Secret key processing method, secret key processing device and related equipment

Abstract

The invention discloses a key processing method. The key processing method is applied to a management system. And the management system is connected with the service system, and manages the cryptographic equipment according to the key index. And the management system obtains a first key operation instruction sent by a first service system in the service systems, and sends a second key operation instruction to the first password device according to the first key information. The second key operation instruction comprises a first key index and a first operation type. The first key index is the index of the first key corresponding to the first key information. The second key operation instruction is used for indicating the first password device to execute the operation of the first operation type on the first key. And the management system obtains a first key operation result fed back by the first cryptographic device. Therefore, by using the key index, the management system can realize cross-device and cross-cluster key management, and the requirement of unified management of keys in a large-scale service scene can be met.

Description

[0001] This application claims the priority of the Chinese patent application filed with the China Patent Office on June 27, 2023, with application number 202310770039.0 and application name “A method, device and other equipment for key management”, the entire contents of which are incorporated by reference in this application. Technical Field

[0002] The present application relates to the field of cloud computing technology, and in particular to a key processing method, device and related equipment. Background Art

[0003] In current business scenarios, there is a need to encrypt data with high security requirements. Data encryption scenarios include business scenarios such as data storage, data transmission, identity authentication, and data integrity protection. For business scenarios with high security and high-performance encryption requirements, cryptographic devices are usually used to implement key management and cryptographic operations. Cryptographic devices include hardware devices such as cryptographic cards, cryptographic machines, and signature verification servers.

[0004] At present, cryptographic devices usually manage the keys stored in the devices. However, in large-scale encryption business scenarios, the number of keys involved is large, and it is difficult to implement cross-device key management. The current device-dimensional key management method is difficult to meet the needs of large-scale encryption business scenarios. Summary of the invention

[0005] The embodiments of the present application provide a key processing method, apparatus and related equipment, which can be applied to a management system connected to a business system. The management system can use key indexes to manage cryptographic devices, implement cross-device key management, and meet the needs of unified key management in large-scale encrypted business scenarios.

[0006] In a first aspect, the present application provides a key processing method applied to a management system. The management system is connected to a business system. The management system manages a cryptographic device according to a key index. The management system obtains a first key operation instruction sent by a first business system. The first business system is one of the business systems connected to the management system. The first key operation instruction includes first key information and a first operation type. The first key information is used to determine the first key to be processed. The first operation type is an operation type for operating the first key. The management system generates a second key operation instruction according to the first key information. The second key operation instruction includes a first key index and a first operation type. The first key index is an index of the first key corresponding to the first key information. The first key index is a unique index of the first key. The management system sends a second key operation instruction to the first cryptographic device. The second key operation instruction is used to instruct the first cryptographic device to perform an operation of the first operation type on the first key. The first cryptographic device is one of the cryptographic devices managed by the management system. As an example, the first cryptographic device can be determined by the management system based on the operation needs of the second key operation instruction for the first key. As another example, the first key information includes an identifier of the first cryptographic device. The management system determines the first cryptographic device based on the identifier of the first cryptographic device included in the first key information. The management system obtains the first key operation result fed back by the first cryptographic device, and implements subsequent management of the first key and the first cryptographic device based on the first key operation result.

[0007] The management system manages cryptographic devices using key indexes, and can manage cryptographic devices across devices and clusters. In addition, using key indexes that uniquely correspond to keys, it can achieve global perception and management of keys, meeting the needs of key use and management in large-scale scenarios.

[0008] In some possible implementations, the number of business systems connected to the management system is multiple. That is, the quantitative relationship between the management system and the business systems is one-to-one, or one-to-many. The business systems connected to the management system include a second business system. The management system obtains a third key operation instruction sent by the second business system. The third key operation instruction includes second key information and a second operation type. The management system sends a fourth key operation instruction to the second cryptographic device according to the second key information. The fourth key operation instruction includes a second key index and a second operation type. The second key index is an index of the second key corresponding to the second key information. The fourth key operation instruction is used to instruct the second cryptographic device to perform a second operation type operation on the second key. Among them, the second cryptographic device is one of the cryptographic devices managed by the management system. The second cryptographic device can be determined by the management system based on the second key operation instruction, or based on the cryptographic device identifier included in the first key information. The management system obtains the second key operation result fed back by the second cryptographic device, and implements subsequent management of the second key and the second cryptographic device based on the second key operation result.

[0009] In some possible implementations, after the management system obtains the first key operation result fed back by the first cryptographic device, the key management information of the key index is updated according to the first key operation. The key management information includes information related to the key. The key management information includes one or more of a key ID, a key algorithm name, a key type, and a key version. The management system can manage the life cycle of the key based on the key management information.

[0010] In some possible implementations, the first operation type includes one or more of a creation type, a query type, an update type, and a deletion type.

