Password task processing method and device based on state extrapolation, storage medium and electronic equipment

Abstract

The invention relates to the technical field of data processing, and particularly provides a password task processing method and device based on state extrapolation, a storage medium and electronic equipment, and the method can comprise the steps: receiving an operation task related to a password task; and sending task data to a password resource end, so that the password resource end executes the operation task on the task data, and obtains a task result and task context update information, the task data comprises the operation task, to-be-processed data related to the operation task and task context information of the password task; and receiving the task result and the task context update information fed back by the password resource end so as to provide context information for other operation tasks of the password task subsequently. Some embodiments of the application can improve the password task processing efficiency.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device, storage medium and electronic device for cryptographic task processing based on state externalization. Background Art

[0002] In general, when an application calls a cryptographic module to perform digital signature and encryption operations, it usually uses the init, update, and final calling model. The init operation establishes a "session". Based on this "session", the operation data is sent to the cryptographic module through one or more updates to perform cryptographic operations. Finally, the final operation is performed to complete the final cryptographic processing process and obtain the result and output it.

[0003] At present, in the scenario where the application system calls multiple cryptographic modules, when the business system calls the init function of the cryptographic module, it will create a session context on one of the cryptographic machines. If the task needs to process a lot of data and cannot be sent to the cryptographic machine at one time, the caller program and the cryptographic machine that performs init will continue to send the task to the cryptographic machine for processing until it is completed. However, if the task of the cryptographic machine is busy, it will seriously affect the service efficiency of the cryptographic task. In addition, since other cryptographic machines do not have the context information of the cryptographic task, they cannot provide services for it.

[0004] Therefore, how to provide a technical solution for an efficient cryptographic task processing method has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of some embodiments of the present application is to provide a method, device, storage medium and electronic device for cryptographic task processing based on state externalization. The technical solutions of the embodiments of the present application can improve the execution efficiency of cryptographic tasks so that cryptographic tasks can be served by different cryptographic resource terminals.

[0006] In the first aspect, some embodiments of the present application provide a method for cryptographic task processing based on state externalization, which is applied to a scheduling end, including: receiving an operation task related to a cryptographic task; sending task data to a cryptographic resource end, so that the cryptographic resource end executes the operation task on the task data, and obtains task results and task context update information, wherein the task data includes: the operation task, data to be processed related to the operation task, and task context information about the cryptographic task; the cryptographic resource end is any end in a cryptographic resource pool; receiving the task results and the task context update information fed back by the cryptographic resource end, so as to subsequently provide context information for other operation tasks of the cryptographic task.

[0007] Some embodiments of the present application can send task data to any cryptographic resource end in the cryptographic resource pool after receiving the operation task. The task data contains task context information related to the cryptographic task, so that the cryptographic resource can obtain the context information of the cryptographic task and complete the operation on the data to be processed. Finally, the scheduling end will also receive the task result and task context update information, and can subsequently provide context information for other operation tasks. Some embodiments of the present application can enable cryptographic tasks to be served by different cryptographic resource ends, improve the execution efficiency of cryptographic tasks, and realize the reasonable scheduling of the cryptographic resource pool.

[0008] In some embodiments, the types of the operation task are update task and termination task; when the type of the operation task is the termination task, the method further includes: merging the task results corresponding to each update task to obtain the target processing result of the cryptographic task.

[0009] Some embodiments of the present application combine all task results after receiving a terminated task to obtain a final target processing result, thereby achieving accurate processing of cryptographic tasks.

[0010] In some embodiments, the task context update information is obtained by the cryptographic resource end updating an intermediate result field, an unprocessed field, and a data length field in the task context information.

[0011] Some embodiments of the present application store the context information of the cryptographic task through different fields in the task context information, so as to facilitate sending to different cryptographic resource terminals and realize effective processing of the cryptographic task.

[0012] In the second aspect, some embodiments of the present application provide a method for cryptographic task processing based on state externalization, which is applied to any cryptographic resource end in a cryptographic resource pool, including: receiving task data sent by a scheduling end, wherein the task data includes: an operation task related to the cryptographic task, data to be processed related to the operation task, and task context information related to the cryptographic task; executing the operation task on the task data, obtaining the task result, and updating the task context information to obtain task context update information; sending the task result and the task context update information to the scheduling end, so that the scheduling end can subsequently provide context information for other operation tasks of the cryptographic task.

[0013] Some embodiments of the present application can receive task data of an operation task corresponding to a cryptographic task, wherein the task data contains task context information related to the cryptographic task, and the cryptographic resource can obtain the context information of the cryptographic task, complete the operation on the data to be processed, and finally the cryptographic resource end sends the task result and task context update information to the scheduling end, which can subsequently provide context information for other operation tasks. Some embodiments of the present application can enable cryptographic tasks to be served by different cryptographic resource ends, improve the execution efficiency of cryptographic tasks, and realize the reasonable scheduling of the cryptographic resource pool.

