Heterogeneous cryptographic device management method, device, electronic device and storage medium

Abstract

The present application discloses a heterogeneous cryptographic device management method, apparatus, electronic device and storage medium, which realizes unified management of heterogeneous cryptographic devices. The method comprises: receiving an access request sent by a cryptographic device, wherein the access request carries interface information of the cryptographic device; determining the similarity between the interface information of the cryptographic device and standard interface information; if the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, converting the interface information of the cryptographic device into the standard interface information, and storing the corresponding relationship between the interface information of the cryptographic device and the standard interface information; and connecting the cryptographic device to the heterogeneous cryptographic device management system based on the standard interface information.

Description

Technical Field

[0001] The present application relates to the field of cryptographic service technology, and in particular to heterogeneous cryptographic device management methods, devices, electronic devices and storage media. Background Art

[0002] While the Internet has brought great convenience to people's lives, it has also been accompanied by the widespread exposure of sensitive information in cyberspace, and the protection of sensitive data faces great challenges. As the core strategy to ensure the secure transmission of data, data security encryption technology has increasingly attracted widespread attention from all walks of life, prompting the construction of a cryptographic device management platform to become an urgent task that needs to be solved. However, with the continuous deepening and expansion of information system services, the types of cryptographic devices are increasing, but most current cryptographic application systems still use the traditional static cryptographic resource allocation model, which makes it difficult to achieve flexible scheduling and efficient use of cryptographic resources. In addition, there are significant differences and compatibility barriers between the cryptographic device management systems provided by different manufacturers, which directly leads to the inability of the cryptographic device management system to smoothly access or manage cryptographic devices from other manufacturers.

[0003] Therefore, how to achieve unified management of heterogeneous cryptographic devices is one of the technical problems that need to be urgently solved in the existing technology. Summary of the invention

[0004] In order to solve the problem that the existing cryptographic device management system cannot uniformly manage heterogeneous cryptographic devices, the embodiments of the present application provide a heterogeneous cryptographic device management method, apparatus, electronic device and storage medium.

[0005] In a first aspect, an embodiment of the present application provides a heterogeneous cryptographic device management method, which is applied to a heterogeneous cryptographic device management system, and the method includes:

[0006] Receiving an access request sent by a cryptographic device, wherein the access request carries interface information of the cryptographic device;

[0007] Determining the similarity between the interface information of the cryptographic device and the standard interface information;

[0008] If the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, converting the interface information of the cryptographic device into the standard interface information, and storing the corresponding relationship between the interface information of the cryptographic device and the standard interface information;

[0009] The cryptographic device is connected to the heterogeneous cryptographic device management system based on the standard interface information.

[0010] In one implementation, the interface information includes an interface function parameter and attribute value information of the interface function parameter, the interface function parameter is used to characterize the interface function of the cryptographic device, and the attribute value information of the interface function parameter is a characterization value of the interface function;

[0011] Determining the similarity between the interface information of the cryptographic device and the standard interface information specifically includes:

[0012] For each interface function parameter of the cryptographic device, determining a similarity between an attribute value of the interface function parameter and an attribute value of a corresponding standard interface function parameter; and

[0013] After determining the similarity between the interface information of the cryptographic device and the standard interface information, the method further includes:

[0014] For each interface function parameter, respectively determine the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool;

[0015] An average value of similarities between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool is determined as a similarity threshold corresponding to the interface function parameter.

[0016] In one implementation, if the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, converting the interface information of the cryptographic device into the standard interface information specifically includes:

[0017] For each interface function parameter of the cryptographic device, if it is determined that the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter is less than the similarity threshold corresponding to the interface function parameter, the attribute value of the interface function parameter is converted into the attribute value of the corresponding standard interface function parameter.

[0018] In one embodiment, the method further comprises:

[0019] Setting a plurality of virtual cryptographic devices on the cryptographic device;

[0020] A corresponding index position is allocated for the key of each virtual cryptographic device, and each index position is used to store a key.

[0021] In one implementation, the key of each virtual cryptographic device is divided into corresponding index positions, specifically including:

[0022] Performing hash calculation on the identifier of the key of each virtual cryptographic device to obtain a hash value corresponding to the corresponding key;

[0023] Determine the position of each key on a hash ring according to a hash value corresponding to each key, wherein the hash ring is created according to a consistent hashing algorithm, and the nodes on the hash ring correspond to the keys stored in the virtual cryptographic device;

[0024] The position of each key on the hash ring is determined as the index position corresponding to each key.

[0025] In one embodiment, the method further comprises:

[0026] Receive a target application's business data encryption request sent by a client;

[0027] Obtaining a first cryptographic resource usage rate of each virtual cryptographic device in each cryptographic device, where the first cryptographic resource usage rate represents a usage rate of a key stored in the virtual cryptographic device;

[0028] Selecting a target virtual cryptographic device from virtual cryptographic devices whose first cryptographic resource usage is less than a first usage threshold;

[0029] Selecting an unused target key from the target virtual cryptographic device;

[0030] The business data of the target application is encrypted according to the target key.

[0031] In one implementation, encrypting the service data of the target application according to the target key specifically includes:

[0032] According to the correspondence between the stored interface information of the cryptographic device and the standard interface information, converting the standard interface information corresponding to the target cryptographic device to which the target virtual cryptographic device belongs into the interface information of the target cryptographic device;

[0033] The interface of the target cryptographic device is called according to the interface information of the target cryptographic device to encrypt the business data of the target application.

[0034] In one embodiment, the method further comprises:

[0035] Monitoring the second cryptographic resource usage of all cryptographic devices according to a preset time period, wherein the second cryptographic resource usage represents the total usage of keys stored in all virtual cryptographic devices in all cryptographic devices;

[0036] Determining a usage trend of the password resource according to the usage rate of the second password resource in the current time period and the usage rate of the second password resource in the previous time period;

[0037] If it is determined that the usage trend of the cryptographic resources is an upward trend, the cryptographic equipment capacity is expanded;

[0038] If it is determined that the usage trend of the cryptographic resources is a downward trend, the cryptographic device is reduced in capacity.

[0039] In one implementation, if it is determined that the usage trend of the cryptographic resources is a downward trend, scaling down the cryptographic device specifically includes:

[0040] Obtaining a third cryptographic resource usage rate of each cryptographic device, where the third cryptographic resource usage rate represents a usage rate of keys stored in all virtual cryptographic devices in the cryptographic device;

[0041] Selecting a first cryptographic device from cryptographic devices whose third cryptographic resource usage rate is lower than a second usage rate threshold;

[0042] For each key in each virtual cryptographic device of the first cryptographic device, determine two nodes adjacent to the node corresponding to the key from the hash ring;

[0043] Migrating the hash value corresponding to the key to the node corresponding to the key of the two nodes with a lower usage frequency;

[0044] The first cryptographic device is removed from the heterogeneous cryptographic device management system, and all nodes corresponding to the keys of the first cryptographic device are removed from the hash ring.

[0045] In a second aspect, an embodiment of the present application provides a heterogeneous cryptographic device management device, which is applied to a heterogeneous cryptographic device management system, and the device includes:

[0046] A first receiving module, configured to receive an access request sent by a cryptographic device, wherein the access request carries interface information of the cryptographic device;

[0047] A first determination module, used to determine the similarity between the interface information of the cryptographic device and the standard interface information;

[0048] an interface standardization module, configured to convert the interface information of the cryptographic device into the standard interface information if the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, and store a corresponding relationship between the interface information of the cryptographic device and the standard interface information;

[0049] An access module is used to connect the cryptographic device to the heterogeneous cryptographic device management system based on the standard interface information.

