A multi-tenant isolation system and method based on cryptographic chip deployment

Abstract

The present invention discloses a multi-tenant isolation system and method based on password chip deployment, including a tenant application server and a password server, which are interconnected through a network; a plurality of tenant application virtual machines are run on the tenant application server, and each tenant application virtual machine is configured with a unique Vlan ID; a password card is provided on the password server, and a pre-built password chip allocation table and a plurality of password chips are provided on the password card, and each password chip has independent password storage resources and computing resources; the password chip allocation table is used to store the unique binding relationship between the Vlan ID and the password chip, and the password card allocates the calling authority of the corresponding password chip to the tenant application virtual machine that sends an encryption request according to the password chip allocation table. The present invention realizes the complete isolation of each tenant's password resources from the chip level, and improves the security of the tenant's password application.

Description

Technical Field

[0001] The present invention relates to the field of information security technology of cryptographic device clusters, and in particular to a multi-tenant isolation system and method based on cryptographic chip deployment. Background Art

[0002] Cryptographic computing resources are the cornerstone of network security and data security. How to achieve isolation of cryptographic resources in multi-tenant scenarios is crucial to protecting the security and isolation of each tenant's cryptographic computing resources.

[0003] Existing cryptographic computing resource isolation methods for multi-tenant scenarios include:

[0004] Method for implementing resource isolation through password card virtualization: Use software or hardware to logically divide password storage resources to implement resource isolation, and limit the calling frequency of each virtual password card to implement computing power isolation. Although this method logically divides the password card, it is not true physical isolation. This means that on the underlying hardware, all virtual password cards still share the same physical resources. Once the underlying hardware has a vulnerability or is attacked, all virtual password cards may be affected, which is not true isolation.

[0005] Centralized multi-tenant cryptographic service method: By deploying a centralized cryptographic service, the cryptographic service is backed by a cryptographic machine cluster and provides cryptographic services to the outside world in a unified manner. The advantages of this method are flexible control and support for high availability. The disadvantage is that cryptographic storage resources and computing power are highly shared. Once a part fails or is attacked, the security and stability of the entire system will be affected.

[0006] Therefore, how to provide a multi-tenant isolation system and method that can fundamentally achieve strict isolation of each tenant's password resources and effectively improve the security of tenant password applications is a technical problem that needs to be urgently solved by technical personnel in this field. Summary of the invention

[0007] In view of the above research status and existing problems, the present invention provides a multi-tenant isolation system and method based on cryptographic chip deployment, which realizes complete isolation of each tenant's cryptographic resources at the chip level and improves the security of tenant cryptographic applications.

[0008] The present invention provides a multi-tenant isolation system based on cryptographic chip deployment, comprising a tenant application server and a cryptographic server, wherein the tenant application server and the cryptographic server are interconnected via a network;

[0009] A plurality of tenant application virtual machines are running on the tenant application server, and each tenant application virtual machine is configured with a unique Vlan ID;

[0010] The password server is provided with a password card, on which a pre-built password chip allocation table and multiple password chips are provided, each of which has independent password storage resources and computing resources; the password chip allocation table is used to store the unique binding relationship between the Vlan ID and the password chip, and the password card allocates the calling authority of the corresponding password chip to the tenant application virtual machine that sends the encryption request according to the password chip allocation table.

[0011] Preferably, a physical network card and a network card configuration tool are installed on the tenant application server:

[0012] The physical network card is interconnected with the password card of the password server through the network; the tenant application virtual machine creates a logical interface of the VLAN subnet card based on the physical network card, and the tenant application virtual machine sequentially builds an interconnection channel with the password card through the VLAN subnet card and the physical network card;

[0013] The network card configuration tool is connected to the physical network card through a PCI bus and is used to configure the Vlan ID of the Vlan subnet card in the tenant application virtual machine.

[0014] Preferably, a password card configuration tool is installed on the password server:

[0015] The password card configuration tool is connected to the password card via a PCI bus and is used to modify and update the password chip allocation table and allocate the password chip to the tenant.

[0016] Preferably, the password card includes a master control module, a network chip and a PCI bus chip; wherein,

[0017] The PCI bus chip is used to receive the configuration instructions of the password card configuration tool transmitted through the PCI bus, and pass them to the master control module;

[0018] The network chip is connected to the password card, and is used to receive an encryption request transmitted through the network and transmit it to the master control module, wherein the encryption request is endowed with the Vlan ID of the tenant application virtual machine;

[0019] The master control module is connected to the PCI bus chip and the network chip, and is used to update the password chip allocation table according to the configuration instruction to complete the configuration of the password chip allocation table; and read the encryption request from the network chip to identify and parse the Vlan ID, query the password chip corresponding to the Vlan ID according to the password chip allocation table, and send the encryption request to the password chip corresponding to the Vlan ID.