[0014] In some embodiments, executing the operation task on the task data and obtaining the task result includes: grouping the data to be processed and the unprocessed data in the task context information to obtain grouped data and ungrouped data; executing the operation task on the grouped data to obtain the task result.

[0015] Some embodiments of the present application obtain task results by grouping the processed data and the unprocessed data and then executing corresponding operation tasks, thereby achieving accurate processing of cryptographic tasks and improving execution efficiency.

[0016] In some embodiments, updating the task context information to obtain the task context update information includes: updating the task result to the intermediate result field of the task context information, updating the ungrouped data and the length of the ungrouped data to the unprocessed field in the task context information, and updating the length of the grouped data to the data length field of the task context information to obtain the task context update information.

[0017] Some embodiments of the present application obtain task context update information by updating different fields in the task context information, which can provide accurate context information for other operation tasks of subsequent cryptographic tasks and ensure the effectiveness of task execution.

[0018] In some embodiments, before receiving the task data sent by the scheduling end, the method also includes: creating context information corresponding to the cryptographic task; processing the context information to generate the task context information; and sending the task context information to the scheduling end so that the scheduling end can store the association between the cryptographic task and the task context information.

[0019] Some embodiments of the present application obtain task context information by creating context information corresponding to a cryptographic task and store it on a scheduling end, so that it can be sent to any cryptographic resource end when the cryptographic task is subsequently executed, thereby completing effective processing of the cryptographic task.

[0020] In the third aspect, some embodiments of the present application provide a device for cryptographic task processing based on state externalization, which is applied to a scheduling end, including: a task receiving module, configured to receive an operation task related to a cryptographic task; a task distribution module, configured to send task data to a cryptographic resource end, so that the cryptographic resource end executes the operation task on the task data, obtains task results and task context update information, wherein the task data includes: the operation task, data to be processed related to the operation task, and task context information of the cryptographic task; the cryptographic resource end is any end in a cryptographic resource pool; a result receiving module, configured to receive the task result and the task context update information fed back by the cryptographic resource end, so as to subsequently provide context information for other operation tasks of the cryptographic task.

[0021] In a fourth aspect, some embodiments of the present application provide a device for cryptographic task processing based on state externalization, which is applied to any cryptographic resource end in a cryptographic resource pool, comprising: a data receiving module, configured to receive task data sent by a scheduling end, wherein the task data includes: an operation task related to the cryptographic task, data to be processed related to the operation task, and task context information related to the cryptographic task; a task execution module, configured to execute the operation task on the task data, obtain the task result, and update the task context information to obtain task context update information; a result sending module, configured to send the task result and the task context update information to the scheduling end, so that the scheduling end can subsequently provide context information for other operation tasks of the cryptographic task.

[0022] In a fifth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0023] In a sixth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement a method as described in any embodiment of the first aspect.

[0024] In a seventh aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 A system diagram of cryptographic task processing based on state externalization provided for some embodiments of the present application;

[0027] Figure 2 One of the flow charts of the method for cryptographic task processing based on state externalization provided for some embodiments of the present application;

[0028] Figure 3 A second flow chart of a method for cryptographic task processing based on state externalization provided for some embodiments of the present application;

[0029] Figure 4 One of the block diagrams of the apparatus for cryptographic task processing based on state externalization provided in some embodiments of the present application;

[0030] Figure 5 The second block diagram of the apparatus for cryptographic task processing based on state externalization provided in some embodiments of the present application;

[0031] Figure 6 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0032] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0033] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0034] In the related art, when an application calls a cryptographic module to perform digital signature and encryption operations, it usually uses the init, update, and final calling model. In this scenario, all subsequent operations (for example, update, final) rely on the key established by init. Each update or final depends on the processing result of the previous update (except for the data processing of the first block).

[0035] When cryptographic calculations are required, if the data to be operated is too large to be directly sent to the cryptographic module, the data will be divided into several parts, and then sent to the cryptographic module in sequence by calling update multiple times. This calling model can meet most of the requirements when an application calls a single cryptographic module.

