A cloud-native cryptography service method and system

Abstract

This invention discloses a cloud-native cryptographic service method and system, relating to the fields of cloud-native technology and cryptographic security technology. It addresses the problems of low resource utilization and slow service response speed caused by deficiencies in resource scheduling, service encapsulation, and hardware interface integration. The cloud-native cryptographic service method includes: grouping and encapsulating the provided cryptographic services using containers; dynamically scheduling container resources; encapsulating the service capabilities of hardware device interfaces; dynamically allocating application-to-service routes based on the application-service authorization relationship assigned by the tenant; invoking hardware cryptographic devices to provide cryptographic services; and achieving dynamic resource allocation and deep hardware-software integration of cryptographic services through containerization and Kubernetes resource scheduling. This significantly improves resource utilization efficiency and service response speed, simplifies the application system access process, enhances service usability, and substantially reduces operation and maintenance costs and management complexity.

Description

Technical Field

[0001] This invention relates to the fields of cloud-native technology and cryptographic security technology, and in particular to a cloud-native cryptographic service method and system. Background Technology

[0002] With the rapid development of cloud computing technology, dynamic resource allocation and hardware-software integration have become significant challenges for cloud services. Traditional cryptographic services are often based on static resource configuration, which cannot meet the flexibility and scalability requirements of cloud services.

[0003] Traditional solutions for cryptographic transformation of application systems fall into two categories: one is the use of practical hardware cryptographic devices, such as server cryptographic machines, signature verification servers, timestamp servers, SSL gateways, and IPSec VPNs; the other is to virtualize cryptographic services using virtual machines, providing cryptographic services externally on a virtual machine basis. Both solutions have drawbacks. The first type faces bottlenecks in the reuse of cryptographic devices, as physical devices are inconvenient for resource reuse and can lead to uneven resource utilization. The second type achieves cryptographic isolation and sharing in a multi-tenant environment through the physical and logical isolation of virtual machines, but virtual resources are fixedly allocated and cannot be dynamically adjusted according to the workload of business applications, resulting in significantly higher deployment and maintenance complexity.

[0004] Patent No. CN2022102621472 discloses a cloud-native national cryptographic key management method, relating to the field of information security. This method includes managing keys for a cloud platform and keys for cloud-based products. The cloud platform key management method, based on user business requests, calls a backend service to invoke underlying nodes. These underlying nodes then invoke a Barbican component, which, through its extension plugin, invokes a KMS service. The KMS service then invokes different hardware devices adapted to the cryptographic facilities to obtain specified key information for encrypting business storage data. The cloud-based product key management method, based on user business requests, parses the business request messages, performs business logic processing using an integrated SDK package, invokes a KMS service, and then invokes different hardware devices adapted to the cryptographic facilities to obtain specified key information for encrypting business application data.

[0005] Patent No. CN2024109390158 discloses a cloud-native high-availability cryptographic service cluster system and its implementation method. The system includes a control platform component, an execution node component, and a data plane component. The control platform component receives and processes cryptographic service lease requests and sends execution cryptographic service instructions to the execution node component. The execution node component receives the execution cryptographic service instructions and calls the data plane component to implement the cryptographic service. The data plane component executes the instructions from the execution node component, completing the cryptographic service through deployed cryptographic service instances. High availability of cryptographic service management is achieved based on multiple master nodes, and high availability of cryptographic service invocation is achieved based on multiple worker nodes. The beneficial effects of this invention are: it solves the high availability problem of cryptographic service management and also addresses the issue of dynamic expansion and contraction of cryptographic service invocation service nodes, improving the fault tolerance and stability of cryptographic services in large-scale service invocation scenarios.

[0006] Although the above patents all use cloud-native methods to solve the cryptographic service problem, they still have shortcomings in resource scheduling, service encapsulation and hardware interface integration, resulting in low resource utilization, slow service response speed and difficulty in adapting to changing business needs. Summary of the Invention

[0007] The purpose of this invention is to provide a cloud-native cryptographic service method and system that can ensure high availability and data security of services through containerization and Kubernetes resource scheduling, and utilize a comprehensive monitoring system; it achieves dynamic resource allocation and deep hardware and software integration for cryptographic services through cloud-native technologies, improves resource utilization efficiency and service response speed, simplifies the access process of application systems, and enhances the ease of use of services, while reducing operation and maintenance costs and management complexity.