[0050] In one implementation, the interface information includes an interface function parameter and attribute value information of the interface function parameter, the interface function parameter is used to characterize the interface function of the cryptographic device, and the attribute value information of the interface function parameter is a characterization value of the interface function;

[0051] The first determination module is specifically configured to determine, for each interface function parameter of the cryptographic device, a similarity between an attribute value of the interface function parameter and an attribute value of a corresponding standard interface function parameter;

[0052] The device further comprises:

[0053] A second determination module is used to determine, for each interface function parameter, the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool after determining the similarity between the interface information of the cryptographic device and the standard interface information;

[0054] The third determination module is used to determine the average value of the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool as the similarity threshold corresponding to the interface function parameter.

[0055] In one embodiment, the interface standardization module is specifically used to convert the attribute value of each interface function parameter of the cryptographic device into the attribute value of the corresponding standard interface function parameter if it is determined that the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter is less than the similarity threshold corresponding to the interface function parameter.

[0056] In one embodiment, the device further comprises:

[0057] A setting module, used for setting a number of virtual cryptographic devices on the cryptographic device;

[0058] The division module is used to divide the key of each virtual cryptographic device into corresponding index positions, and each index position is used to store a key.

[0059] In one embodiment, the partitioning module is specifically used to perform hash calculations on the identifiers of the keys of each virtual cryptographic device to obtain hash values ​​corresponding to the corresponding keys; determine the position of each key on a hash ring according to the hash values ​​corresponding to each key, wherein the hash ring is created according to a consistent hashing algorithm, and the nodes on the hash ring correspond to the keys stored in the virtual cryptographic device; and determine the position of each key on the hash ring as the index position corresponding to each key.

[0060] In one embodiment, the device further comprises:

[0061] The second receiving module is used to receive a business data encryption request of a target application sent by a client;

[0062] An acquisition module, used to acquire a first cryptographic resource usage rate of each virtual cryptographic device in each cryptographic device, wherein the first cryptographic resource usage rate represents a usage rate of a key stored in the virtual cryptographic device;

[0063] A first selection module, configured to select a target virtual cryptographic device from virtual cryptographic devices whose first cryptographic resource usage rate is less than a first usage rate threshold;

[0064] A second selection module, used to select an unused target key from the target virtual cryptographic device;

[0065] The encryption module is used to encrypt the business data of the target application according to the target key.

[0066] In one embodiment, the encryption module is specifically used to convert the standard interface information corresponding to the target cryptographic device to which the target virtual cryptographic device belongs into the interface information of the target cryptographic device according to the correspondence between the stored interface information of the cryptographic device and the standard interface information; and to call the interface of the target cryptographic device according to the interface information of the target cryptographic device to encrypt the business data of the target application.

[0067] In one embodiment, the device further comprises:

[0068] A monitoring module, used to monitor the usage rate of the second cryptographic resource of all cryptographic devices according to a preset time period, wherein the usage rate of the second cryptographic resource represents the total usage rate of the keys stored in all virtual cryptographic devices in all cryptographic devices;

[0069] a fourth determination module, configured to determine a usage trend of the cryptographic resource according to a usage rate of the second cryptographic resource in a current time period and a usage rate of the second cryptographic resource in a previous time period;

[0070] An expansion module, configured to expand the capacity of cryptographic devices if it is determined that the usage trend of the cryptographic resources is an upward trend;

[0071] The capacity reduction module is used to reduce the capacity of the cryptographic device if it is determined that the usage trend of the cryptographic resource is a downward trend.

[0072] In one embodiment, the shrinking module is specifically used to obtain a third cryptographic resource usage rate of each cryptographic device, wherein the third cryptographic resource usage rate represents the usage rate of keys stored in all virtual cryptographic devices in the cryptographic device; select a first cryptographic device from the cryptographic devices whose third cryptographic resource usage rate is lower than a second usage rate threshold; for each key in each virtual cryptographic device of the first cryptographic device, determine two nodes adjacent to the node corresponding to the key on the hash ring; migrate the hash value corresponding to the key to the node corresponding to the key corresponding to the two nodes with low usage frequency; remove the first cryptographic device from the heterogeneous cryptographic device management system, and remove all nodes corresponding to the keys of the first cryptographic device on the hash ring.

[0073] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the heterogeneous cryptographic device management method described in the present application when executing the program.

[0074] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps in the heterogeneous cryptographic device management method described in the present application are implemented.

[0075] The beneficial effects of this application are as follows:

[0076] The embodiments of the present application provide a heterogeneous cryptographic device management method, apparatus, electronic device, and storage medium. The heterogeneous cryptographic device management system receives an access request sent by a cryptographic device, the access request carries interface information of the cryptographic device, determines the similarity between the interface information of the cryptographic device and the standard interface information, and if the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, converts the interface information of the cryptographic device into standard interface information, stores the correspondence between the interface information of the cryptographic device and the standard interface information, and connects the cryptographic device to the heterogeneous cryptographic device management system based on the standard interface information. In an embodiment of the present application, the heterogeneous cryptographic device management system pre-sets standard interface information of the cryptographic device. When a cryptographic device is connected, the interface information of the cryptographic device whose interface information is less than the similarity threshold to the standard interface information is converted into the standard interface information and then connected to the heterogeneous cryptographic device management system, and the correspondence between the interface information of the cryptographic device and the standard interface information is stored for subsequent use when the cryptographic device is used to provide cryptographic services. For the cryptographic device whose interface information is greater than or equal to the similarity threshold to the standard interface information, there is no need to perform the interface information conversion operation, and it can be directly connected to the heterogeneous cryptographic device management system. Therefore, for heterogeneous cryptographic devices provided by different manufacturers, the commonalities between the interfaces are identified to effectively shield the interface differences between the devices, so that the dependence of the cryptographic service application layer on the cryptographic device is significantly reduced, and unified access management of heterogeneous cryptographic devices provided by different manufacturers is realized, and a more flexible and compatible management method is constructed, so that cryptographic services can cross the boundaries of different cryptographic devices to achieve seamless integration and efficient operation.