[0011] In some possible implementations, the first operation type is a creation type. That is, the second key operation instruction is used to instruct the first cryptographic device to create a first key corresponding to the first key index. After obtaining the first key operation result fed back by the first cryptographic device, the management system records the generated first key index into the key management information of the key index. In this way, the key management information is updated in a timely manner, which facilitates the management system to determine the key status based on the key management information and also facilitates the management system to manage the key.

[0012] In some possible implementations, the management system controls the first cryptographic device to synchronize the first key. The management system sends a key synchronization instruction to the first cryptographic device. The key synchronization instruction includes a first key index. The key synchronization instruction is used to instruct the first cryptographic device to synchronize the first key corresponding to the first key index to the third cryptographic device. In this way, synchronization of the first key between the cryptographic devices can be achieved.

[0013] In some other possible implementations, the management system can implement key backup. The management system obtains a key backup instruction including a first key index sent by a fourth cryptographic device. The management system obtains the first key corresponding to the first key index from the first cryptographic device, and sends the first key to the fourth cryptographic device. The present application does not limit the manner in which the management system obtains the first key corresponding to the first key index from the first cryptographic device. As an example, after the management system creates the first key in the first cryptographic device, it obtains the first key from the first key operation result sent by the first cryptographic device. As another example, after obtaining the key backup instruction, the management system queries whether the first key corresponding to the first key index is created by the first cryptographic device. The management system obtains the first key from the first cryptographic device.

[0014] Key synchronization and key backup can meet the needs of scenarios that require key migration, such as application migration and adding new cryptographic devices, decoupling business applications from local hardware that stores keys, and expanding the scope of applicable scenarios. In addition, synchronizing keys or backing up keys can improve the reliability of keys and ensure that keys can be recovered. It can also reduce the execution process of creating the same key by other cryptographic devices, simplifying the complexity of key management.

[0015] In some possible implementations, the cryptographic device is a physical functional device. The cryptographic device includes multiple virtual functional devices obtained after virtualization processing. Multiple keys corresponding to the key index are associated with multiple virtual functional devices through the belonging index. In this way, the virtual functional device associated with the key can be determined based on the belonging index, and the virtual functional device can call the associated key. There is no need to store the same key in different virtual functional devices, which saves the storage space of the key, improves the efficiency of key management, and saves space costs.

[0016] In some possible implementations, the management system can also adjust the virtual function device corresponding to the key in the cryptographic device. The management system sends a key adjustment instruction to the first cryptographic device. The key adjustment instruction is used to instruct the first cryptographic device to adjust the distribution of the first key in the virtual function device of the first cryptographic device, and update the attribution index associated with the first key. The attribution index can be used to dynamically adjust the association between the key and the virtual function device, and avoid storing the same key in different virtual function devices, thereby reducing the space occupied by the key and saving costs.

[0017] In the second aspect, the present application provides a key processing device, which is applied to a management system, which is connected to a business system, and which manages cryptographic devices according to a key index. The device includes: an acquisition module, which is used to acquire a first key operation instruction sent by a first business system in the business system, wherein the first key operation instruction includes first key information and a first operation type; a sending module, which is used to send a second key operation instruction to a first cryptographic device according to the first key information, wherein the second key operation instruction includes a first key index and the first operation type, wherein the first key index is an index of a first key corresponding to the first key information, and the second key operation instruction is used to instruct the first cryptographic device to perform the first operation type operation on the first key; the acquisition module is also used to acquire a first key operation result fed back by the first cryptographic device.

[0018] In some possible implementations, the acquisition module is further used to acquire a third key operation instruction sent by a second business system in the business system, wherein the third key operation instruction includes second key information and a second operation type; the sending module is further used to send a fourth key operation instruction to the second cryptographic device based on the second key information, wherein the fourth key operation instruction includes a second key index and the second operation type, wherein the second key index is an index of the second key corresponding to the second key information, and the fourth key operation instruction is used to instruct the second cryptographic device to perform the second operation type operation on the second key; the acquisition module is further used to acquire a second key operation result fed back by the second cryptographic device.

[0019] In some possible implementations, the device further includes:

[0020] An update module is used to update the key management information of the key index according to the first key operation result, and the key management information includes one or more of the following: key ID, key algorithm name, key type, and key version.

[0021] In some possible implementations, the first operation type includes one or more of the following: a creation type, a query type, an update type, and a deletion type.

[0022] In some possible implementations, the first operation type is the creation type, and the apparatus further includes:

[0023] A recording module is used to record the generated first key index into the key management information of the key index.

[0024] In some possible implementations, the sending module is further used to send a key synchronization instruction to the first cryptographic device, where the key synchronization instruction includes the first key index, and the key synchronization instruction is used to synchronize the first key corresponding to the first key index to a third cryptographic device.

[0025] In some possible implementations, the acquisition module is further used to acquire a key backup instruction of a fourth cryptographic device, where the key backup instruction includes the first key index;

[0026] The acquisition module is further used to acquire the first key corresponding to the first key index from the first cryptographic device;

[0027] The sending module is further used to send the first key to the fourth cryptographic device.