[0020] Preferably, the multiple cryptographic chips are connected to the master control module via a cryptographic chip bus.

[0021] Preferably, the network is a designated encrypted network.

[0022] The present invention provides a multi-tenant isolation method based on cryptographic chip deployment, which is applied to a tenant application server, wherein the tenant application server and the cryptographic server are interconnected through a network; a plurality of tenant application virtual machines are running on the tenant application server; a cryptographic card is provided on the cryptographic server, and a pre-built cryptographic chip allocation table and a plurality of cryptographic chips are provided on the cryptographic card, and each of the cryptographic chips has independent cryptographic storage resources and computing resources;

[0023] Receive the Vlan ID configuration instruction of the tenant application virtual machine, configure the Vlan ID of the Vlan subnet card of the tenant application virtual machine and save it, so as to facilitate the pre-construction of a password chip allocation table for the password card, the password chip allocation table is used to store the unique binding relationship between the Vlan ID and the password chip, and each of the password chips has independent password storage resources and computing resources;

[0024] Receive the IP address configuration instruction of the tenant application virtual machine, and configure the IP address of the configuration file in the tenant application virtual machine to point to the network port IP of the password card, so that the tenant application virtual machine can call the corresponding password chip in the password card.

[0025] The present invention provides a multi-tenant isolation method based on password chip deployment, which is applied to a password server, wherein the password server and a tenant application server are interconnected through a network; a password card is provided on the password server, and a pre-built password chip allocation table and a plurality of password chips are provided on the password card, and each of the password chips has independent password storage resources and computing resources; a plurality of tenant application virtual machines are run on the tenant application server, and each of the tenant application virtual machines is configured with a unique Vlan ID;

[0026] Receive the Vlan ID of the tenant application virtual machine;

[0027] A password chip allocation table modification instruction is received, a password chip is allocated to the Vlan ID, a unique binding relationship between the Vlan ID and the password chip is established, and the unique binding relationship is stored in the password chip allocation table.

[0028] The present invention provides a multi-tenant isolation method according to the multi-tenant isolation system based on cryptographic chip deployment, which is applied to a tenant application server and includes the following steps:

[0029] Generate an encryption request based on the data to be encrypted of the tenant application virtual machine;

[0030] The encryption request is sent to the password card through the network, and the Vlan ID of the tenant application virtual machine is automatically assigned to the encryption request when sending it, so that the password card can identify and parse the Vlan ID, query the password chip corresponding to the Vlan ID according to the password chip allocation table, and send the data to be encrypted to the password chip to perform encryption operations.

[0031] Preferably, the method further comprises the following steps:

[0032] Call the password card operation API interface library;

[0033] The password card operation API interface calls the password card device driver;

[0034] The password card device driver calls the corresponding password chip on the password server through the network.

[0035] The present invention provides a multi-tenant isolation method according to the multi-tenant isolation system based on cryptographic chip deployment, which is applied to a cryptographic server and includes the following steps:

[0036] Receiving an encryption request generated based on the data to be encrypted and sent by the tenant application virtual machine, wherein the encryption request is assigned with the Vlan ID of the tenant application virtual machine;

[0037] Identify and parse the Vlan ID, query the cryptographic chip corresponding to the Vlan ID according to the cryptographic chip allocation table, and send the data to be encrypted to the cryptographic chip to perform encryption operation;

[0038] After completing the encryption operation, the cryptographic chip returns the operation result to the tenant application virtual machine through the network.

[0039] Compared with the prior art, it has the following beneficial effects:

[0040] The present invention solves the problem of insufficient resource sharing and security isolation in traditional virtualized and centralized multi-tenant cryptographic services by strictly isolating cryptographic computing resources at the hardware level. In a multi-tenant scenario, each tenant has exclusive access to the cryptographic storage resources and computing power resources of a cryptographic chip, which improves the security, independence and availability of tenant cryptographic applications and avoids performance bottlenecks and security risks caused by resource sharing.