[0077] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0079] Figure 1 A schematic diagram of an application scenario of the heterogeneous cryptographic device management method provided in an embodiment of the present application;

[0080] Figure 2 A schematic diagram of the internal structure of a cryptographic device provided in an embodiment of the present application;

[0081] Figure 3 A schematic diagram of a process for managing heterogeneous cryptographic devices provided in an embodiment of the present application;

[0082] Figure 4 A schematic diagram of a process for determining the similarity between an attribute value of an interface function parameter and an attribute value of a corresponding standard interface function parameter provided in an embodiment of the present application;

[0083] Figure 5 A schematic diagram of a flow chart of index positions corresponding to key division of a virtual cryptographic device provided in an embodiment of the present application;

[0084] Figure 6 Schematic diagram of a hash ring;

[0085] Figure 7 A schematic diagram of the cryptographic resource allocation process provided in an embodiment of the present application;

[0086] Figure 8 A schematic diagram of a process for encrypting the business data of a target application provided in an embodiment of the present application;

[0087] Fig. 9 A schematic diagram of a process for expanding and reducing the capacity of a cryptographic device provided in an embodiment of the present application;

[0088] Fig.10 A schematic diagram of a specific implementation process for reducing the capacity of a cryptographic device provided in an embodiment of the present application;

[0089] Fig.11 A schematic diagram of the structure of a heterogeneous cryptographic device management device provided in an embodiment of the present application;

[0090] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0091] While the Internet has brought great convenience to people's lives, it has also been accompanied by the widespread exposure of sensitive information in cyberspace. The protection of sensitive data faces great challenges. As the core strategy to ensure the secure transmission of data, data security encryption technology has received increasing attention from all walks of life, prompting the construction of a cryptographic device management platform to become an urgent task to be solved. However, with the continuous deepening and expansion of information system services, the types of cryptographic devices are increasing, but most current cryptographic application systems still use the traditional static cryptographic resource allocation model, which makes it difficult to achieve flexible scheduling and efficient use of cryptographic resources. In addition, there are significant differences and compatibility barriers between the cryptographic device management systems provided by different manufacturers, which directly leads to the inability of the cryptographic device management system to smoothly access or manage cryptographic devices from other manufacturers. Moreover, the functional interfaces of cryptographic devices provided by different manufacturers are different. This difference limits the application requester to rely only on the services of cryptographic devices provided by a specific single manufacturer. This limitation not only limits the diversity of service options, but also leads to an imbalance in the utilization rate of cryptographic devices in the cryptographic resource pool, that is, some cryptographic devices may be overloaded due to frequent use, while other cryptographic devices may be idle for a long time.

[0092] To solve the above technical problems, the embodiments of the present application provide a heterogeneous cryptographic device management method, apparatus, electronic device and storage medium.

[0093] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0094] First reference Figure 1, which is a schematic diagram of an application scenario of the heterogeneous cryptographic device management method provided in an embodiment of the present application, and may include a heterogeneous cryptographic device management system 100, a cryptographic device 101 to be connected to the heterogeneous cryptographic device management system 100, and the heterogeneous cryptographic device management system 100 includes a cryptographic device difference standardization module 1001, a cryptographic resource allocation module 1002, a dynamic cryptographic resource expansion module 1003, and cryptographic devices 1 to n that have been connected to the heterogeneous cryptographic device management system 100, wherein n is the number of cryptographic devices that have been connected to the heterogeneous cryptographic device management system 100. The heterogeneous cryptographic device management system 100 can be connected to cryptographic devices from different manufacturers, and cryptographic devices from different manufacturers are provided with different interface documents, and the interface documents store interface information of the cryptographic devices, and the interface information includes interface function parameters and attribute value information of the interface function parameters. When the heterogeneous cryptographic device management system receives an access request from the cryptographic device 101, the text parser in the cryptographic device difference standardization module 1001 parses the interface document of the cryptographic device 101, extracts the interface information of the cryptographic device 101, identifies and extracts the interface information that implements the same function as the preset standard interface, and uses the similarity voting mechanism to standardize the interface information that may be different to ensure the interface compatibility and consistency between cryptographic devices from different manufacturers. The standardized cryptographic devices can be uniformly provided by this module, thereby simplifying the complexity of integration and management of the heterogeneous cryptographic device management system 100. The cryptographic devices connected to the heterogeneous cryptographic device management system 100 can be virtualized into several independent virtual cryptographic devices, each of which can be further subdivided into units containing different index bit resources, and each index position stores the key of a virtual cryptographic device, such as Figure 2As shown, it is a schematic diagram of the internal structure of a cryptographic device provided by an embodiment of the present application. Taking cryptographic device 1 as an example, it is assumed that cryptographic device 1 contains three virtual cryptographic devices: virtual cryptographic device 11, virtual cryptographic device 12, and virtual cryptographic device 13. Several keys are stored in each virtual cryptographic device, and the storage position of the key can be identified by the index position. For example, in virtual cryptographic device 11, 111 identifies the position of the first key stored in virtual cryptographic device 11, and index 111 can be used as the identifier of the key stored in the index position. 112 identifies the position of the second key stored in virtual device 11, and index identifier 112 can be used as the identifier of the key stored in the index position, and so on, until all keys of virtual cryptographic device 11 are set with index positions. The cryptographic resource allocation module 1002 has intelligent scheduling capabilities, and can dynamically adjust and allocate cryptographic resources, that is, key resources in the cryptographic device, according to real-time changes in encryption service traffic from the application side, improve the utilization efficiency of cryptographic resources, and promote the integration and unification of cryptographic resources of cryptographic devices of different manufacturers, breaking the previous dependence on encryption devices of a single manufacturer, and enriching the diversity and flexibility of cryptographic devices. The efficient operation of the password resource allocation module 1002 needs to cooperate with the password device difference standardization module 1001 and the dynamic password resource extension module 1003. The password resource allocation module 1002 needs to make dynamic password resource decisions based on the mapping relationship between the interface information of the password device and the standard interface information established by the password device difference standardization module 1001, and the real-time monitoring of the password resource usage of all current password devices by the dynamic password resource extension module 1003. Moreover, the actual calling process of the password service involves the operation of converting the standard interface information corresponding to the password device into the specific interface information of the bottom layer of the password device to ensure the smooth execution of the password service. The dynamic password resource extension module 1003 can dynamically expand or shrink the password device according to the current password resource utilization rate, avoid the impact of insufficient password resources on the business, or cause the waste of password resources when the business volume is small, ensure that the business operation is not affected by the adjustment of password resources, and at the same time improve the efficiency and flexibility of password resource management.

[0095] In an embodiment of the present application, the heterogeneous cryptographic device management system 100 can be implemented using a server. The server can be an independent physical server or a cloud server that provides basic cloud computing services such as cloud servers, cloud databases, and cloud storage. This embodiment of the present application does not limit this.

[0096] Based on the above application scenarios, the following will refer to the attached Figures 3 to 10The exemplary embodiments of the present application are described in more detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present application, and the implementation of the present application is not limited in any way. On the contrary, the implementation of the present application can be applied to any applicable scenario.

[0097] like Figure 3 As shown, it is a schematic diagram of the implementation process of the heterogeneous cryptographic device management method provided in the embodiment of the present application. The heterogeneous cryptographic device management method can be applied to the above-mentioned heterogeneous cryptographic device management system 100, and specifically may include the following steps:

[0098] S21. Receive an access request sent by a cryptographic device, where the access request carries interface information of the cryptographic device.

[0099] During specific implementation, the heterogeneous cryptographic device management system receives an access request sent by a cryptographic device, which carries interface information of the cryptographic device, wherein the interface information includes interface function parameters and attribute value information of the interface function parameters, the interface function parameters are used to characterize the interface function of the cryptographic device, and the attribute value information of the interface function parameters is the characterization value of the interface function.

[0100] Specifically, the heterogeneous cryptographic device management system receives an access request sent by a cryptographic device, the access request carries an interface document containing interface information of the cryptographic device, and uses a text parser to parse the interface document of the cryptographic device to extract the interface information of the cryptographic device in the interface document.