[0036] However, in the scenario where the application system calls multiple cryptographic modules, the above calling model becomes complicated. For example, a business system calls two cryptographic machines to process task T in a load balancing manner. When the business system calls the init function of the cryptographic machine, it will create a session context on one of the cryptographic machines A. If the task needs to process a lot of data and cannot be sent to the cryptographic machine at one time, the cryptographic machine that processes the call needs to maintain the context during multiple updates to ensure that the entire processing process of task T will be sent to cryptographic machine A, and the context is maintained inside cryptographic machine A, where the context contains the current cryptographic operation task. If the business system calls the update function next time and sends it to another cryptographic machine B, there is no relevant session context information in cryptographic machine B, and the processing can only fail. In order to avoid this failure, the existing technical solutions choose connection stickiness or session stickiness. That is, the caller program and which cryptographic machine are inited, then the subsequent calls will be sent to the same cryptographic machine until the final.

[0037] At present, a mainstream password deployment method is the password resource pool. If the password resource pool is not very busy and each request can be processed quickly, then the existing connection stickiness and session stickiness processing methods can also meet the needs of the application system. However, under the technical architecture of intensive deployment of a large number of password resources and unified service provision, if the password processing task is busy, this call model has great disadvantages. For example, the session is established on a specific password resource, such as password machine A, and the next update must be scheduled to password machine A, even if A is very busy or the resource has failed. At this time, password machines B and C cannot perform password functions due to lack of session information. Even if password machines B and C are idle, their computing power cannot provide help for this long task. The scheduling system of the password resource pool can only schedule the establishment of sessions and multiple calls to password functions as a whole, and the computing power can only be coarse-grained, which seriously affects service efficiency.

[0038] In view of this, some embodiments of the present application provide a method for processing cryptographic tasks based on state externalization, in which the scheduling end stores task context information of context information related to the cryptographic task. The scheduling end can send the operation task of the cryptographic task to any cryptographic resource end after receiving it, and send the task context information and the data to be processed at the same time, so that the cryptographic resource end can perform corresponding operations on the data to be processed, obtain the task result and the task context update information, and feed back the task result and the task context update information to the scheduling end, so that the context information can continue to be provided to the cryptographic resource end when other operations of the cryptographic task are subsequently executed. That is to say, the present application proposes a method of "state externalization" to divide a long cryptographic task into multiple short cryptographic tasks, and disconnect the association between these short tasks through the transmission of task context, so that each short task can be processed on any scheduled cryptographic resource. The scheduling end of some embodiments of the present application stores task context information related to the cryptographic task, and can realize accurate service for the cryptographic task by sending the task context information to any cryptographic resource end that performs the operation task, realize the reasonable allocation of the cryptographic resource pool, and improve service efficiency.

[0039] The following is combined with Figure 1 The overall composition structure of a system for cryptographic task processing based on state externalization provided by some embodiments of the present application is exemplified.

[0040] like Figure 1 As shown, some embodiments of the present application provide a system for cryptographic task processing based on state externalization, and the system for cryptographic task processing based on state externalization may include: a scheduling end 100 and multiple cryptographic machines, such as Figure 1 The first cipher machine 101, the second cipher machine 102, ... the Nth cipher machine, N is a positive integer. The scheduling terminal 100 pre-stores or pre-acquires the cipher task T A The task context information corresponding to the initialization context result is obtained. A After receiving the relevant operation task (for example, update), the corresponding task data can be sent to any idle cryptographic machine among the multiple cryptographic machines (as a specific example of the cryptographic resource end), and the task data includes: the operation task, the data to be processed related to the operation task, and the task context information. After receiving the task data, any cryptographic machine can execute the corresponding operation task on it, obtain the task result, and update the task context information to feedback to the scheduling end 100. At this time, the scheduling end 100 can obtain the cryptographic task T AThe task context update information and task result corresponding to the latest context information. When updating again, the task context update information can be given to any cipher machine selected by the scheduling end 100 to continue to execute the corresponding update, and so on, until the cipher task T is completed. A The final operation is performed to obtain the target processing result.

[0041] The following is combined with Figure 2 The implementation process of cryptographic task processing based on state externalization performed by the scheduling terminal 100 provided in some embodiments of the present application is exemplified.

[0042] Please see attached Figure 2 , Figure 2 A flowchart of a method for processing a cryptographic task based on state externalization is provided for some embodiments of the present application. The method for processing a cryptographic task based on state externalization may include:

[0043] S210, receiving an operation task related to the password task, wherein the types of the operation task are update task and termination task.

[0044] For example, in some embodiments of the present application, the scheduling terminal 100 may receive a cryptographic task T A The related update operation (as a specific example of an update task) or the final operation (as a specific example of a termination task).