[0041] The present invention can automatically configure the VLAN subnet card and the password chip allocation table through the configuration tool, can centrally manage and configure the password chip resources, simplify the management process, realize on-demand allocation, reduce manual intervention, and improve management efficiency;

[0042] The tenant application server of the present invention is interconnected with the password server through a dedicated network, which improves the security of data transmission. The data transmission process does not flow through the operating system network stack of the password server, which reduces the attack surface and further improves security.

[0043] The present invention supports a multi-tenant environment, is applicable to a cloud environment, can flexibly and dynamically allocate independent cryptographic chip resources to each tenant, and supports elastic expansion. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work.

[0045] Figure 1 A schematic diagram of a multi-tenant isolation system based on cryptographic chip deployment provided in Example 1 of the present invention;

[0046] Figure 2 A flowchart of tenant application server configuration of a multi-tenant isolation method based on cryptographic chip deployment provided in Example 2 of the present invention;

[0047] Figure 3 A flowchart of a cryptographic server configuration of a multi-tenant isolation method based on cryptographic chip deployment provided in Example 3 of the present invention;

[0048] Figure 4 A flowchart of sending encrypted requests by tenant application servers of a multi-tenant isolation method based on cryptographic chip deployment provided in Embodiment 4 of the present invention;

[0049] Figure 5 A cryptographic chip encryption flow chart of a cryptographic chip server allocation in a multi-tenant isolation method based on cryptographic chip deployment provided in Example 5 of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] The present invention discloses a multi-tenant isolation system and method based on cryptographic chip deployment, which can fundamentally realize the strict isolation of cryptographic resources of each tenant and effectively improve the security of tenant cryptographic applications. The present invention includes the configuration process of the cryptographic chip and the process of the tenant application calling the corresponding cryptographic chip resources.

[0052] Example 1

[0053] Figure 1 This is a structural principle diagram of a multi-tenant isolation system deployed based on a cryptographic chip according to Example 1 of the present invention.

[0054] A multi-tenant isolation system based on cryptographic chip deployment includes a tenant application server and a cryptographic server, which are interconnected through a network; a plurality of tenant application virtual machines are run on the tenant application server, and each tenant application virtual machine is configured with a unique Vlan ID; a cryptographic card is provided on the cryptographic server, and a pre-built cryptographic chip allocation table and a plurality of cryptographic chips are provided on the cryptographic card, and each cryptographic chip has independent cryptographic storage resources and computing resources; the cryptographic chip allocation table is used to store a unique binding relationship between a Vlan ID and a cryptographic chip, and the cryptographic card allocates the calling authority of the corresponding cryptographic chip to the tenant application virtual machine that sends an encryption request according to the cryptographic chip allocation table.

[0055] It should be noted that the cryptographic chip is a separate integrated circuit (IC), which contains a dedicated hardware accelerator for cryptographic operations, a storage unit (such as SRAM, Flash), a random number generator (RNG), a key storage area, etc. The cryptographic chip is connected to the master control module inside the cryptographic card through an internal bus (such as SPI, I2C).

[0056] The password card is a plug-in device that contains multiple password chips and other auxiliary components (such as master control module, interface circuit, etc.). The password card is connected to the password server motherboard through a standard peripheral interface (such as PCI, PCIe).

[0057] In this embodiment, a physical network card and a network card configuration tool are installed on the tenant application server: the physical network card is interconnected with the password card of the password server through the network; the tenant application virtual machine creates a logical interface of the VLAN subnet card based on the physical network card, and the tenant application virtual machine builds an interconnection channel with the password card through the VLAN subnet card and the physical network card in turn; the network card configuration tool is connected to the physical network card through the PCI bus, and is used to configure the VLANID of the VLAN subnet card in the tenant application virtual machine.

[0058] Both the physical network card and the password card have network ports for accessing the network, and the two are interconnected through the network ports.

[0059] In this embodiment, multiple tenant application virtual machines can be built on a tenant application server, and each tenant application virtual machine includes an operating system layer and an application layer. In the operating system layer, the Vlan subnet card is configured by software, and the network-based password card device driver is installed. The tenant application is loaded in the application layer, and the password card operation API interface library is installed.

[0060] The API interface library encapsulates different cryptographic operation service interfaces according to the cryptographic industry specifications, such as RSA public key operation, RSA private key operation, symmetric encryption, symmetric decryption, national secret SM2 signature, national secret SM2 signature verification, etc., to facilitate upper-level service calls. Tenant applications request cryptographic operation services by calling the cryptographic operation services in the API interface library.