[0101] As shown in Table 1, it is an example of the interface information of a newly added virtual cryptographic device to a cryptographic device:

[0102] Table 1

[0103]

[0104] As shown in Table 1, the interface function parameters of the newly added virtual cryptographic device of the cryptographic device include: request serial number, operation type, vsm identification code (i.e., virtual cryptographic device identification), callback address, the attribute value of the interface function parameter "request serial number" is "requestId", the attribute value of the interface function parameter "operation type" is "oprType", the attribute value of the interface function parameter "vsm identification code" is "vsmId", and the attribute value of the interface function parameter "callback address" is "callbackUrl". The attribute value of the interface function parameter "request serial number" of the cryptographic device produced by another manufacturer is "reqId", the attribute value of the interface function parameter "operation type" is "operateType", the attribute value of the interface function parameter "vsm identification code" is "vsmId", and the attribute value of the interface function parameter "callback address" is "callbackUrl". It can be seen that the attribute values ​​of the same interface function parameters of cryptographic devices provided by different manufacturers may be different. In order to eliminate interface differences, the heterogeneous cryptographic device management system can pre-set standard interface information. For example, for the newly added virtual cryptographic device function of the cryptographic device, the attribute values ​​of the standard interface function parameters are set as follows: the attribute value of the interface function parameter "request serial number" is "requestId", the attribute value of the interface function parameter "operation type" is "oprerateType", the attribute value of the interface function parameter "vsm identification code" is "vsmId", and the attribute value of the interface function parameter "callback address" is "callbackUrl". During implementation, it can be set according to needs, and the embodiments of the present application are not limited to this.

[0105] S22. Determine the similarity between the interface information of the cryptographic device and the standard interface information.

[0106] During specific implementation, for each interface function parameter of the cryptographic device, the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter is determined.

[0107] Specifically, you can follow the following Figure 4 The process shown determines the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter, including the following steps:

[0108] S31. Base-encode the attribute value of each interface function parameter to obtain the encoded value of the attribute value of each interface function parameter, and Base-encode the attribute value of each standard interface function parameter to obtain the encoded value of the attribute value of each standard interface function parameter.

[0109] In implementation, the attribute value of each interface function parameter may be Base64 encoded to obtain the encoded value of the attribute value of each interface function parameter, and the attribute value of each standard interface function parameter may be Base64 encoded to obtain the encoded value of the attribute value of each standard interface function parameter. Base16 encoding or Base32 encoding may also be used, which is not limited in the embodiments of the present application.

[0110] S32. For each interface function parameter, determine the similarity between the encoding value of the attribute value of the interface function parameter and the encoding value of the attribute value of the corresponding standard interface function parameter.

[0111] In specific implementation, the similarity between the encoded value of the attribute value of the interface function parameter and the encoded value of the attribute value of the corresponding standard interface function parameter can be determined by calculating the Euclidean distance between the encoded value of the attribute value of the interface function parameter and the encoded value of the attribute value of the corresponding standard interface function parameter. Other algorithms for calculating similarity can also be used to determine the similarity between the encoded value of the attribute value of the interface function parameter and the encoded value of the attribute value of the corresponding standard interface function parameter, such as cosine similarity, which is not limited in the embodiments of the present application.

[0112] After determining the similarity between the encoding value of the attribute value of each interface function parameter and the encoding value of the attribute value of the corresponding standard interface function parameter, the method further includes:

[0113] Get the similarity threshold corresponding to each interface function parameter.

[0114] In one implementation, the heterogeneous cryptographic device management system may pre-set a fixed similarity threshold corresponding to each interface function parameter.

[0115] In one implementation, the similarity threshold corresponding to each interface function parameter may also be dynamically set based on the attribute value of each interface function parameter of each connected cryptographic device.

[0116] In specific implementation, for each interface function parameter, the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool is determined respectively, and the average value of the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool is determined as the similarity threshold corresponding to the interface function parameter.

[0117] Specifically, each time a cryptographic device is connected to the heterogeneous cryptographic device management system, the corresponding relationship between the interface information of the cryptographic device and the standard interface information is stored in the attribute pool, which contains the corresponding relationship between the attribute values ​​of the interface function parameters of different cryptographic devices and the attribute values ​​of the standard interface parameters.

[0118] For each interface function parameter of the current cryptographic device to be accessed, the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter of cryptographic devices from different manufacturers stored in the attribute pool is determined respectively, and the average value of the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool is determined as the similarity threshold corresponding to the interface function parameter. Thus, the similarity threshold corresponding to each interface function parameter of the current cryptographic device to be accessed can be determined.

[0119] S23. If the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, convert the interface information of the cryptographic device into the standard interface information, and store the corresponding relationship between the interface information of the cryptographic device and the standard interface information.

[0120] In a specific implementation, for each interface function parameter of the cryptographic device, if it is determined that the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter is less than the similarity threshold corresponding to the interface function parameter, the attribute value of the interface function parameter is converted into the attribute value of the corresponding standard interface function parameter; if it is determined that the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter is greater than or equal to the similarity threshold corresponding to the interface function parameter, the attribute value of the interface function parameter is not standardized, and then the correspondence between the interface information of the cryptographic device and the standard interface information is stored in the attribute pool.

[0121] S24. Connect the cryptographic device to the heterogeneous cryptographic device management system based on the standard interface information.

[0122] During specific implementation, the cryptographic devices with standardized interface information are connected to the heterogeneous cryptographic device management system.

[0123] After the cryptographic device is connected to the heterogeneous cryptographic device management system, it also includes:

[0124] Create an index location for the password of the password device.

[0125] During specific implementation, a number of virtual cryptographic devices are set on the cryptographic device, and a corresponding index position is allocated for the key of each virtual cryptographic device.

[0126] Specifically, after the cryptographic device is connected to the heterogeneous cryptographic device management system, the heterogeneous cryptographic device management system can send a virtualization cryptographic device request to the cryptographic device to virtualize the cryptographic device into several virtual cryptographic devices. The heterogeneous cryptographic device management system divides the key of each virtual cryptographic device into corresponding index positions, and each index position is used to store a key. The heterogeneous cryptographic device management system stores the correspondence between the identifier of the cryptographic device and the identifier and index position of the virtual cryptographic device.

[0127] In a specific implementation, in order to ensure the fixity of the index position corresponding to the key, each key can be used as a node of a consistent hash ring, and the index position of the key can be set on the hash ring.

[0128] Specifically, the following can be used: Figure 5 The process shown is the index position corresponding to the key division of each virtual cryptographic device, including the following processes:

[0129] S41, performing hash calculation on the identifier of the key of each virtual cryptographic device to obtain a hash value corresponding to the corresponding key.

[0130] In this step, the heterogeneous cryptographic device management system performs hash calculation on the identifier of the key of each virtual cryptographic device of the connected cryptographic device to obtain a hash value corresponding to the corresponding key, wherein the index corresponding to the key can be used to represent the identifier of the key.

[0131] S42. Determine the position of each key on the hash ring according to the hash value corresponding to each key. The hash ring is created according to the consistent hashing algorithm. The nodes on the hash ring correspond to the keys stored in the virtual cryptographic device.

[0132] The heterogeneous cryptographic device management system creates a hash ring in advance according to the consistent hashing algorithm, and maps the key stored in the virtual cryptographic device of each cryptographic device as a node to the hash ring. Figure 6 The hash ring shown in the figure is a virtual ring that organizes the entire hash value space into a circle through the consistent hashing algorithm. The hash ring is organized in a clockwise direction, representing The point directly above the hash ring represents 0, the first point to the right of 0 represents 1, and so on, until , 0 and Overlap. Each participating node will be mapped to a certain position on the hash ring. The position of the node can be calculated by the node's identifier or IP address through a hash function. In order to better balance the load, each actual physical node can also be mapped to multiple positions on the ring. These positions are called virtual nodes. The number of virtual nodes can be more than the number of actual nodes. In this way, data can be more evenly distributed on different nodes.