[0008] This invention utilizes the following technical solution:

[0009] A cloud-native cryptography service method includes the following steps:

[0010] S1: Virtually divide the computing and storage units of the cloud cryptographic card to obtain virtual cryptographic card A;

[0011] S2: Bind the virtual cryptographic card A as a high-speed serial computer expansion bus device PCIe to container A1;

[0012] S3: Encapsulate services within container A1 to provide services using network interfaces;

[0013] S4: Container A1 is configured with different parameters according to the service to meet different performance requirements;

[0014] S5: The container management module dynamically schedules the parameter configuration of container A1;

[0015] S6: Container A1 provides a fixed service port to the outside world, and its IP address is dynamically allocated according to the container management module;

[0016] S7: The unified gateway calls the service of container A1 to perform application authentication and load balances K containers with the same service.

[0017] Preferably, in step S1, the process of virtually segmenting the cloud cryptographic card using a hardware-accelerated virtualization algorithm to obtain virtual cryptographic card A is as follows:

[0018] S11: Define the cloud password card as a physical function module (PF) of a peripheral device and assign it a unique PCIe identifier;

[0019] S12: Create several virtual functional devices (VF) within the physical functional module (PF) and assign them unique PCIe identifiers;

[0020] S13: The virtual function device VF shares the physical resources of the peripheral device, thereby obtaining the virtual password card A.

[0021] Preferably, in step S2, the virtual password card A is bound to container A1; within container A1, the virtual password card A can be accessed as a virtual function device (VF) and is independent of the remaining virtual function devices (VF).

[0022] Preferably, in step S3, container A1 encapsulates services by calling virtual password card A and remote software development kit (SDK); and encapsulates different network interfaces according to the services defined by container A1.

[0023] Preferably, in step S4, the parameter configuration includes, but is not limited to, the number of CPU cores and memory space.

[0024] Preferably, in step S7, the application system calls the unified gateway, which performs application authentication and load balancing. The unified gateway uses a hash algorithm to authenticate the container based on the application identifier Id, key key, and random number s to obtain the application authentication result value T: T = SM3_HMAC(Id, key, s), where SM3_HMAC() represents the hash algorithm. The application system calls the unified gateway to compare the access validity based on the application authentication result value. If the access is valid, it is directly routed to the corresponding service according to the correspondence between the application system and the service. If the access is invalid, the service is rejected, and the IP address is dynamically reallocated using the container management module. The calling logic of the application system via HTTP and SDK is the same, and unified application authentication is performed by the unified gateway in both cases.

[0025] Preferably, in step S7, two containers with the same service can call the same virtual cryptographic card or different virtual cryptographic cards; if different virtual cryptographic cards are called, the keys of the virtual cryptographic cards are synchronized for consistency; a matching service within the allocated service resources is selected using a random selection algorithm, a weighted round-robin algorithm, and / or a sequential round-robin algorithm, and the route is directed to this service to complete load balancing.

[0026] A cloud-native cryptographic service system includes a unified gateway, a tenant management module, a container management module, a virtual machine management module, a cryptographic resource scheduling module, and a hardware cryptographic device module; wherein,

[0027] A unified gateway is used to provide cryptographic service interfaces to application systems; the unified gateway includes application authentication and load balancing, and provides HTTP and SDK interface formats.

[0028] The tenant management module is used to manage tenant functions; tenant functions include tenant application authorization, tenant password service allocation, and tenant resource monitoring.

[0029] Container management module: Used to manage container resource orchestration, container monitoring, and container images respectively;

[0030] The virtual machine management module is used for unified management of virtual cryptographic machine images, instances, and resources;

[0031] The cryptographic resource scheduling module is used to schedule the allocation, use, and secure access of cryptographic resources.

[0032] The hardware cryptographic device module is used for unified monitoring, alarming, and retrieval of traditional cryptographic hardware devices.

[0033] Preferably, the cloud-native cryptographic service system utilizes a multi-layer service unit architecture to meet scalable cryptographic service functions; traditional cryptographic hardware devices include, but are not limited to, cryptographic cards, cloud cryptographic machines, virtualized resource cards supporting SR-IOV, virtual cryptographic machines, and monitoring systems; the monitoring system is used to monitor the invocation process of hardware resources, containers, virtual machines, and keys.

[0034] Preferably, after the container management module is deployed using containerization technology, it uses Kubernetes for resource scheduling and allocation management; after the virtual machine and hardware resources are bound, the service component calls the virtual cryptographic machine to provide basic cryptographic algorithms and storage functions.