[0045] It should be noted that before receiving the operation task, a unique identifier within the system scope of the cryptographic task processing is set for each cryptographic task to be processed and each cryptographic resource (that is, the cryptographic machine); the cryptographic resource pool processes the external cryptographic task T A Create a context CTX in the password resource when "Initialize Context" A , serialize the context to get CTX A -SER (as a specific example of task context information), returns CTX to the scheduling module of the cryptographic resource pool (that is, the scheduling terminal 100) A -SER and other information needed to help the resource scheduler to schedule computing power; the scheduler of the cryptographic resource pool (that is, the scheduler 100) receives the result of the initialization context and saves T A and CTX A -SER's association relationship.

[0046] S220, sending task data to the cryptographic resource end, so that the cryptographic resource end executes the operation task on the task data, obtains the task result and task context update information, wherein the task data includes: the operation task, the data to be processed related to the operation task and the task context information of the cryptographic task; the cryptographic resource end is any end in the cryptographic resource pool.

[0047] For example, in some embodiments of the present application, taking the update operation as an example, the scheduling module dispatches the update operation to any cryptographic resource (that is, any end, that is, any cryptographic machine) in the cryptographic resource pool, and sends CTX A -SER and data to be processed. After any cipher receives an update operation request, it uses CTX A -SER establishes the context, performs the cryptographic operation corresponding to the update operation on the data to be processed, and after completion, obtains the task result and the updated CTX corresponding to the context after the re-serialization operation. A -SER (as a specific example of task context update information).

[0048] S230, receiving the task result and the task context update information fed back by the cryptographic resource end, so as to provide context information for other operation tasks of the cryptographic task in the future.

[0049] For example, in some embodiments of the present application, the scheduling module receives the task result and the updated CTX fed back by any cipher machine. A -SER to save password task T A The latest context information (i.e. updated CTX A -SER). When the scheduling module and the cryptographic resource pool receive a subsequent update operation, the implementation process of S220 to S230 can be re-executed.

[0050] In some embodiments of the present application, the method for cryptographic task processing may further include: when the type of the operation task is the termination task, the method further includes: merging the task results corresponding to each update task to obtain the target processing result of the cryptographic task.

[0051] For example, in some embodiments of the present application, the scheduler receives a cryptographic task T A When the final operation of the scheduler 100 is executed, the scheduler 100 receives the cryptographic resource for the cryptographic task T A After the task result of the final operation is obtained, the task results of each operation are combined to obtain the password task T A The final processing result of (as a specific example of the target processing result).

[0052] In some embodiments of the present application, the task context update information is obtained by the cryptographic resource end updating the intermediate result field, the unprocessed field and the data length field in the task context information.

[0053] For example, in some embodiments of the present application, taking SM3 summary calculation as an example, the task context information may include: intenalData (as a specific example of the intermediate result field), restPlainLen and restData (as a specific example of the unprocessed field), and totalLen (as a specific example of the data length field). Among them, intenalData represents the intermediate result (i.e., the task result) that has been calculated by the cryptographic resource, restPlainLen and restData represent the data that cannot be processed, such as the data that cannot be completely grouped when the data to be processed is grouped; totalLen represents the total length of the data after processing.

[0054] The following is combined with Figure 3 The specific process of cryptographic task processing based on state externalization performed by any cryptographic resource end provided in some embodiments of the present application is exemplified. Among them, any cryptographic resource end (i.e., any cryptographic machine hereinafter) can be selected by the scheduling end 100 after analyzing the busy conditions of multiple cryptographic resources (e.g., whether they are idle, resource occupancy conditions, or task queue conditions).

[0055] Please see attached Figure 3 , Figure 3 A flowchart of a method for processing a cryptographic task based on state externalization is provided for some embodiments of the present application. The method for processing a cryptographic task based on state externalization may include:

[0056] S310, receiving task data sent by the scheduling end, wherein the task data includes: an operation task related to a cryptographic task, to-be-processed data related to the operation task, and task context information related to the cryptographic task.

[0057] For example, in some embodiments of the present application, any cryptographic machine may receive an update operation, CTX sent by the scheduling module. A -SER and pending data.

[0058] S320, executing the operation task on the task data, obtaining a task result, and updating the task context information to obtain task context update information.

[0059] For example, in some embodiments of the present application, after any cryptographic machine receives an update operation request, it performs a corresponding operation on the task data to obtain the task result and the updated CTX.A -SER.

[0060] S330, sending the task result and the task context update information to the scheduling end, so that the scheduling end can subsequently provide context information for other operation tasks of the cryptographic task.

[0061] For example, in some embodiments of the present application, the cryptographic resource may send the task result and the updated CTX to the scheduler. A -SER.

[0062] Finally, after the cryptographic resource completes the final operation, the scheduler (or external caller) merges the results of multiple updates and final operations into the final processing result.

[0063] The following takes the SM3 summary calculation process as an example to illustrate the specific implementation process of S320.