[0133] In this step, the hash value corresponding to each key is mapped to the hash ring to obtain the position of the hash value corresponding to each key on the hash ring.

[0134] S43. Determine the position of each key on the hash ring as the index position corresponding to each key.

[0135] In this step, the position of each key on the hash ring is used as the index position corresponding to each key.

[0136] The heterogeneous cryptographic device management system can also provide cryptographic resource allocation for the business data of different applications, and use the allocated cryptographic resources to provide encryption and decryption processing for the business data of the applications.

[0137] like Figure 7 As shown, it is a schematic diagram of the cryptographic resource allocation process provided by the example of this application, which may include the following steps:

[0138] S51: Receive a target application's business data encryption request sent by a client.

[0139] During specific implementation, the heterogeneous cryptographic device management system receives a business data encryption request of a target application sent by a client.

[0140] S52: Obtain a first cryptographic resource usage rate of each virtual cryptographic device in each cryptographic device.

[0141] In specific implementation, the heterogeneous cryptographic device management system obtains the first cryptographic resource usage rate of each virtual cryptographic device in each cryptographic device, and the first cryptographic resource usage rate represents the usage rate of the keys stored in the virtual cryptographic device. For example, a virtual cryptographic device of a cryptographic device stores 100 keys and 50 keys have been used, then the first cryptographic resource usage rate of the virtual cryptographic device of the cryptographic device is: 50 / 100=50%.

[0142] Specifically, the heterogeneous cryptographic device management system monitors the first cryptographic resource usage rate of each virtual cryptographic device in each cryptographic device, and stores the correspondence between the identifier of the used cryptographic device and the identifier of the used virtual cryptographic device and the index position of the used key in a database, and stores the correspondence between the identifier of the cryptographic device and the identifier of the virtual cryptographic device with unused keys and the first cryptographic resource usage rate of each virtual cryptographic device in the database.

[0143] When the heterogeneous cryptographic device management system receives a business data encryption request of a target application sent by a client, it obtains the first cryptographic resource usage rate of each virtual cryptographic device in each cryptographic device from a database.

[0144] S53: Select a target virtual cryptographic device from virtual cryptographic devices whose first cryptographic resource usage rate is less than a first usage rate threshold.

[0145] In specific implementation, the heterogeneous cryptographic device management system can arbitrarily select a virtual cryptographic device as the target virtual cryptographic device from the virtual cryptographic devices whose first cryptographic resource usage rate is less than the first usage rate threshold, or can select the virtual cryptographic device with the smallest first cryptographic resource usage rate from the virtual cryptographic devices whose first cryptographic resource usage rate is less than the first usage rate threshold as the target virtual cryptographic device, which is not limited in the embodiment of the present application. In implementation, the first usage rate threshold can be set voluntarily, such as 30% or 40%, or any other percentage, which is not limited in the embodiment of the present application.

[0146] If the first cryptographic resource usage rates of all virtual cryptographic devices are greater than (or equal to) the first usage rate threshold, the virtual cryptographic device with the lowest first cryptographic resource usage rate may be selected as the target virtual cryptographic device.

[0147] S54. Select an unused target key from the target virtual cryptographic device.

[0148] During specific implementation, the heterogeneous cryptographic device management system selects an unused key from the target virtual cryptographic device as the target key. The selection can be based on the index position or can be arbitrarily selected. The embodiment of the present application does not limit this, and the relationship between the target application identifier and the index position is stored in the database.

[0149] S55. Encrypt the business data of the target application according to the target key.

[0150] During specific implementation, the heterogeneous cryptographic device management system uses the selected target key to encrypt the business data of the target application to obtain encrypted business data, and sends the encrypted business data to the target device corresponding to the target IP address.

[0151] Specifically, you can follow the following Figure 8 The process shown encrypts the business data of the target application and includes the following steps:

[0152] S61. According to the correspondence between the stored interface information of the cryptographic device and the standard interface information, convert the standard interface information corresponding to the target cryptographic device to which the target virtual cryptographic device belongs into the interface information of the target cryptographic device.

[0153] In specific implementation, the heterogeneous cryptographic device management system converts the attribute values ​​of the corresponding standard interface function parameters of the cryptographic device to which the target virtual cryptographic device belongs into the attribute values ​​of the interface function parameters of the target cryptographic device according to the correspondence between the attribute values ​​of the interface function parameters of the stored cryptographic devices and the attribute values ​​of the standard interface function parameters.

[0154] S62: Call the interface of the target cryptographic device according to the interface information of the target cryptographic device to encrypt the business data of the target application.

[0155] During specific implementation, the heterogeneous cryptographic device management system calls the interface of the target cryptographic device according to the attribute value of the interface function parameter of the target cryptographic device to encrypt the business data of the target application to obtain the encrypted business data.

[0156] Furthermore, after receiving the encrypted business data, the target device decrypts the encrypted business data based on the target key to obtain the decrypted business data.

[0157] In the embodiment of the present application, the cryptographic devices managed by the heterogeneous cryptographic device management system can provide not only data encryption and decryption services, but also other services that the cryptographic devices can provide, such as signature verification. The embodiment of the present application does not limit this, and the present application only uses the above data encryption service as an example for explanation.

[0158] In the embodiment of the present application, the heterogeneous cryptographic device management system dynamically expands or reduces the capacity of the cryptographic device according to the usage trend of the cryptographic resources, such as Fig. 9 As shown, it is a schematic diagram of the implementation process of expanding and shrinking the cryptographic device provided in an embodiment of the present application, which may include the following steps:

[0159] S71. Monitor the usage rate of the second password resources of all password devices according to a preset time period.

[0160] In specific implementation, the heterogeneous cryptographic device management system can monitor the second cryptographic resource usage rate of all cryptographic devices according to the preset time period, wherein the second cryptographic resource usage rate represents the total usage rate of the keys stored in all virtual cryptographic devices in all cryptographic devices. For example, there are 3 cryptographic devices connected to the heterogeneous cryptographic device management system, each of which contains 3 virtual cryptographic devices, and each virtual cryptographic device has 10 keys. Then the total number of keys in each cryptographic device is 30, 10 keys of cryptographic device 1 have been used, 15 keys of cryptographic device 2 have been used, and 20 keys of cryptographic device 3 have been used. Then the second cryptographic resource usage rate of all cryptographic devices is: (10+15+20) / (30×3)=50%. In implementation, the preset time period can be set voluntarily, such as 5 days or 7 days, or any other duration, which is not limited in the embodiment of the present application.

[0161] S72. Determine a usage trend of the cryptographic resource according to the usage of the second cryptographic resource in the current time period and the usage of the second cryptographic resource in the previous time period.

[0162] During specific implementation, if it is determined that the usage rate of the second password resource in the current time period is greater than the usage rate of the second password resource in the previous time period, it can be determined that the usage trend of the password resource is an upward trend. If it is determined that the usage rate of the second password resource in the current time period is less than the usage rate of the second password resource in the previous time period, it can be determined that the usage trend of the password resource is a downward trend. If it is determined that the usage rate of the second password resource in the current time period is equal to the usage rate of the second password resource in the previous time period, it can be determined that the usage trend of the password resource is unchanged.