[0028] In some possible implementations, the cryptographic device is a physical functional device, the cryptographic device includes a plurality of virtual functional devices, and the plurality of keys corresponding to the key index are associated with the plurality of virtual functional devices through a belonging index.

[0029] In some possible implementations, the sending module is further used to send a key adjustment instruction to the first cryptographic device, where the key adjustment instruction is used to instruct the first cryptographic device to adjust the distribution of the first key in the virtual function device of the first cryptographic device and update the belonging index associated with the first key.

[0030] In a third aspect, the present application provides a computing device cluster, the computing device includes at least one computing device, the at least one computing device includes at least one processor and at least one memory; the at least one memory is used to store instructions, and the at least one processor executes the instructions stored in the at least one memory, so that the computing device cluster executes the key processing method in the above-mentioned first aspect or any possible implementation of the first aspect. It should be noted that the memory can be integrated into the processor or can be independent of the processor. The at least one computing device may also include a bus. The processor is connected to the memory via a bus. The memory may include a readable memory and a random access memory.

[0031] In a fourth aspect, the present application provides a computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is executed on at least one computing device, the at least one computing device executes the method described in the first aspect or any one of the implementations of the first aspect.

[0032] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on at least one computing device, enables the at least one computing device to execute the method described in the first aspect or any one of the implementations of the first aspect.

[0033] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of an exemplary cryptographic device and server architecture provided in an embodiment of the present application;

[0035] Figure 2 A schematic diagram of a mapping relationship between a service node and a virtual cryptographic device provided in an embodiment of the present application;

[0036] Figure 3 A schematic diagram of a system architecture provided for an embodiment of the present application;

[0037] Figure 4 A schematic diagram of the structure of a system provided in an embodiment of the present application;

[0038] Figure 5 A schematic diagram of the interaction process between the first business system, the management system and the first cryptographic device provided in an embodiment of the present application;

[0039] Figure 6 A flowchart of a key processing method provided in an embodiment of the present application;

[0040] Figure 7 A structural schematic diagram of a key processing method and device is also provided for an embodiment of the present application;

[0041] Figure 8 A schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0042] Fig. 9 A schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0043] Fig.10 A schematic diagram of a connection method for computing devices in a computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The scheme in the embodiments provided in this application will be described below in conjunction with the drawings in this application.

[0045] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances. This is just a way of distinguishing objects with the same attributes when describing the embodiments of this application.

[0046] In business scenarios with high security and high-performance encryption requirements, independent hardware security modules (HSM) are usually used to implement cryptographic operations and key management. HSM is a tamper-proof and intrusion-proof hardware component used to improve the security protection of cryptographic operations and store encryption keys. HSM can provide authorized users with the service of using and managing keys while ensuring the security of the cryptographic operation process. HSM is mainly divided into two forms: peripheral component interconnect (PCI) board or server cryptographic machine. The PCI board form is, for example, a high-speed peripheral component interconnect (PCIE) cryptographic card. The server cryptographic machine form is, for example, a cryptographic machine and a signature verification server. Such devices with certain cryptographic functions or capable of completing certain cryptographic tasks can also be called cryptographic devices.

[0047] At present, cryptographic devices mainly use key index tables to manage keys in cryptographic devices. Each key has an independent index within the management scope of the cryptographic device. The cryptographic device manages the keys and key indexes stored in the device. In this way, in cloud scenarios or big data scenarios, it is difficult to perform cross-device processing operations such as key query between different cryptographic devices, and it is difficult to achieve unified key management.

[0048] In addition, in some business scenarios, cryptographic devices need to be virtualized. A cryptographic device with a physical function (PF) is virtualized into multiple cryptographic devices with virtual functions (VF) to meet the needs of large-scale cryptographic use and key management. Among them, the cryptographic device of PF can also be called a physical cryptographic device, and the cryptographic device of VF can be called a virtual cryptographic device.

[0049] As an example, see Figure 1As shown, this figure is a schematic diagram of the architecture of an exemplary cryptographic device and a server provided in an embodiment of the present application. The server is used to provide service resources or application resources to users. The server is connected to M physical cryptographic devices. The physical cryptographic device is used to manage device keys, cluster keys, and manufacturer keys. Each physical cryptographic device can be virtualized into N virtual cryptographic devices through virtualization methods such as virtualization technology (Single-Root I / O Virtualization, SR-IOV). The virtual cryptographic device is used to manage key encryption keys (Key Encryption Key, KEK), data encryption keys (Data Encryption Key, DEK), public-private key pairs, and card root keys.

[0050] The virtual cryptographic device is called by service resources or application resources to provide cryptographic operations and key management services.

[0051] The virtual cryptographic device is assigned to the business nodes included in the required business system. Figure 2 As shown, the figure is a schematic diagram of a mapping relationship between a business node and a virtual cryptographic device provided in an embodiment of the present application. Each business node is allocated A virtual cryptographic devices as needed. Each virtual cryptographic device is allocated B number of keys to provide cryptographic operations and key management services for the business node.