[0064] In some embodiments of the present application, S320 may include:

[0065] S321, grouping the data to be processed and the unprocessed data in the task context information to obtain grouped data and ungrouped data; executing the operation task on the grouped data to obtain the task result.

[0066] For example, in some embodiments of the present application, in the case of cryptographic computing power pooling, if a cryptographic task T that needs to be split into multiple SM3 digest calculations is completed, A , cross-device task scheduling is required, and the returned context serialized data contains the context data (i.e., task context information) required for the task to run across devices, but does not include the final processing result of the SM3 calculation. Among them, contextData includes:

[0067] SM3Context:

[0068] unsigned char

[32] intenalData;

[0069] unsigned int restPlainLen

[0070] unsigned char restData[restPlainLen];

[0071] unsigned int totalLen;

[0072] }

[0073] Among them, intenalData represents the intermediate result that has been calculated by the cryptographic resource, restPlainLen and restData represent the data that cannot be processed, for example, when the data to be processed is grouped, the data cannot be completely grouped, and totalLen represents the total length of the data for SM3.

[0074] In a complete multiple SM3 call process, the context processing methods include:

[0075] After init, in contextData, the data of internalData is {0x73, 0x80, 0x16, 0x6F, 0x49, 0x14, 0xB2, 0xB9, 0x17, 0x24, 0x42, 0xD7, 0xDA, 0x8A, 0x06, 0x00, 0xA9, 0x6F, 0x30, 0xBC, 0x16, 0x31, 0x38, 0xAA, 0xE3, 0x8D, 0xEE, 0x4D, 0xB0, 0xFB, 0x0E, 0x4E}; restPlainLen and totalLen are set to 0, and restData is set to empty.

[0076] When the scheduler of the password resource pool sets CTX A -SER and the next update operation or final operation are assigned to a cryptographic resource (that is, any cryptographic machine), after receiving the update, the cryptographic resource uses internalData as the starting value of its internal state for subsequent processing. The subsequent processing process includes: grouping and calculating the restData in internalData (as the unprocessed data in the task context information) and the data to be processed this time. For example, the group length can be 512 bits. For example, in SM3, the group length is 64 bytes, and the length of the data to be processed is 200 bytes. Then this update processing process processes 3 groups, that is, 192 bytes (that is, grouped data), and the remaining 8 bytes are ungrouped data. After grouping, the grouped data is updated this time to obtain the task result.

[0077] S322, by updating the task result to the intermediate result field of the task context information, updating the ungrouped data and the length of the ungrouped data to the unprocessed field in the task context information, and updating the length of the grouped data to the data length field of the task context information, the task context update information is obtained.

[0078] For example, in some embodiments of the present application, the new internal state (as a specific example of the task result) calculated for the packet data is output to the intenalData of contextData; the remaining 8 bytes are placed in restData, and restPlainLen is set to 8; the length of the data processed by this update operation is added to totalLen, and the updated CTX is obtained by updating and replacing the above fields. A -SER.

[0079] After receiving the final operation, the cryptographic resource performs the following processing: calculates the SM3 data filling value based on the totalLen in the contextData; groups and calculates the restData in the contextData, the data to be processed this time, and the filling value of the SM3 data, and outputs the task result of the last data block corresponding to the final operation.

[0080] It should be noted that the implementation process of other digest cryptographic algorithms, such as SHA1, SHA224, SHA256, and SHA3, is similar to the above. Their contextData varies with the algorithm. To avoid repetition, they are not described here.

[0081] The following takes the SM4 / CBC calculation process as an example to illustrate the specific implementation process of S320.

[0082] In the case of cryptographic computing power pooling, if an SM4 / CBC encryption or decryption calculation that needs to be split into multiple calculations is completed, contextData is defined as follows:

[0083] SM4Context:

[0084] unsigned char

[16] lastBlockEnc;

[0085] unsigned int restPlainLen;

[0086] unsigned char restData[restPlainLen];

[0087] }

[0088] Among them, contextData contains the context data required for the task to run across devices, and lastBlockEnc plays two roles: one is to serve as the encryption result of this block of plaintext data (that is, the task result), and the other is to provide the IV value for the next encryption operation of CBC chain encryption; restData contains the plaintext data that failed to form a complete group and therefore could not be encrypted during the last operation (that is, unprocessed data), and restPlainLen is the length of the plaintext data.

[0089] During init, the returned plaintext data and contextData contain the IV value provided by the calling module, and other fields (such as restData, restPlainLen, etc.) are empty or 0.