[0163] S73. If it is determined that the usage trend of cryptographic resources is an upward trend, the cryptographic equipment is expanded.

[0164] In specific implementation, if it is determined that the usage trend of the password resource is an upward trend, and the second password resource usage rate in the current time period is greater than or equal to the first preset threshold, the password device is expanded and a new password device is added. Among them, the first preset threshold can be set according to the actual situation, such as 85% or 90%, and can also be set to other percentages, which is not limited in the embodiment of the present application.

[0165] If it is determined that the usage trend of the password resource is an upward trend, and the second password resource usage rate in the current time period is less than the first preset threshold, the current password device resource is kept unchanged.

[0166] The implementation method of expanding the capacity of the cryptographic device, that is, adding a new cryptographic device, can refer to the implementation of steps S21 to S24 and steps S41 to S43, which will not be repeated here.

[0167] S74. If it is determined that the usage trend of the cryptographic resources is a downward trend, the cryptographic equipment is reduced in capacity.

[0168] In specific implementation, if it is determined that the utilization trend of the cryptographic resources is a downward trend, and the utilization rate of the second cryptographic resources in the current time period is less than the second preset threshold, the cryptographic device can be scaled down and one cryptographic device can be deleted, wherein the second preset threshold can be set by itself, such as 50% or 60%, and other percentages can also be set, which is not limited in the embodiments of the present application.

[0169] If it is determined that the usage trend of the password resource is a downward trend, and the second password resource usage rate in the current time period is greater than or equal to the second preset threshold, the current password device resources are kept unchanged.

[0170] If it is determined that the usage trend of the password resources remains unchanged, the current password device resources remain unchanged.

[0171] You can follow Fig.10 The process shown in the figure can be used to reduce the capacity of the cryptographic device, and can include the following steps:

[0172] S81. Obtain the third cryptographic resource usage rate of each cryptographic device.

[0173] In specific implementation, the heterogeneous cryptographic device management system monitors the third cryptographic resource usage rate of each cryptographic device, and the third cryptographic resource usage rate represents the usage rate of the keys stored in all virtual cryptographic devices in the cryptographic device. For example, a cryptographic device includes 3 virtual cryptographic devices, each of which stores 50 keys, 10 keys have been used in the first virtual cryptographic device, 20 keys have been used in the second virtual cryptographic device, and 30 keys have been used in the third virtual cryptographic device. Then the third cryptographic resource usage rate of the cryptographic device is: (10+20+30) / (50×3)=40%.

[0174] S82. Select a first cryptographic device from cryptographic devices whose third cryptographic resource usage rate is lower than the second usage rate threshold.

[0175] During specific implementation, the heterogeneous cryptographic device management system may arbitrarily select a cryptographic device as the first cryptographic device from the cryptographic devices whose third cryptographic resource usage rate is less than the second usage rate threshold, or may select the cryptographic device with the lowest third cryptographic resource usage rate as the first cryptographic device, which is not limited to this in the embodiments of the present application. The second usage rate threshold can be set according to needs, such as 20% or 30%, or any other percentage, which is not limited to this in the embodiments of the present application.

[0176] S83. For each key in each virtual cryptographic device of the first cryptographic device, determine two nodes adjacent to the node corresponding to the key on the hash ring.

[0177] In specific implementation, the operations of step S83 and step S84 are performed for each key in each virtual cryptographic device of the first cryptographic device.

[0178] In this step, the two nodes before and after the node corresponding to the key are queried from the hash ring.

[0179] S84. Migrate the hash value corresponding to the key to the node corresponding to the key with a lower usage frequency among the keys corresponding to the two nodes.

[0180] In specific implementation, the hash value corresponding to the key is migrated to the node corresponding to the key with the lowest frequency of use among the two nodes before and after the node corresponding to the key. The frequency of use of the key represents the number of times the key is used. If the two use frequencies are the same, the hash value corresponding to the key can be migrated to any of the two nodes before and after the node corresponding to the key. In this way, the key being used in the first cryptographic device can be migrated to the node of the neighbor of the node corresponding to the key on the hash ring, avoiding the loss of key data. The key in the first cryptographic device can be deleted from the hash ring after use.

[0181] S85: Remove the first cryptographic device from the heterogeneous cryptographic device management system, and remove all nodes corresponding to the keys of the first cryptographic device from the hash ring.

[0182] During specific implementation, the heterogeneous cryptographic device management system takes out the first cryptographic device from the heterogeneous cryptographic device management system, and deletes all key mapping nodes of the first cryptographic device on the hash ring to complete the reduction of the cryptographic device.

[0183] In the heterogeneous cryptographic device management method provided in the embodiment of the present application, the heterogeneous cryptographic device management system receives an access request sent by a cryptographic device, the access request carries the interface information of the cryptographic device, determines the similarity between the interface information of the cryptographic device and the standard interface information, and if the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, converts the interface information of the cryptographic device into standard interface information, stores the correspondence between the interface information of the cryptographic device and the standard interface information, and connects the cryptographic device to the heterogeneous cryptographic device management system based on the standard interface information. In an embodiment of the present application, the heterogeneous cryptographic device management system pre-sets standard interface information of the cryptographic device. When a cryptographic device is connected, the interface information of the cryptographic device whose interface information is less than the similarity threshold to the standard interface information is converted into the standard interface information and then connected to the heterogeneous cryptographic device management system, and the correspondence between the interface information of the cryptographic device and the standard interface information is stored for subsequent use when the cryptographic device is used to provide cryptographic services. For the cryptographic device whose interface information is greater than or equal to the similarity threshold to the standard interface information, there is no need to perform the interface information conversion operation, and it can be directly connected to the heterogeneous cryptographic device management system. Therefore, for heterogeneous cryptographic devices provided by different manufacturers, the commonalities between the interfaces are identified to effectively shield the interface differences between the devices, so that the dependence of the cryptographic service application layer on the cryptographic device is significantly reduced, and unified access management of heterogeneous cryptographic devices provided by different manufacturers is realized, and a more flexible and compatible management method is constructed, so that cryptographic services can cross the boundaries of different cryptographic devices to achieve seamless integration and efficient operation.

[0184] Based on the same inventive concept, an embodiment of the present application also provides a heterogeneous cryptographic device management device. Since the principle of solving the problem by the above-mentioned heterogeneous cryptographic device management device is similar to the above-mentioned heterogeneous cryptographic device management method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0185] like Fig.11 As shown, it is a schematic diagram of the structure of the heterogeneous cryptographic device management device provided in the embodiment of the present application, which can be applied to Figure 1 In the heterogeneous cryptographic device management system 100 shown, the device includes:

[0186] A first receiving module 91, configured to receive an access request sent by a cryptographic device, wherein the access request carries interface information of the cryptographic device;

[0187] A first determination module 92, used to determine the similarity between the interface information of the cryptographic device and the standard interface information;

[0188] An interface standardization module 93, configured to convert the interface information of the cryptographic device into the standard interface information if the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, and store a corresponding relationship between the interface information of the cryptographic device and the standard interface information;

[0189] The access module 94 is used to connect the cryptographic device to the heterogeneous cryptographic device management system based on the standard interface information.