[0052] However, the keys and key indexes included in the virtual cryptographic devices in each physical cryptographic device are independent of each other. When different virtual cryptographic devices need to use the same key, each virtual cryptographic device using the key needs to store the same key and key index, resulting in repeated storage of the same key in different virtual cryptographic devices, wasting storage space.

[0053] Based on this, an embodiment of the present application provides a key processing method. The key processing method can be applied to a management system. The management system is connected to a business system. The management system manages a cryptographic device based on a key index. The management system obtains a first key operation instruction sent by a first business system in the business system. The first business system is one of the business systems to which the management system is connected. The first key operation instruction includes first key information and a first operation type. The management system sends a second key operation instruction to the first cryptographic device based on the obtained first key operation instruction. The first cryptographic device is one of the cryptographic devices managed by the management system. The second key operation instruction includes a first key index and a first operation type. The first key index is an index of the first key corresponding to the key information. The second key operation instruction is used to instruct the first cryptographic device to perform an operation of the first operation type on the first key. The management system obtains a first key operation result fed back by the first cryptographic device.

[0054] The management system manages cryptographic devices based on the key index. The key index is a unique index for each key generated by the management system. The management system uses the unique key index to achieve global key management across devices and clusters. It is no longer limited to key management within a single device, and can meet the needs of unified key management in large-scale business scenarios.

[0055] The following is an introduction to the system involved in the key processing method provided in the embodiment of the present application. The system can be applied to cloud computing, big data, storage, database and other scenarios involving key management.

[0056] The key processing method provided in the embodiment of the present application can be applied to Figure 3 The system architecture shown in the figure. The system includes hardware devices, a platform layer, a service layer, and an application layer. The hardware devices of the system include physical cryptographic devices that support virtualization, build multiple virtual cryptographic devices, and map the virtual cryptographic devices to information technology (IT) resources. At the platform layer, the key creation and life cycle management capabilities of the virtual cryptographic devices are realized based on the management system, and the key synchronization and management capabilities between cryptographic devices are supported. The service layer integrates the virtual cryptographic devices into the service process as needed to realize encryption operations, key management and other capabilities. The application layer supports applications to directly connect to cryptographic devices to manage keys based on tools, and can also reuse key management capabilities to achieve rapid management of keys.

[0057] See also Figure 4 As shown, this figure is a structural diagram of a system provided in an embodiment of the present application. The system includes multiple business systems and a management system. Multiple business systems are connected to the management system. The business system has multiple cryptographic devices. The cryptographic devices are virtualized to obtain multiple virtual function devices. The management system is used to manage the cryptographic devices of the business system. It should be noted that the management system can manage the cryptographic devices of one or more business systems, and this embodiment of the present application does not limit this. The embodiment of the present application also does not limit the specific type of cryptographic device, such as a cryptographic card, a cryptographic machine, or a signature verification server and other devices that support virtualization.

[0058] Next, various non-limiting specific implementations of the key processing method are described in detail.

[0059] The key processing method provided in the embodiment of the present application can be applied to a management system. Figure 4 The structure of the system shown is described as an example.

[0060] See also Figure 5As shown, the figure is a schematic diagram of the interaction process of the first business system, the management system and the first cryptographic device provided in the embodiment of the present application. The key processing method provided in the embodiment of the present application includes the following steps:

[0061] Step S501: The first business system generates a first key operation instruction.

[0062] The first business system is one of the business systems connected to the management system. When the first business system processes password-related business, it is necessary to operate the key and generate a first key operation instruction. The first key operation instruction includes first key information and a first operation type. The first key information corresponds to the first key that needs to be operated. The first operation type is the type of operation that needs to be performed on the first key corresponding to the first key information. The first key operation instruction is used to instruct the operation of the operation type to be performed using the first key corresponding to the first key information.

[0063] The first key information and the first operation type are determined based on business needs. As an example, the first key information includes a key type. For example, the key type includes a key encryption key (Key Encryption Key, KEK) or a data encryption key (Data Encryption Key, DEK). As another example, the first key information includes a first key index. The first key index is a pre-established index that uniquely corresponds to the first key. Based on the first key index, the first key corresponding to the first key index can be determined. As another example, the first key information includes an identifier of a first cryptographic device. This makes it easy to determine the cryptographic device that needs to process the first key corresponding to the first key information based on the identifier of the first cryptographic device.

[0064] The first operation type is, for example, one or more types of operations related to the key, such as a creation type, a query type, an update type, a deletion type, and a management type.

