory storing one or more computer-executable instructions, the processor invoking the one or more computer-executable instructions to execute the confidential computing environment creation method as described in any one of claims 1-2 and / or claims 3-5, and / or, the cryptographic operation method as described in any one of claims 6-7.

12. A storage medium, characterized in that, The storage medium stores one or more computer-executable instructions, which, when executed, implement the confidential computing environment creation method as described in any one of claims 1-2 and / or claims 3-5, and / or the cryptographic operation method as described in any one of claims 6-7.

Images