[0035] This invention achieves dynamic resource allocation and deep hardware-software integration for cryptographic services through containerization and Kubernetes resource scheduling; it also utilizes cloud-native technologies; significantly improving resource utilization efficiency and service response speed, simplifying the application system access process, enhancing service usability, and drastically reducing operation and maintenance costs and management complexity. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0037] Figure 1 A flowchart illustrating the principles of operation and maintenance services;

[0038] Figure 2 This is a framework diagram of the operation and maintenance service system. Detailed Implementation

[0039] The present invention will now be described in detail with reference to the accompanying drawings and embodiments:

[0040] like Figure 1 As shown, the cloud-native cryptography service method of the present invention includes the following steps in sequence:

[0041] S1: Virtually divide the computing and storage units of the cloud cryptographic card to obtain virtual cryptographic card A;

[0042] In this embodiment, the cloud cryptographic card is an ultra-high-speed PCI-E encryption card that supports SR-IOV virtualization technology. It complies with the relevant technical specifications of the State Cryptography Administration regarding PCI cryptographic cards and cloud cryptographic cards. It can provide high-speed cryptographic computation services with virtualized resource pool isolation and parallel processing for various cloud cryptographic platforms such as cloud cryptographic machines. This meets their requirements for functions such as digital signature / verification, asymmetric / symmetric encryption and decryption, data integrity verification, true random number generation, key generation, and management, ensuring the confidentiality, authenticity, integrity, and non-repudiation of sensitive data. It supports up to 32 VFs and can be applied to various application areas such as cloud cryptographic machines and cloud signature verification servers.

[0043] In this invention, a hardware-accelerated virtualization algorithm is used to virtually segment the cloud cryptographic card; the process for obtaining virtual cryptographic card A is as follows:

[0044] S11: Define the cloud password card as a physical function module (PF) of a peripheral device and assign it a unique PCIe identifier;

[0045] S12: Create several virtual functional devices (VF) within the physical functional module (PF) and assign them unique PCIe identifiers;

[0046] S13: The virtual function device VF shares the physical resources of the peripheral device, thereby obtaining the virtual password card A;

[0047] S2: Bind the virtual cryptographic card A as a high-speed serial computer expansion bus device PCIe to container A1;

[0048] In this invention, a virtual password card A is bound to a container A1; within container A1, the bound virtual card A can be accessed as a virtual function device (VF) and is independent of the remaining virtual function devices (VFs).

[0049] S3: Encapsulate services within container A1 to provide services using network interfaces;

[0050] In this invention, container A1 encapsulates services by calling virtual password card A and remote software development kit (SDK); and encapsulates different network interfaces according to the services defined by container A1.

[0051] S4: Container A1 is configured with different parameters according to the service to meet different performance requirements;

[0052] In this invention, parameter configuration includes, but is not limited to, the number of CPU cores and memory space;

[0053] S5: The container management module dynamically schedules the parameter configuration of container A1;

[0054] S6: Container A1 provides a fixed service port to the outside world, and its IP address is dynamically allocated according to the container management module;

[0055] S7: The unified gateway calls the service of container A1 to perform application authentication and load balances K containers with the same service.

[0056] In this invention, the application system calls the unified gateway, which performs application authentication and load balancing. The unified gateway uses a hash algorithm to authenticate the container based on the application identifier (Id), key (key), and random number (s) to obtain the application authentication result value T: T = SM3_HMAC(Id,key,s), where SM3_HMAC() represents the hash algorithm. The application system calls the unified gateway to compare the access validity based on the application authentication result value. If the access is valid, it is directly routed to the corresponding service according to the correspondence between the application system and the service. If the access is invalid, the service is rejected, and the IP address is dynamically reallocated using the container management module. The calling logic of the application system via HTTP and SDK is the same, and unified application authentication is performed by the unified gateway in both cases.

[0057] In this invention, two containers providing the same service can call the same virtual cryptographic card or different virtual cryptographic cards; if different virtual cryptographic cards are called, the keys of the virtual cryptographic cards are synchronized for consistency; a matching service within the allocated service resources is selected using a random selection algorithm, a weighted round-robin algorithm, and / or a sequential round-robin algorithm, and the route is directed to this service to achieve load balancing;

[0058] Example 1:

[0059] The computing and storage units of the cloud cryptographic card are virtually partitioned using hardware-accelerated virtualization algorithms to obtain a virtual cryptographic card A: The cloud cryptographic card is defined as a physical functional module (PF) of a peripheral device and assigned a unique PCIe identifier; several virtual functional devices (VF) are created within the physical functional module (PF) and assigned unique PCIe identifiers; the virtual functional devices (VF) share the physical resources of the peripheral device, thereby obtaining the virtual cryptographic card A.