[0065] It should be noted that in some scenarios, the first operation type is determined based on the first key information. For example, the first cryptographic device is used to generate a DEK type key and encrypt the DEK using the KEK. The cryptographic device does not store DEK type keys, nor does it manage DEK. The first key information included in the first key operation instruction is the key type of DEK and the first key index of KEK, and the first operation type is a creation type. For another example, the first cryptographic device is used to generate a KEK type key, and is capable of maintaining and managing KEK type keys. For example, the first key information included in the first key operation instruction is the key type of KEK, and the first operation type is a creation type. Or, for another example, the first key information included in the first key operation instruction is the first key index of KEK, and the first operation type is one or more of the query type, update type, deletion type, and other operation types.

[0066] In some possible implementations, the first key operation instruction may include other operation information in addition to the first key information and the first operation type. The operation information may be determined based on the requirements for processing the key.

[0067] Step S502: The first business system sends a first key operation instruction to the management system.

[0068] The management system is a system for managing the cryptographic devices of the first business system. The first business system can establish a connection with the management system in advance. After generating the first key operation instruction, the first business system sends the first key operation instruction to the management system.

[0069] It should be noted that, in some implementations, the first key operation instruction also includes system information of the first business system. This facilitates the management system to determine the first business system that needs to perform the key operation. The system information is, for example, a system identifier of the first business system, or, for example, an address of the first business system that sends the first key operation instruction.

[0070] Step S503: The management system obtains the first key operation instruction sent by the first business system.

[0071] Step S504: the management system sends a second key operation instruction to the first cryptographic device according to the first key information.

[0072] The management system generates a second key operation instruction based on the acquired first key operation instruction. The second key operation instruction includes a first key index and a first operation type. The first key index is a unique index of the first key corresponding to the first key information. The first key index is determined by the management system. Using the unique first key index, unified management and global scheduling of keys can be achieved, and is no longer limited to the management of a single device. The second key operation instruction is used to instruct the first operation type to be performed using the first key corresponding to the first key index.

[0073] In one possible implementation, the first key operation instruction is used to create a key. The first operation type included in the first key operation instruction is a creation type. The first key information of the first key operation instruction does not include a first key index, for example, the first key information only includes a key type. After obtaining the first key operation instruction, the management system assigns a first key index to the first key to be created based on the index creation rule. In another possible implementation, the first key operation instruction is used to perform other operations on the first key that has been created, such as a query operation, an update operation, or a deletion operation. The first key information included in the first key operation instruction includes a first key index. The management system generates a second key operation instruction using the first key index and the first operation type included in the first key operation instruction.

[0074] The embodiments of the present application do not limit the specific content of the index creation rule. The index creation rule is used to generate a first key index that uniquely corresponds to the first key. As an example, the index creation rule is to use the sequential number of key creation as the first key index. As another example, the index creation rule is to select an index from an index resource pool as the first key index.

[0075] In addition to the first key index and the first operation type, in some implementations, the second key operation instruction also includes other information required for operating the key, such as key version, key type, etc. For example, for the second key operation instruction for creating a DEK, the second key operation instruction includes a first key index of a KEK, a first operation type of a creation operation, and a key type of a DEK.

[0076] The management system determines a first cryptographic device that operates a first key based on a second key operation instruction. The first cryptographic device is one of the cryptographic devices of the first business system. The embodiment of the present application does not limit the method of determining the first cryptographic device. For example, the first operation type included in the second key operation instruction is a creation type. As an example, the management system can select any one of the cryptographic devices of the first business system as the first cryptographic device. As another example, the management system determines the first cryptographic device that creates a key based on a resource pool of cryptographic devices. For another example, the first operation type included in the second key operation instruction is an update type, a query type, or a deletion type. The management system determines the first cryptographic device based on the cryptographic device that stores the key corresponding to the first key index of the second key operation instruction. For another example, the first key information included in the first key operation instruction includes an identifier of the first cryptographic device. The management system determines the first cryptographic device based on the identifier of the first cryptographic device included in the first key information. After determining the first cryptographic device, the management system sends the second key operation instruction to the first cryptographic device.

[0077] Step S505: The first cryptographic device obtains a second key operation instruction sent by the management system.

[0078] Step S506: The first cryptographic device performs an operation of a first operation type on the first key corresponding to the first key index to generate a first key operation result.

[0079] The first cryptographic device performs an operation of the first operation type based on the first key corresponding to the first key index according to the second key operation instruction. The first cryptographic device generates a first key operation result based on the result of the operation.

[0080] In one possible implementation, the operation of the first operation type is an operation on the first key corresponding to the first key index. For example, for the second key operation instruction for deleting the KEK, the first key index included in the second key operation instruction is the first key index of the KEK, and the first operation type is a deletion operation. The first cryptographic device performs the second key operation to delete the KEK corresponding to the first key index. In another possible implementation, the operation of the first operation type is an operation performed using the first key corresponding to the first key index. For example, for the second key operation instruction for creating a DEK, the second key operation instruction includes the first key index that is the first key index of the KEK, the first operation type is a creation operation, and the key type of the DEK. The first cryptographic device performs the second key operation to create the DEK, and encrypts the DEK using the KEK corresponding to the first key index.