[0090] After the cryptographic resource receives the update operation instruction, the process of cryptographic task processing based on state externalization includes: grouping and calculating the restData in contextData and the data to be processed this time (for example, the group length can be 128 bits). After this update operation, the new ciphertext (that is, the task result) is output to the IV of contextData; the ungrouped data and its length that failed to be grouped during this update operation are output to the restData and restPlainLen variables. For example, in SM4, the group length is 16 bytes, and the length of the unprocessed data and the data to be processed in restData is 100 bytes. Then this update process processes 6 groups, that is, 96 bytes (that is, grouped data), and the remaining 4 bytes (that is, ungrouped data) are placed in restData, and restPlainLen is set to 4. By re-serializing the Context-related fields after updating, CTX can be implemented. A -Update of SER.

[0091] In actual applications, when the scheduler of the password resource pool sends the context CTX A -SER and the next update or final is assigned to another password resource, the password resource is assigned to this CTX A- The new data to be processed corresponding to the IV, update or final operation in SER are encrypted in groups. If restPlainLen in contextData is a non-zero positive integer, the unprocessed data in restData and the new data to be processed are grouped together to obtain the result of this task. Until the cryptographic resource receives the final operation, the plaintext (i.e., the data to be processed) is padded for grouping, and the encryption result of the last block of plaintext of the cryptographic task (i.e., the task result) is output. The external calling module can finally connect all the ciphertext blocks (i.e., the encryption results) into the overall encryption result (i.e., the cryptographic task T A final processing result).

[0092] It should be noted that the calculation process of other digest cryptographic algorithms, such as AES, SM1 and SM4 / CBC, is similar, and their contextData varies with the algorithm mode. For different modes of the same algorithm, such as CTR, GCM, OFB, etc., the content of contextData may also be slightly different.

[0093] Based on the same method as above, the serialized data of digital signature and MAC calculation long tasks can also be obtained when they are scheduled across devices. Similarly, the above-mentioned technology is also applicable to a scenario where a cryptographic device is installed with multiple cryptographic cards and multiple cryptographic chips that need to handle long task scheduling; that is, the calling program of the cryptographic device can send the operation task corresponding to the cryptographic task to any cryptographic card or any cryptographic chip, and complete the processing of the cryptographic task in an implementation method similar to the above principle. It should be understood that the application scenarios and related algorithms used in the embodiments of the present application can be selected according to actual conditions, and the embodiments of the present application are not limited to this.

[0094] In some embodiments of the present application, in order to ensure the security of task context information transmission, the task context information may also be encrypted for transmission.

[0095] Specifically, the cryptographic resources in the cryptographic resource pool all contain a unified scheduling task protection key TDK. TDK is calculated to obtain TD-MACKEY and TD-ENCKEY through a key derivation mechanism. The key derivation mechanism can be based on a hash or symmetric cryptographic algorithm, for example:

[0096] TD-MACKEY = enc(TDK, "MAC" | TEXT1), where TEXT1 is a text of your choice, and the values ​​of each password resource should be kept consistent;

[0097] TD-ENCKEY=enc(TDK, "ENC" | TEXT2), where TEXT2 is a text of your choice, and the values ​​of each password resource should be kept consistent.

[0098] Serialize data CTX in the returned task context A -SER, CTX can be adjusted according to actual needs A -SER performs MAC (Message Authentication Code) calculation to obtain integrity verification data I = MAC (TD-MACKEY, CTX-SER | cryptographic resource identifier | processing time), where MAC is the identifier message check code algorithm. When the cryptographic resource is returned to the scheduling module, the returned data includes CTX A -SER, cryptographic resource identifier, processing time and I. When the cryptographic resource for subsequent operation task processing receives this data, it can verify the integrity of the context data to prevent the context from being tampered with. A -SER, you can adjust CTX as needed. A -SER performs encryption protection, for example, C = ENC (TD-ENCKEY, CTX A -SER); then returns C, the unique identifier of the cryptographic resource, and the processing time to the scheduling module.

[0099] It should be noted that the protection mechanism for task context information can be encrypted and protected by a related cryptographic algorithm, or a verification algorithm (e.g., checksum) and an XOR algorithm can be used instead of a MAC and encryption algorithm. The specific method can be selected according to the actual application scenario, and the embodiments of the present application are not specifically limited here. It should be understood that whether to encrypt the task context information and other related data can be selected, and the embodiments of the present application are not specifically limited here. In one embodiment, the scheduling module and the cryptographic resources are transmitted in a trusted network, and the transmission can be performed without encryption; if the network for the transmission of the two is untrustworthy, data encryption transmission can be performed to improve security.