[0061] The API interface library controls the cryptographic card device by calling the device driver. The API interface library converts the encryption request into a format that the device driver can understand and calls the device driver.

[0062] The device driver is responsible for converting the API interface library's requests into specific hardware instructions.

[0063] The device driver communicates with the cryptographic card device through the PCI bus, and the device driver passes the encryption request (including Vlan ID, algorithm type, key and data to be encrypted) to the cryptographic card through the PCI bus.

[0064] In this embodiment, a password card configuration tool is installed on the password server: wherein the password card configuration tool is connected to the password card through the PCI bus, and is used to modify and update the password chip allocation table and allocate password chips to tenants.

[0065] In this embodiment, the password card includes a master control module, a network chip and a PCI bus chip; wherein the PCI bus chip is used to receive the configuration instructions of the password card configuration tool transmitted through the PCI bus, and pass them to the master control module; the network chip is connected to the password card, and is used to receive the encryption request transmitted through the network, and pass it to the master control module, and the encryption request is assigned with the Vlan ID of the tenant application virtual machine; the master control module is connected to the PCI bus chip and the network chip, and is used to update the password chip allocation table according to the configuration instructions and complete the configuration of the password chip allocation table; and read the encryption request from the network chip to identify and parse the VlanID, query the password chip corresponding to the Vlan ID according to the password chip allocation table, and send the encryption request to the password chip corresponding to the Vlan ID.

[0066] In this embodiment, a plurality of cryptographic chips are connected to the master control module via a cryptographic chip bus.

[0067] In this embodiment, the network is a designated encrypted network.

[0068] Example 2

[0069] Figure 2 This is a tenant application server configuration flow chart of a multi-tenant isolation method based on cryptographic chip deployment according to embodiment 2 of the present invention, which is executed on the tenant application server provided in embodiment 1. It includes the following technical solutions:

[0070] S11: Receive the Vlan ID configuration instruction of the tenant application virtual machine, configure the Vlan ID of the Vlan subnet card of the tenant application virtual machine and save it, so as to facilitate the pre-construction of the password chip allocation table for the password card. The password chip allocation table is used to store the unique binding relationship between the VlanID and the password chip. Each password chip has independent password storage resources and computing resources; Figure 1 The VLAN IDs of the two virtual machines are configured as 100 and 200 respectively.

[0071] S12: Receive the IP address configuration instruction of the tenant application virtual machine, and configure the IP address of the configuration file in the tenant application virtual machine to point to the network port IP of the password card, so that the tenant application virtual machine can call the corresponding password chip in the password card.

[0072] This embodiment also includes the step of installing a network-based cryptographic card device driver in the tenant application virtual machine.

[0073] Example 3

[0074] Figure 3 This is a cryptographic server configuration flow chart of a multi-tenant isolation method based on cryptographic chip deployment according to Embodiment 3 of the present invention, which is executed on the cryptographic server provided in Embodiment 1. It includes the following technical solutions:

[0075] S21: Receive the Vlan ID of the tenant application virtual machine;

[0076] S22: receiving a password chip allocation table modification instruction, allocating a password chip to a Vlan ID, establishing a unique binding relationship between the Vlan ID and the password chip, and storing the relationship in the password chip allocation table.

[0077] like Figure 1 As shown, the tenant with Vlan ID 100 corresponds to password chip 01, the tenant with Vlan ID 200 corresponds to password chip 02, and password chip 03 and password chip 04 are currently idle. The configuration instructions of the password card configuration tool pass through the PCI bus, PCI bus chip, and reach the main control module in sequence. After receiving the instructions, the main control module updates the password chip allocation table to complete the configuration of the password chip allocation table.

[0078] Example 4

[0079] Figure 4This is a flowchart of sending encrypted requests by tenant application servers of a multi-tenant isolation method based on cryptographic chip deployment according to Embodiment 4 of the present invention, which is executed on the cryptographic server provided in Embodiment 1. It includes the following technical solutions:

[0080] S31: Generate an encryption request based on the data to be encrypted of the tenant application virtual machine;

[0081] S32: Send the encryption request to the password card through the network, and automatically assign the Vlan ID of the tenant application virtual machine to the encryption request when sending it, so that the password card can identify and parse the Vlan ID, and query the password chip corresponding to the Vlan ID according to the password chip allocation table, such as Figure 1 As shown, the encryption request sent by tenant 1 is added with the Vlan ID of 100, and the encryption request sent by tenant 2 is added with the Vlan ID of 200; and the data to be encrypted is sent to the cryptographic chip to perform encryption operation.