[0081] The embodiment of the present application does not limit the specific content of the first key operation result. The content of the first key operation result is related to the second key operation instruction. As some examples, the embodiment of the present application provides four specific contents of the first key operation result.

[0082] The first type: the first operation type included in the second key operation instruction is a creation type.

[0083] The first key operation result includes a result indicating whether the creation is successful. As an example, the second key operation instruction is used to instruct the creation of a KEK type key. In the case where the first key operation result includes a result indicating successful creation, the first key operation result also includes a first key index and other related information. The related information is, for example, a key version. As another example, the second key operation instruction is used to instruct the creation of a DEK type key. In the case where the first key operation result includes a result indicating successful creation, the first key operation result also includes an encryption result.

[0084] The second type: the first operation type included in the second key operation instruction is a query type.

[0085] The first key operation result includes the first key index and other related information.

[0086] The third type: the first operation type included in the second key operation instruction is an update type.

[0087] The first key operation result includes a result indicating whether the update is successful, an updated key index, and other related information.

[0088] Fourth type: the first operation type included in the second key operation instruction is a deletion type.

[0089] The first key operation result includes a result indicating whether the deletion is successful.

[0090] Step S507: The first cryptographic device feeds back the first key operation result to the management system.

[0091] Step S508: The management system obtains the first key operation result.

[0092] The management system can determine the processing result of the second key operation instruction based on the obtained first key operation result, and realize the management of the first key and the first cryptographic device.

[0093] In a possible implementation, after obtaining the first key operation result, the management system feeds back the first key operation result to the first service system. The first service system can implement service processing by using the obtained first key operation result.

[0094] The management system manages the cryptographic devices of the business system and can manage cryptographic devices across devices and clusters. In addition, by using the key index that uniquely corresponds to the key, it can realize global perception and management of the key, meeting the needs of key use and management in large-scale scenarios.

[0095] The management system can also establish connections with multiple business systems to manage cryptographic devices of other business systems. As an example, the business system includes a second business system. The second business system is a business system other than the first business system. The second business system can interact with the management system to implement operations on the second key.

[0096] In a possible implementation, the embodiment of the present application provides a schematic diagram of an interaction process between a second business system, a management system, and a second cryptographic device. The key processing method provided in the embodiment of the present application includes steps A1-A8:

[0097] Step A1: The second business system generates a third key operation instruction.

[0098] The second business system is one of the business systems connected to the management system. When the second business system processes password-related business, it is necessary to operate the key and generate a third key operation instruction. The third key operation instruction includes the second key information and the second operation type. The second key information corresponds to the second key that needs to be operated. The second operation type is the type of operation that needs to be performed on the second key corresponding to the second key information.

[0099] The specific content included in the third key operation instruction is similar to that of the second key operation instruction. For the content of the second key operation instruction, please refer to the above description and will not be repeated here.

[0100] Step A2: The second business system sends a third key operation instruction to the management system.

[0101] Step A3: The management system obtains the third key operation instruction sent by the second business system.

[0102] Step A4: The management system sends a fourth key operation instruction to the second cryptographic device according to the second key information.

[0103] The management system generates a fourth key operation instruction based on the acquired second key operation instruction. The fourth key operation instruction includes a second key index and a second operation type. The second key index is a unique index of the second key corresponding to the second key information. The second key index is determined by the management system. Using the unique second key index, unified management and global scheduling of keys can be achieved, and is no longer limited to the management of a single device. The fourth key operation instruction is used to instruct the second key corresponding to the second key index to perform an operation of the second operation type.

[0104] The management system determines a second cryptographic device that operates the second key based on the fourth key operation instruction. The second cryptographic device is one of the cryptographic devices of the second business system. The embodiment of the present application does not limit the method for determining the second cryptographic device. The method for determining the second cryptographic device by the management system is similar to the method for determining the first cryptographic device. For the method for determining the first cryptographic device, please refer to the above description, which will not be repeated here.

[0105] Step A5: The second cryptographic device obtains the fourth key operation instruction sent by the management system.

[0106] Step A6: The second cryptographic device performs an operation of a second operation type on the second key corresponding to the second key index to generate a second key operation result.

[0107] The second cryptographic device performs an operation of the second operation type based on the second key corresponding to the second key index according to the fourth key operation instruction. The second cryptographic device generates a second key operation result based on the result of the operation.

[0108] Step A7: The second cryptographic device feeds back the second key operation result to the management system.

[0109] Step A8: The management service system obtains the second key operation result.

[0110] The interaction process of the above steps A1-A8 is similar to the above steps S501-S508, respectively. Please refer to the detailed introduction of the above steps S501-S508.

[0111] In addition to the above steps, the management system can also manage the life cycle of the keys stored in the managed cryptographic devices. The management system records the key management information of the key. The key management information includes, for example, one or more of the key ID, key algorithm name, key version, key type, key content, and other key-related information.

[0112] Taking the first key index as an example, after creating the first key index, the management system records the first key index into the key management information of the key index.