[0100] In addition, in some embodiments of the present application, the cryptographic resource can choose to cache the context information (i.e., task context information) that has been established and processed for a period of time, and reclaim the space if the set time is exceeded. When the cryptographic resource pool scheduling module receives an external update or final cryptographic operation request that needs to be assigned to the cryptographic resource, under the same circumstances, according to the resourceID in the response-info, the subsequent operation of the long cryptographic task is preferentially assigned to the cryptographic resource represented by the resourceID (i.e., it is judged by the time when the cryptographic resource returned the result during the last operation and the cache duration strategy of the system), and then consider assigning it to another cryptographic resource when the cryptographic resource is busy or fails; that is, a certain update operation of the long cryptographic task is assigned to the cryptographic machine A. If the cryptographic machine A is busy or fails, the operation task of the cryptographic task can be subsequently assigned to other cryptographic machines. After the cryptographic resource receives the subsequent operation request, if it finds that the CTX_ID is in its own cache, it takes out the context data for processing the operation request from the cache for processing, thereby improving the processing efficiency of the cryptographic task.

[0101] The specific process of cryptographic task processing based on state externalization provided by some embodiments of the present application is exemplified below.

[0102] S401, a cryptographic resource creates context information of a cryptographic task, and performs context informationization on the context information to obtain task context information.

[0103] S402, the cryptographic resource sends task context information to the scheduling module.

[0104] S403, the scheduling module stores the association between the cryptographic task and the task context information.

[0105] S404, the scheduling module receives an update operation related to the password task.

[0106] S405, the scheduling module assigns the update operation to the cryptographic resources in the cryptographic resource pool, and sends the task context information and the data to be processed to the cryptographic resources.

[0107] S406, the cryptographic resource receives the update operation, task context information and data to be processed.

[0108] S407, the cryptographic resource uses the task context information to construct the context information of the cryptographic task, performs an update operation on the data to be processed, obtains the task result, and serializes the newly obtained context information to obtain task context update information.

[0109] S408, the cryptographic resource sends the task result and task context update information to the scheduling module.

[0110] When the subsequent operation is still an update operation, the implementation process of the above S404 to S408 is repeated. When the operation received by the scheduling module is a final operation, S409 to S411 are executed.

[0111] S409, the scheduling module assigns the final operation to the cryptographic resources in the cryptographic resource pool, and sends the task context update information and the data to be processed at the same time.

[0112] S410, the cryptographic resource receives the final operation, uses the task context update information to construct context information, performs the final operation on the data to be processed, and obtains the task result.

[0113] S411, the scheduling module receives the task results sent by the cryptographic resources; merges all the task results to obtain the final processing results corresponding to the cryptographic tasks.

[0114] It should be noted that the specific implementation process of S401 to S411 can refer to the method embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0115] Through some of the above-mentioned embodiments of the present application, it can be seen that the scheduling module of the present application only needs to hand over the "multiple calls" of long cryptographic tasks to the available cryptographic resources as agreed. Designers and implementers do not need to pay attention to the content, nor do they need to have various knowledge of cryptography, forming an "ALL-to-ALL" calling mode between devices and services. It supports scheduling tasks to other idle cryptographic resources when a single device (i.e., a cryptographic machine) is heavy with tasks, without being restricted by the session mechanism, thereby optimizing resource utilization and providing on-demand cryptographic computing power for the business.

[0116] Please refer to Figure 4 , Figure 4 The block diagram of the composition of the device for cryptographic task processing based on state externalization provided by some embodiments of the present application is shown. It should be understood that the device for cryptographic task processing based on state externalization corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the device for cryptographic task processing based on state externalization can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0117] Figure 4The device for cryptographic task processing based on state externalization includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the device for cryptographic task processing. The device for cryptographic task processing based on state externalization is applied to a scheduling end, and includes: a task receiving module 410, configured to receive an operation task related to a cryptographic task; a task distribution module 420, configured to send task data to a cryptographic resource end, so that the cryptographic resource end performs the operation task on the task data, obtains task results and task context update information, wherein the task data includes: the operation task, data to be processed related to the operation task, and task context information of the cryptographic task; the cryptographic resource end is any end in a cryptographic resource pool; a result receiving module 430, configured to receive the task result and the task context update information fed back by the cryptographic resource end, so as to provide context information for other operation tasks of the cryptographic task in the future.

[0118] Please refer to Figure 5 , Figure 5 The block diagram of the composition of the device for cryptographic task processing based on state externalization provided by some embodiments of the present application is shown. It should be understood that the device for cryptographic task processing based on state externalization corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the device for cryptographic task processing based on state externalization can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0119] Figure 5 The device for cryptographic task processing based on state externalization includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the device for cryptographic task processing based on state externalization. The device for cryptographic task processing based on state externalization is applied to any cryptographic resource end in a cryptographic resource pool, including: a data receiving module 510, configured to receive task data sent by a scheduling end, wherein the task data includes: an operation task related to the cryptographic task, data to be processed related to the operation task, and task context information of the cryptographic task; a task execution module 520, configured to execute the operation task on the task data, obtain the task result, and update the task context information to obtain the task context update information; a result sending module 530, configured to send the task result and the task context update information to the scheduling end, so that the scheduling end can subsequently provide context information for other operation tasks of the cryptographic task.