[0082] In this embodiment, generating an encryption request further includes the following steps:

[0083] Use tenant applications to call the password card operation API interface library;

[0084] The password card operation API interface calls the password card device driver;

[0085] The password card device driver calls the corresponding password chip on the password server through the network.

[0086] Example 5

[0087] Figure 5 This is a cryptographic chip encryption flow chart of a cryptographic chip server allocation in a multi-tenant isolation method based on cryptographic chip deployment according to Embodiment 5 of the present invention, which is executed on the cryptographic server provided in Embodiment 1. It includes the following technical solutions:

[0088] S41: receiving an encryption request generated based on the data to be encrypted and sent by the tenant application virtual machine, where the encryption request is assigned with the Vlan ID of the tenant application virtual machine;

[0089] S42: Identify and parse the Vlan ID, query the cryptographic chip corresponding to the Vlan ID according to the cryptographic chip allocation table, and send the data to be encrypted to the cryptographic chip for encryption operation;

[0090] S43: After completing the encryption operation, the cryptographic chip returns the operation result to the tenant application of the tenant application virtual machine through the original path of the network.

[0091] In this embodiment, the data in the encryption request reaches the network port of the password card of the password server through a dedicated encryption network. After receiving the data, the network chip notifies the master control module to receive it. The master control module reads the data from the network chip and parses the VlanID, queries the password chip allocation table, queries the password chip corresponding to the Vlan ID, and sends the data to the password chip with the specified ID through the password chip bus.

[0092] The above is a detailed introduction to a multi-tenant isolation system and method based on cryptographic chip deployment provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0093] In this article, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Claims

1. A multi-tenant isolation system based on cryptographic chip deployment, characterized in that: It includes a tenant application server and a password server, wherein the tenant application server and the password server are interconnected via a network; A plurality of tenant application virtual machines are running on the tenant application server, and each tenant application virtual machine is configured with a unique Vlan ID; The password server is provided with a password card, on which a pre-built password chip allocation table and a plurality of password chips are provided, each of which has independent password storage resources and computing resources; the password chip allocation table is used to store the unique binding relationship between the Vlan ID and the password chip, and the password card allocates the calling authority of the corresponding password chip to the tenant application virtual machine that sends the encryption request according to the password chip allocation table; A password card configuration tool is installed on the password server; the password card configuration tool is connected to the password card through a PCI bus and is used to modify and update the password chip allocation table and allocate the password chip to the tenant; The password card includes a master control module, a network chip and a PCI bus chip; the PCI bus chip is used to receive the configuration instructions of the password card configuration tool transmitted through the PCI bus and pass them to the master control module; The network chip is connected to the password card, and is used to receive an encryption request transmitted through the network and transmit it to the master control module, wherein the encryption request is endowed with the Vlan ID of the tenant application virtual machine; The master control module is connected to the PCI bus chip and the network chip, and is used to update the password chip allocation table according to the configuration instruction to complete the configuration of the password chip allocation table; and read the encryption request from the network chip to identify and parse the Vlan ID, query the password chip corresponding to the Vlan ID according to the password chip allocation table, and send the encryption request to the password chip corresponding to the Vlan ID.

2. According to a multi-tenant isolation system based on cryptographic chip deployment according to claim 1, it is characterized in that: The tenant application server is installed with a physical network card and a network card configuration tool: The physical network card is interconnected with the password card of the password server through the network; the tenant application virtual machine creates a logical interface of the VLAN subnet card based on the physical network card, and the tenant application virtual machine sequentially builds an interconnection channel with the password card through the VLAN subnet card and the physical network card; The network card configuration tool is connected to the physical network card through a PCI bus and is used to configure the Vlan ID of the Vlan subnet card in the tenant application virtual machine.

3. According to a multi-tenant isolation system based on cryptographic chip deployment according to claim 1, it is characterized in that: The plurality of cryptographic chips are connected to the master control module via a cryptographic chip bus.