[0190] In one implementation, the interface information includes an interface function parameter and attribute value information of the interface function parameter, the interface function parameter is used to characterize the interface function of the cryptographic device, and the attribute value information of the interface function parameter is a characterization value of the interface function;

[0191] The first determination module 92 is specifically configured to determine, for each interface function parameter of the cryptographic device, a similarity between an attribute value of the interface function parameter and an attribute value of a corresponding standard interface function parameter;

[0192] The device further comprises:

[0193] A second determination module is used to determine, for each interface function parameter, the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool after determining the similarity between the interface information of the cryptographic device and the standard interface information;

[0194] The third determination module is used to determine the average value of the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool as the similarity threshold corresponding to the interface function parameter.

[0195] In one embodiment, the interface standardization module 93 is specifically used to convert the attribute value of each interface function parameter of the cryptographic device into the attribute value of the corresponding standard interface function parameter if it is determined that the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter is less than the similarity threshold corresponding to the interface function parameter.

[0196] In one embodiment, the device further comprises:

[0197] A setting module, used for setting a number of virtual cryptographic devices on the cryptographic device;

[0198] The division module is used to divide the key of each virtual cryptographic device into corresponding index positions, and each index position is used to store a key.

[0199] In one embodiment, the partitioning module is specifically used to perform hash calculations on the identifiers of the keys of each virtual cryptographic device to obtain hash values ​​corresponding to the corresponding keys; determine the position of each key on a hash ring according to the hash values ​​corresponding to each key, wherein the hash ring is created according to a consistent hashing algorithm, and the nodes on the hash ring correspond to the keys stored in the virtual cryptographic device; and determine the position of each key on the hash ring as the index position corresponding to each key.

[0200] In one embodiment, the device further comprises:

[0201] The second receiving module is used to receive a business data encryption request of a target application sent by a client;

[0202] An acquisition module, used to acquire a first cryptographic resource usage rate of each virtual cryptographic device in each cryptographic device, wherein the first cryptographic resource usage rate represents a usage rate of a key stored in the virtual cryptographic device;

[0203] A first selection module, configured to select a target virtual cryptographic device from virtual cryptographic devices whose first cryptographic resource usage rate is less than a first usage rate threshold;

[0204] A second selection module, used to select an unused target key from the target virtual cryptographic device;

[0205] The encryption module is used to encrypt the business data of the target application according to the target key.

[0206] In one embodiment, the encryption module is specifically used to convert the standard interface information corresponding to the target cryptographic device to which the target virtual cryptographic device belongs into the interface information of the target cryptographic device according to the correspondence between the stored interface information of the cryptographic device and the standard interface information; and to call the interface of the target cryptographic device according to the interface information of the target cryptographic device to encrypt the business data of the target application.

[0207] In one embodiment, the device further comprises:

[0208] A monitoring module, used to monitor the usage rate of the second cryptographic resource of all cryptographic devices according to a preset time period, wherein the usage rate of the second cryptographic resource represents the total usage rate of the keys stored in all virtual cryptographic devices in all cryptographic devices;

[0209] a fourth determination module, configured to determine a usage trend of the cryptographic resource according to a usage rate of the second cryptographic resource in a current time period and a usage rate of the second cryptographic resource in a previous time period;

[0210] An expansion module, configured to expand the capacity of cryptographic devices if it is determined that the usage trend of the cryptographic resources is an upward trend;

[0211] The capacity reduction module is used to reduce the capacity of the cryptographic device if it is determined that the usage trend of the cryptographic resource is a downward trend.

[0212] In one embodiment, the shrinking module is specifically used to obtain a third cryptographic resource usage rate of each cryptographic device, wherein the third cryptographic resource usage rate represents the usage rate of keys stored in all virtual cryptographic devices in the cryptographic device; select a first cryptographic device from the cryptographic devices whose third cryptographic resource usage rate is lower than a second usage rate threshold; for each key in each virtual cryptographic device of the first cryptographic device, determine two nodes adjacent to the node corresponding to the key on the hash ring; migrate the hash value corresponding to the key to the node corresponding to the key corresponding to the two nodes with low usage frequency; remove the first cryptographic device from the heterogeneous cryptographic device management system, and remove all nodes corresponding to the keys of the first cryptographic device on the hash ring.

[0213] Based on the same technical concept, the present application embodiment also provides an electronic device 1100, referring to Fig.12As shown, the electronic device 1100 is used to implement the heterogeneous cryptographic device management method described in the above method embodiment. The electronic device 1100 of this embodiment may include: a memory 1101, a processor 1102, and a computer program stored in the memory and executable on the processor, such as a heterogeneous cryptographic device management program. When the processor executes the computer program, the steps in each of the above heterogeneous cryptographic device management method embodiments are implemented.

[0214] The specific connection medium between the memory 1101 and the processor 1102 is not limited in the embodiment of the present application. Fig.12 In the embodiment, the memory 1101 and the processor 1102 are connected via a bus 1103. The bus 1103 is Fig.12 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 1103 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0215] The memory 1101 may be a volatile memory, such as a random-access memory (RAM); the memory 1101 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 1101 is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1101 may be a combination of the above memories.

[0216] Processor 1102 is used to implement the heterogeneous cryptographic device management method provided in the embodiment of the present application.

[0217] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program required to execute the above-mentioned processor.

[0218] In some possible implementations, various aspects of the heterogeneous cryptographic device management method provided in the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the heterogeneous cryptographic device management method according to various exemplary implementations of the present application described above in this specification.

[0219] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0220] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0221] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0222] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0223] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0224] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for managing heterogeneous cryptographic devices, characterized in that: Applied to a heterogeneous cryptographic device management system, the method comprises: Receiving an access request sent by a cryptographic device, wherein the access request carries interface information of the cryptographic device; Determine the similarity between the interface information of the cryptographic device and the standard interface information; the interface information includes interface function parameters and attribute value information of the interface function parameters, the interface function parameters are used to characterize the interface function of the cryptographic device, and the attribute value information of the interface function parameters is the characterization value of the interface function; Determining the similarity between the interface information of the cryptographic device and the standard interface information specifically includes: for each interface function parameter of the cryptographic device, determining the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter; For each interface function parameter, respectively determine the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool; Determine the average value of the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool as the similarity threshold corresponding to the interface function parameter; If the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, converting the interface information of the cryptographic device into the standard interface information, and storing the corresponding relationship between the interface information of the cryptographic device and the standard interface information; The cryptographic device is connected to the heterogeneous cryptographic device management system based on the standard interface information.

2. The method according to claim 1, characterized in that If the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, converting the interface information of the cryptographic device into the standard interface information specifically includes: For each interface function parameter of the cryptographic device, if it is determined that the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter is less than the similarity threshold corresponding to the interface function parameter, the attribute value of the interface function parameter is converted into the attribute value of the corresponding standard interface function parameter.

3. The method according to claim 1, characterized in that Also includes: Setting a plurality of virtual cryptographic devices on the cryptographic device; A corresponding index position is allocated for the key of each virtual cryptographic device, and each index position is used to store a key.

4. The method according to claim 3, characterized in that The corresponding index position is divided for the key of each virtual cryptographic device, specifically including: Performing hash calculation on the identifier of the key of each virtual cryptographic device to obtain a hash value corresponding to the corresponding key; Determine the position of each key on a hash ring according to a hash value corresponding to each key, wherein the hash ring is created according to a consistent hashing algorithm, and the nodes on the hash ring correspond to the keys stored in the virtual cryptographic device; The position of each key on the hash ring is determined as the index position corresponding to each key.