[0060] Virtual cryptographic card A is bound to container A1 as a high-speed serial computer expansion bus device (PCIe); virtual cryptographic card A is bound to container A1; within container A1, the bound virtual card A can be accessed as a virtual function device (VF), independent of other virtual function devices (VF); services are encapsulated within container A1 (container A1 encapsulates services by calling virtual cryptographic card A and through a remote software development kit (SDK); and different network interfaces are encapsulated according to the services defined in container A1) to provide services using the network interfaces;

[0061] Container A1 is configured with different parameters based on the service, such as the number of CPU cores and memory space, to meet different performance requirements. The container management module dynamically schedules the parameter configuration of container A1. Container A1 provides a fixed service port, while its IP address is dynamically allocated by the container management module. The unified gateway calls the service of container A1 for application authentication and performs load balancing on K containers with the same service. The application system calls the unified gateway, which performs application authentication and load balancing. The unified gateway uses a hash algorithm based on the application identifier Id, key key, and random number s to perform application authentication on the container, obtaining the application authentication result value T: T = SM3_HMAC(Id, key, s), SM3_HMAC() The hash algorithm is used to represent the access method. The application system calls the unified gateway to compare the access validity with the application authentication result. If the access is valid, it is directly routed to the corresponding service based on the correspondence between the application system and the service. The calling logic of the application system via HTTP and SDK is the same, and both are uniformly authenticated by the unified gateway. Two containers serving the same service can call the same virtual cryptographic card or different virtual cryptographic cards. If different virtual cryptographic cards are called, the keys of the virtual cryptographic cards are synchronized for consistency. A matching service within the allocated service resources is selected using a random selection algorithm, a weighted round-robin algorithm, and / or a sequential round-robin algorithm, and the route is directed to this service to achieve load balancing.

[0062] like Figure 2 As shown, a cloud-native cryptographic service system includes a unified gateway, a tenant management module, a container management module, a virtual machine management module, a cryptographic resource scheduling module, and a hardware cryptographic device module; wherein,

[0063] A unified gateway is used to provide cryptographic service interfaces to application systems; the unified gateway includes application authentication and load balancing, and provides HTTP and SDK interface formats.

[0064] The tenant management module is used to manage tenant functions; tenant functions include tenant application authorization, tenant password service allocation, and tenant resource monitoring.

[0065] Container management module: Used to manage container resource orchestration, container monitoring, and container images respectively;

[0066] In this invention, after the container management module deploys containerization technology, it uses Kubernetes for resource scheduling and allocation management; after the virtual machine and hardware resources are bound, the service component calls the virtual cryptographic machine to provide basic cryptographic algorithms and storage functions.

[0067] The virtual machine management module is used for unified management of virtual cryptographic machine images, instances, and resources;

[0068] The cryptographic resource scheduling module is used to schedule the allocation, use, and secure access of cryptographic resources.

[0069] The hardware cryptographic device module is used for unified monitoring, alarming, and retrieval of traditional cryptographic hardware devices;

[0070] In this invention, traditional cryptographic hardware devices include, but are not limited to, cryptographic cards, cloud cryptographic machines, virtualized resource cards supporting SR-IOV, virtual cryptographic machines, and monitoring systems; the monitoring system is used to monitor the calling process of hardware resources, containers, virtual machines, and keys;

[0071] In this invention, the cloud-native cryptographic service system utilizes a multi-layered service unit architecture to meet scalable cryptographic service functions;

[0072] (1) Architecture design: Build a multi-layer service unit architecture, including modules such as unified gateway and tenant management, to ensure the collaborative work between modules;

[0073] (2) Containerized deployment: Encapsulate the cryptographic service in containers and use container technologies such as Docker to achieve rapid deployment of the service;

[0074] (3) Resource scheduling and allocation: Container resources are dynamically scheduled using Kubernetes, and resource allocation is adjusted in real time based on tenant demand and service load.

[0075] (4) Hardware resource abstraction and integration: encapsulate the service capabilities of hardware cryptographic devices and virtualized cryptographic cards, and provide a unified calling interface;

[0076] (5) Provide a password service interface to the application system through a unified gateway, supporting both HTTP and SDK access methods;

[0077] (6) Implementation of monitoring system: Establish a comprehensive monitoring system to monitor and alarm the use of hardware resources, containers, virtual machines and keys in real time.