[0113] After the first cryptographic device generates the first key operation result based on the second key operation instruction, it sends the first key operation result to the management system. The management system updates the key management information including the key index based on the obtained first key operation result. In this way, the management system can manage the key based on the key management information and realize unified management of the key.

[0114] After the key is created, it is also possible to synchronize or back up the key so that cryptographic devices other than the cryptographic device that created the key can obtain and manage the key.

[0115] The synchronization or backup of keys can be achieved based on the management system. The synchronization of keys is that the cryptographic device that creates the key sends the key to other cryptographic devices so that other cryptographic devices can obtain the key. The backup of keys is that the cryptographic device that needs the key obtains the key from the management device. Synchronizing or backing up keys can meet the needs of scenarios that require key migration, such as application migration and adding new cryptographic devices, decoupling business applications from local hardware that stores keys, and expanding the scope of applicable scenarios. In addition, synchronizing keys or backing up keys can improve the reliability of keys and ensure that keys are recoverable. It can also reduce the execution process of other cryptographic devices creating the same key and simplify the complexity of key management.

[0116] Taking the first cryptographic device and the first key as an example, the key synchronization process is first specifically introduced. The embodiment of the present application does not limit the method of triggering the first cryptographic device to synchronize the key.

[0117] As an example, after the first cryptographic device completes the creation of the first key based on the second key operation instruction of the creation type of the first operation type, the first key is triggered to be synchronized to the third cryptographic device. As another example, after the first cryptographic device obtains the key synchronization instruction sent by the management device, the first key is triggered to be synchronized to the third cryptographic device.

[0118] The third cryptographic device, that is, the scope of key synchronization can be preset.

[0119] As an example, a preconfigured synchronization rule. The synchronization rule includes a cryptographic device identifier of a third cryptographic device. In this way, when the first cryptographic device performs key synchronization based on the synchronization rule, relevant information of the first key is sent to the cryptographic device corresponding to the cryptographic device identifier included in the synchronization rule, that is, the third cryptographic device. As another example, the third cryptographic device is all the cryptographic devices of the cluster to which the first cryptographic device belongs except the first cryptographic device, or all the cryptographic devices included in the business system except the first cryptographic device. After the first cryptographic device completes the creation of the key, or after obtaining the key synchronization instruction, the relevant information of the key is sent to the third cryptographic device.

[0120] As another example, the scope of key synchronization can be determined by a key synchronization instruction. The management device can generate a key synchronization instruction based on the need for key synchronization. The key synchronization instruction includes a first key index. The key synchronization instruction can also include a cryptographic device identifier of a third cryptographic device. Based on the key synchronization instruction, the first cryptographic device can synchronize the first key corresponding to the first key index to the cryptographic device corresponding to the cryptographic device identifier, that is, the third cryptographic device. The following introduces the key backup method by taking the first cryptographic device and the first key as an example.

[0121] In some scenarios, the fourth cryptographic device needs to obtain a key from the management system. As an example, the fourth cryptographic device is one of the cryptographic devices of the first business system. When the backup condition of the first key corresponding to the first key index is met, the fourth cryptographic device sends a key request instruction to the management system.

[0122] The backup condition is the condition that the fourth cryptographic device needs to obtain the first key corresponding to the first key index from the management system. As an example, the backup condition is that the fourth cryptographic device determines that the first key corresponding to the first key index is not stored locally. For example, when the business system uses the fourth cryptographic device to call the first key corresponding to the first key index, the fourth cryptographic device determines that the first key corresponding to the first key index is not stored locally, and the backup condition of the first key corresponding to the first key index is satisfied. As another example, the backup condition is that the fourth cryptographic device is the cryptographic device to which the first key corresponding to the first key index is to be backed up. For example, the fourth cryptographic device is a newly added cryptographic device to the business system. It is necessary to back up the first key corresponding to the first key index managed by the failed cryptographic device to the fourth cryptographic device.

[0123] When the backup condition of the first key corresponding to the first key index is met, the fourth cryptographic device sends a key request instruction including the first key index to the management system. The management system obtains the first key corresponding to the first key index based on the obtained key request instruction, and sends the first key corresponding to the first key index to the fourth cryptographic device. The fourth cryptographic device obtains and stores the first key corresponding to the first key index, and completes the backup of the first key corresponding to the first key index.

[0124] It should be noted that the key synchronization and key backup are performed in units of keys, so that relatively accurate key synchronization and key backup can be achieved, thus avoiding waste of resources.

[0125] The above key synchronization and key backup are both the transmission of keys between cryptographic devices. In some implementations, the cryptographic device is a physical functional device, and the cryptographic device is virtualized. The cryptographic device includes multiple virtual functional devices. Keys also need to be transmitted between different virtual functional devices belonging to the same cryptographic device.