5. The method according to claim 3 or 4, characterized in that Also includes: Receive a target application's business data encryption request sent by a client; Obtaining a first cryptographic resource usage rate of each virtual cryptographic device in each cryptographic device, where the first cryptographic resource usage rate represents a usage rate of a key stored in the virtual cryptographic device; Selecting a target virtual cryptographic device from virtual cryptographic devices whose first cryptographic resource usage is less than a first usage threshold; Selecting an unused target key from the target virtual cryptographic device; The business data of the target application is encrypted according to the target key.

6. The method according to claim 5, characterized in that The business data of the target application is encrypted according to the target key, specifically including: According to the correspondence between the stored interface information of the cryptographic device and the standard interface information, converting the standard interface information corresponding to the target cryptographic device to which the target virtual cryptographic device belongs into the interface information of the target cryptographic device; The interface of the target cryptographic device is called according to the interface information of the target cryptographic device to encrypt the business data of the target application.

7. The method according to claim 4, characterized in that Also includes: Monitoring the second cryptographic resource usage of all cryptographic devices according to a preset time period, wherein the second cryptographic resource usage represents the total usage of keys stored in all virtual cryptographic devices in all cryptographic devices; Determining a usage trend of the password resource according to the usage rate of the second password resource in the current time period and the usage rate of the second password resource in the previous time period; If it is determined that the usage trend of the cryptographic resources is an upward trend, the cryptographic equipment is expanded; If it is determined that the usage trend of the cryptographic resources is a downward trend, the cryptographic device is reduced in capacity.

8. The method according to claim 7, characterized in that If it is determined that the usage trend of the cryptographic resources is a downward trend, the cryptographic device is reduced in capacity, specifically including: Obtaining a third cryptographic resource usage rate of each cryptographic device, where the third cryptographic resource usage rate represents a usage rate of keys stored in all virtual cryptographic devices in the cryptographic device; Selecting a first cryptographic device from cryptographic devices whose third cryptographic resource usage rate is lower than a second usage rate threshold; For each key in each virtual cryptographic device of the first cryptographic device, determine two nodes adjacent to the node corresponding to the key from the hash ring; Migrating the hash value corresponding to the key to the node corresponding to the key of the two nodes with a lower usage frequency; The first cryptographic device is removed from the heterogeneous cryptographic device management system, and all nodes corresponding to the keys of the first cryptographic device are removed from the hash ring.

9. A heterogeneous cryptographic device management device, characterized in that: Applied to heterogeneous cryptographic device management system, the device comprises: A first receiving module, configured to receive an access request sent by a cryptographic device, wherein the access request carries interface information of the cryptographic device; A first determination module is used to determine the similarity between the interface information of the cryptographic device and the standard interface information; the interface information includes an interface function parameter and attribute value information of the interface function parameter, the interface function parameter is used to characterize the interface function of the cryptographic device, and the attribute value information of the interface function parameter is a characterization value of the interface function; The first determination module is specifically configured to determine, for each interface function parameter of the cryptographic device, a similarity between an attribute value of the interface function parameter and an attribute value of a corresponding standard interface function parameter; A second determination module is used to determine, for each interface function parameter, the similarity between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool after determining the similarity between the interface information of the cryptographic device and the standard interface information; A third determination module, configured to determine an average value of similarities between the attribute value of the interface function parameter and the attribute value of each identical interface function parameter stored in the attribute pool as a similarity threshold corresponding to the interface function parameter; an interface standardization module, configured to convert the interface information of the cryptographic device into the standard interface information if the similarity between the interface information of the cryptographic device and the standard interface information is less than a similarity threshold, and store a corresponding relationship between the interface information of the cryptographic device and the standard interface information; An access module is used to connect the cryptographic device to the heterogeneous cryptographic device management system based on the standard interface information.

10. The device according to claim 9, characterized in that The interface standardization module is specifically used to convert the attribute value of each interface function parameter of the cryptographic device into the attribute value of the corresponding standard interface function parameter if it is determined that the similarity between the attribute value of the interface function parameter and the attribute value of the corresponding standard interface function parameter is less than the similarity threshold corresponding to the interface function parameter.

11. The device according to claim 9, characterized in that Also includes: A setting module, used for setting a number of virtual cryptographic devices on the cryptographic device; The division module is used to divide the key of each virtual cryptographic device into corresponding index positions, and each index position is used to store a key.

12. The device according to claim 11, characterized in that The partitioning module is specifically used to perform hash calculation on the identifier of the key of each virtual cryptographic device to obtain the hash value corresponding to the corresponding key; determine the position of each key on the hash ring according to the hash value corresponding to each key, the hash ring is created according to the consistent hashing algorithm, and the nodes on the hash ring correspond to the keys stored in the virtual cryptographic device; The position of each key on the hash ring is determined as the index position corresponding to each key.

13. The device according to claim 11 or 12, characterized in that Also includes: The second receiving module is used to receive a business data encryption request of a target application sent by a client; An acquisition module, used to acquire a first cryptographic resource usage rate of each virtual cryptographic device in each cryptographic device, wherein the first cryptographic resource usage rate represents a usage rate of a key stored in the virtual cryptographic device; A first selection module, configured to select a target virtual cryptographic device from virtual cryptographic devices whose first cryptographic resource usage rate is less than a first usage rate threshold; A second selection module, used to select an unused target key from the target virtual cryptographic device; The encryption module is used to encrypt the business data of the target application according to the target key.

14. The device according to claim 13, characterized in that The encryption module is specifically used to convert the standard interface information corresponding to the target cryptographic device to which the target virtual cryptographic device belongs into the interface information of the target cryptographic device according to the correspondence between the stored interface information of the cryptographic device and the standard interface information; The interface of the target cryptographic device is called according to the interface information of the target cryptographic device to encrypt the business data of the target application.

15. The device according to claim 12, characterized in that Also includes: A monitoring module, used to monitor the usage rate of the second cryptographic resource of all cryptographic devices according to a preset time period, wherein the usage rate of the second cryptographic resource represents the total usage rate of the keys stored in all virtual cryptographic devices in all cryptographic devices; a fourth determination module, configured to determine a usage trend of the cryptographic resource according to a usage rate of the second cryptographic resource in a current time period and a usage rate of the second cryptographic resource in a previous time period; An expansion module, configured to expand the capacity of cryptographic devices if it is determined that the usage trend of the cryptographic resources is an upward trend; The capacity reduction module is used to reduce the capacity of the cryptographic device if it is determined that the usage trend of the cryptographic resource is a downward trend.

16. The device according to claim 15, characterized in that The shrinking module is specifically used to obtain a third cryptographic resource usage rate of each cryptographic device, where the third cryptographic resource usage rate represents a usage rate of keys stored in all virtual cryptographic devices in the cryptographic device; Selecting a first cryptographic device from cryptographic devices whose third cryptographic resource usage rate is lower than a second usage rate threshold; For each key in each virtual cryptographic device of the first cryptographic device, determine two nodes adjacent to the node corresponding to the key from the hash ring; Migrating the hash value corresponding to the key to the node corresponding to the key of the two nodes with a lower usage frequency; The first cryptographic device is removed from the heterogeneous cryptographic device management system, and all nodes corresponding to the keys of the first cryptographic device are removed from the hash ring.

17. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the heterogeneous cryptographic device management method as described in any one of claims 1 to 8 is implemented.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in the heterogeneous cryptographic device management method as described in any one of claims 1 to 8 are implemented.

Images