4. A multi-tenant isolation method based on cryptographic chip deployment, characterized in that: Applied to a tenant application server, the tenant application server and the password server are interconnected through a network; a number of tenant application virtual machines are running on the tenant application server; a password card is provided on the password server, and a pre-built password chip allocation table and a plurality of password chips are provided on the password card, and each of the password chips has independent password storage resources and computing resources; a password card configuration tool is installed on the password server; the password card configuration tool is connected to the password card through a PCI bus, and is used to modify and update the password chip allocation table, and allocate the password chip to the tenant; The password card includes a master control module, a network chip and a PCI bus chip; the PCI bus chip is used to receive the configuration instructions of the password card configuration tool transmitted through the PCI bus and pass them to the master control module; The network chip is connected to the password card, and is used to receive an encryption request transmitted through the network and transmit it to the master control module, wherein the encryption request is endowed with the Vlan ID of the tenant application virtual machine; The master control module is connected to the PCI bus chip and the network chip, and is used to update the password chip allocation table according to the configuration instruction to complete the configuration of the password chip allocation table; and read the encryption request from the network chip to identify and parse the Vlan ID, query the password chip corresponding to the Vlan ID according to the password chip allocation table, and send the encryption request to the password chip corresponding to the Vlan ID; Receive the Vlan ID configuration instruction of the tenant application virtual machine, configure the Vlan ID of the Vlan subnet card of the tenant application virtual machine and save it, so as to facilitate the pre-construction of a password chip allocation table for the password card, the password chip allocation table is used to store the unique binding relationship between the VlanID and the password chip, and each of the password chips has independent password storage resources and computing resources; Receive the IP address configuration instruction of the tenant application virtual machine, and configure the IP address of the configuration file in the tenant application virtual machine to point to the network port IP of the password card, so that the tenant application virtual machine can call the corresponding password chip in the password card.

5. A multi-tenant isolation method based on cryptographic chip deployment, characterized in that: Applied to a password server, the password server and the tenant application server are interconnected through a network; a password card is provided on the password server, and a pre-built password chip allocation table and multiple password chips are provided on the password card, and each of the password chips has independent password storage resources and computing resources; a number of tenant application virtual machines are running on the tenant application server, and each of the tenant application virtual machines is configured with a unique Vlan ID; a password card configuration tool is installed on the password server; the password card configuration tool is connected to the password card through a PCI bus, and is used to modify and update the password chip allocation table and allocate the password chip to the tenant; The password card includes a master control module, a network chip and a PCI bus chip; the PCI bus chip is used to receive the configuration instructions of the password card configuration tool transmitted through the PCI bus and pass them to the master control module; The network chip is connected to the password card, and is used to receive an encryption request transmitted through the network and transmit it to the master control module, wherein the encryption request is endowed with the Vlan ID of the tenant application virtual machine; The master control module is connected to the PCI bus chip and the network chip, and is used to update the password chip allocation table according to the configuration instruction to complete the configuration of the password chip allocation table; and read the encryption request from the network chip to identify and parse the Vlan ID, query the password chip corresponding to the Vlan ID according to the password chip allocation table, and send the encryption request to the password chip corresponding to the Vlan ID; Receive the Vlan ID of the tenant application virtual machine; A password chip allocation table modification instruction is received, a password chip is allocated to the Vlan ID, a unique binding relationship between the Vlan ID and the password chip is established, and the unique binding relationship is stored in the password chip allocation table.

6. A multi-tenant isolation method for a multi-tenant isolation system based on cryptographic chip deployment according to any one of claims 1-3, characterized in that: Applied to the tenant application server, including the following steps: Generate an encryption request based on the data to be encrypted of the tenant application virtual machine; The encryption request is sent to the password card through the network, and the Vlan ID of the tenant application virtual machine is automatically assigned to the encryption request when sending it, so that the password card can identify and parse the Vlan ID, query the password chip corresponding to the Vlan ID according to the password chip allocation table, and send the data to be encrypted to the password chip to perform encryption operations.

7. The multi-tenant isolation method according to claim 6, characterized in that: The following steps are also included: Call the password card operation API interface library; The password card operation API interface calls the password card device driver; The password card device driver calls the corresponding password chip on the password server through the network.

8. A multi-tenant isolation method for a multi-tenant isolation system based on cryptographic chip deployment according to any one of claims 1-3, characterized in that: Applied to the password server, including the following steps: Receiving an encryption request generated based on the data to be encrypted and sent by the tenant application virtual machine, wherein the encryption request is assigned with the Vlan ID of the tenant application virtual machine; Identify and parse the Vlan ID, query the cryptographic chip corresponding to the Vlan ID according to the cryptographic chip allocation table, and send the data to be encrypted to the cryptographic chip to perform encryption operation; After completing the encryption operation, the cryptographic chip returns the operation result to the tenant application virtual machine through the network.

Images