[0120] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0121] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0122] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0123] like Figure 6 As shown, some embodiments of the present application provide an electronic device 600, which includes: a memory 610, a processor 620, and a computer program stored in the memory 610 and executable on the processor 620, wherein the processor 620 can implement a method as described in any of the above embodiments when reading the program from the memory 610 through a bus 630 and executing the program.

[0124] Processor 620 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 620 can be a microprocessor.

[0125] The memory 610 may be used to store instructions executed by the processor 620 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 620 of the disclosed embodiment may be used to execute instructions in the memory 610 to implement the method shown above. The memory 610 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0126] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0127] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0128] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for cryptographic task processing based on state externalization, characterized in that: Applied to the dispatching end, the method includes: Receive operational tasks related to cryptographic tasks; Sending task data to a cryptographic resource end so that the cryptographic resource end performs the operation task on the task data and obtains task results and task context update information, wherein the task data includes: the operation task, data to be processed related to the operation task, and task context information related to the cryptographic task; the cryptographic resource end is any end in a cryptographic resource pool; The task result and the task context update information fed back by the cryptographic resource end are received, so as to provide context information for other operation tasks of the cryptographic task in the future.

2. The method according to claim 1, characterized in that The type of the operation task is an update task and a termination task; when the type of the operation task is the termination task, the method further includes: The task results corresponding to each update task are merged to obtain the target processing result of the password task.

3. The method according to claim 1 or 2, characterized in that The task context update information is obtained by the cryptographic resource end updating the intermediate result field, the unprocessed field and the data length field in the task context information.

4. A method for cryptographic task processing based on state externalization, characterized in that: Applied to any cryptographic resource end in a cryptographic resource pool, the method comprises: Receiving task data sent by the scheduling end, wherein the task data includes: an operation task related to the cryptographic task, data to be processed related to the operation task, and task context information related to the cryptographic task; Executing the operation task on the task data, obtaining a task result, and updating the task context information to obtain task context update information; The task result and the task context update information are sent to the scheduling end, so that the scheduling end can subsequently provide context information for other operation tasks of the cryptographic task.

5. The method according to claim 4, characterized in that The performing the operation task on the task data to obtain the task result includes: Grouping the data to be processed and the unprocessed data in the task context information to obtain grouped data and ungrouped data; The operation task is performed on the grouped data to obtain the task result.

6. The method according to claim 5, characterized in that The updating of the task context information to obtain task context update information includes: The task context update information is obtained by updating the task result to the intermediate result field of the task context information, updating the ungrouped data and the length of the ungrouped data to the unprocessed field in the task context information, and updating the length of the grouped data to the data length field of the task context information.

7. The method according to any one of claims 4 to 6, characterized in that Before receiving the task data sent by the scheduling end, the method further includes: creating context information corresponding to the cryptographic task; Processing the context information to generate the task context information; The task context information is sent to the scheduling end so that the scheduling end stores the association relationship between the cryptographic task and the task context information.

8. A device for cryptographic task processing based on state externalization, characterized in that: Applied to the dispatching end, including: A task receiving module, configured to receive an operation task related to a password task; The task distribution module is configured to send task data to the cryptographic resource end, so that the cryptographic resource end performs the operation task on the task data and obtains the task result and task context update information, wherein the task data includes: the operation task, the data to be processed related to the operation task and the task context information related to the cryptographic task; the cryptographic resource end is any end in the cryptographic resource pool; The result receiving module is configured to receive the task result and the task context update information fed back by the cryptographic resource end, so as to provide context information for other operation tasks of the cryptographic task in the future.

9. A device for cryptographic task processing based on state externalization, characterized in that: Applicable to any password resource end in the password resource pool, including: A data receiving module is configured to receive task data sent by the scheduling end, wherein the task data includes: an operation task related to the cryptographic task, data to be processed related to the operation task, and task context information related to the cryptographic task; A task execution module is configured to execute the operation task on the task data, obtain the task result, and update the task context information to obtain task context update information; The result sending module is configured to send the task result and the task context update information to the scheduling end, so that the scheduling end can subsequently provide context information for other operation tasks of the cryptographic task.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 7 when executed by a processor.

11. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 7 when being run by the processor.

12. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 7 when executed by a processor.

Images