Claims

1. A cloud-native cryptographic service method, characterized in that: The steps are as follows: S1: Virtually divide the computing and storage units of the cloud cryptographic card to obtain virtual cryptographic card A; S2: Bind the virtual cryptographic card A as a high-speed serial computer expansion bus device PCIe to container A1; S3: Encapsulate services within container A1 to provide services using network interfaces; S4: Container A1 is configured with different parameters according to the service to meet different performance requirements; S5: The container management module dynamically schedules the parameter configuration of container A1; S6: Container A1 provides a fixed service port to the outside world, and its IP address is dynamically allocated according to the container management module; S7: The unified gateway calls the service of container A1 to perform application authentication and load balances K containers with the same service. Application systems call the unified gateway, which performs application authentication and load balancing. The unified gateway uses a hash algorithm to authenticate the container based on the application identifier (Id), key (key), and random number (s) to obtain the application authentication result value (T). , Represents a hash algorithm; Application systems call the unified gateway to compare the access validity with the application authentication result value; if the access is valid, it is directly routed to the corresponding service according to the correspondence between the application system and the service; if the access is invalid, the service is rejected and the IP address is dynamically reallocated using the container management module; the calling logic of application systems via HTTP and SDK is the same, and unified application authentication is performed by the unified gateway.

2. The cloud-native cryptographic service method according to claim 1, characterized in that: In step S1, the process of using a hardware-accelerated virtualization algorithm to virtually segment the cloud cryptographic card to obtain virtual cryptographic card A is as follows: S11: Define the cloud password card as a physical function module (PF) of a peripheral device and assign it a unique PCIe identifier; S12: Create several virtual functional devices (VF) within the physical functional module (PF) and assign them unique PCIe identifiers; S13: The virtual function device VF shares the physical resources of the peripheral device, thereby obtaining the virtual password card A.

3. The cloud-native cryptographic service method according to claim 1, characterized in that: In step S2, the virtual password card A is bound to container A1; within container A1, the virtual password card A can be accessed as a virtual function device VF, independent of the remaining virtual function devices VF.

4. The cloud-native cryptographic service method according to claim 1, characterized in that: In step S3, container A1 encapsulates services by calling virtual password card A and remote software development kit (SDK); and encapsulates different network interfaces according to the services defined by container A1.

5. The cloud-native cryptographic service method according to claim 1, characterized in that: In step S4, the parameter configuration includes, but is not limited to, the number of CPU cores and memory space.

6. The cloud-native cryptographic service method according to claim 1, characterized in that: In step S7, two containers with the same service can call the same virtual cryptographic card or different virtual cryptographic cards; if different virtual cryptographic cards are called, the keys of the virtual cryptographic cards are synchronized for consistency; a matching service within the allocated service resources is selected using a random selection algorithm, a weighted round-robin algorithm, and / or a sequential round-robin algorithm, and the route is directed to this service to complete load balancing.

7. A cloud-native cryptographic service system for implementing the method of any one of claims 1 to 6, characterized in that: It includes a unified gateway, a tenant management module, a container management module, a virtual machine management module, a cryptographic resource scheduling module, and a hardware cryptographic device module; among which, A unified gateway is used to provide cryptographic service interfaces to application systems; the unified gateway includes application authentication and load balancing, and provides HTTP and SDK interface formats. The tenant management module is used to manage tenant functions; tenant functions include tenant application authorization, tenant password service allocation, and tenant resource monitoring. Container management module: Used to manage container resource orchestration, container monitoring, and container images respectively; The virtual machine management module is used for unified management of virtual cryptographic machine images, instances, and resources; The cryptographic resource scheduling module is used to schedule the allocation, use, and secure access of cryptographic resources. The hardware cryptographic device module is used for unified monitoring, alarming, and retrieval of traditional cryptographic hardware devices.

8. The cloud-native cryptographic service system according to claim 7, characterized in that: The cloud-native cryptographic service system utilizes a multi-layered service unit architecture to meet scalable cryptographic service functions; traditional cryptographic hardware devices include, but are not limited to, cryptographic cards, cloud cryptographic machines, virtualized resource cards supporting SR-IOV, virtual cryptographic machines, and monitoring systems; the monitoring system is used to monitor the invocation process of hardware resources, containers, virtual machines, and keys.

9. The cloud-native cryptographic service system according to claim 7, characterized in that: After the container management module is deployed using containerization technology, it uses Kubernetes for resource scheduling and allocation management. After the virtual machine and hardware resources are bound together, the service component calls the virtual cryptographic machine to provide basic cryptographic algorithms and storage functions.

Images