[0126] The cryptographic device establishes a belonging index corresponding to the key. The belonging index is used to indicate the association between the key and the virtual function device. In this way, the virtual function device that can use the key can be determined based on the belonging index, and there is no need to store the same key in different virtual function devices, which saves the storage space of the key, improves the efficiency of key management, and saves space costs.

[0127] In one possible implementation, the attribution index is a binary string. The number of characters in the attribution index is consistent with the number of virtual function devices included in the cryptographic device. Each character of the attribution index is used to indicate whether the key belongs to the virtual function device corresponding to the character. For example, the cryptographic device includes 8 virtual function devices. The attribution index of the key is: 10010010. Each character of the attribution index is used to indicate whether the key belongs to the virtual function device corresponding to the character. The character value of "1" is used to indicate that the key belongs to the virtual function device corresponding to the character. The character value of "0" is used to indicate that the key does not belong to the virtual function device corresponding to the character. As shown in Table 1, taking the attribution index of the key as 10010010 as an example, each character of the attribution index from the first to the last digit corresponds to virtual function devices from virtual function device 0 to virtual function device 7.

[0128] Table 1

[0129] Virtual Function Device 0 1 2 3 4 5 6 7 Attribution Index 1 0 0 1 0 0 1 0 Is it yes no no yes no no yes no

[0130] Virtual function device 0, virtual function device 3, and virtual function device 6 can use the key. Virtual function device 1, virtual function device 2, virtual function device 4, virtual function device 5, and virtual function device 7 cannot use the key.

[0131] In addition, the attribution index can be adjusted based on the distribution of the key in the virtual function devices included in the cryptographic device. The embodiment of the present application does not limit the way of adjusting the distribution of the key in the virtual function devices included in the cryptographic device.

[0132] As an example, the business system can use the key operation instruction to adjust the distribution of the key in the virtual function device included in the cryptographic device. Figure 6 As shown, this figure is a schematic diagram of a key processing process provided by an embodiment of the present application. The first business system generates a first key operation instruction based on the key processing requirements of the processing business. The first business system sends the first key operation instruction to the management system. The management system generates a second key operation instruction based on the first key operation instruction. The management system sends the second key operation instruction to the first cryptographic device. The first cryptographic device processes the first key based on the second key operation instruction, and updates the attribution index of the first key according to the distribution of the first key in the virtual function device.

[0133] As another example, the management system can generate a key adjustment instruction based on management needs. The key adjustment instruction is used to instruct to adjust the distribution of the key in the virtual function device. For example, the key adjustment instruction includes a first key index, adjustment operation information, and an identifier of the virtual function device. The adjustment operation information is synchronous. The management system sends the key adjustment instruction to the first cryptographic device. The first cryptographic device can copy the key corresponding to the first key index to the virtual function device indicated by the identifier of the virtual function device based on the key adjustment instruction.

[0134] The first cryptographic device updates the attribution index of the first key according to the distribution of the adjusted key in the virtual function devices included in the cryptographic device. Take the attribution index of the above key as 10010010 as an example. For example, if the key is synchronized from virtual function device 0 to virtual function device 1, the attribution index of the key is correspondingly adjusted to 11010010. For another example, if the key is deleted from virtual function device 0, the attribution index of the key is correspondingly adjusted to 00010010.

[0135] The attribution index can be used to dynamically map the association between the key and the virtual function device, and avoid storing the same key in different virtual function devices, thereby reducing the space occupied by the key and saving costs.

[0136] Based on the key processing method provided in the embodiment of the present application, see Figure 7 As shown, the embodiment of the present application also provides a structural schematic diagram of a key processing device 700. The key processing device 700 can realize the function of a management system. The key processing device 700 is applied to a management system. The management system is connected to a business system. The management system manages the cryptographic device according to the key index.

[0137] Figure 7 Schematic diagram of the structure of a key processing device provided in an embodiment of the present application. The key processing device 700 includes an acquisition module 701 and a sending module 702. The functions of the key processing device 700 can be specifically referred to in Figure 5 The relevant parts of the embodiment shown are described. Acquisition module 701 is used to implement Figure 5 Steps S503 and S508 of the embodiment shown; sending module 702, used to implement Figure 5 Step S504 of the illustrated embodiment.

[0138] Specifically, the acquisition module 701 is used to acquire a first key operation instruction sent by a first business system in the business system, where the first key operation instruction includes first key information and a first operation type;

[0139] A sending module 702 is used to send a second key operation instruction to the first cryptographic device according to the first key information, where the second key operation instruction includes a first key index and a first operation type, where the first key index is an index of the first key corresponding to the first key information, and the second key operation instruction is used to instruct the first cryptographic device to perform an operation of the first operation type on the first key;

[0140] The acquisition module 701 is further used to obtain the first key operation result fed back by the first cryptographic device.

[0141] In some possible implementations, the acquisition module 701 is further configured to acquire a third key operation instruction sent by a second business system in the business system, where the third key operation instruction includes second key information and a second operation type;

[0142] The sending module 702 is further used to send a fourth key operation instruction to the second cryptographic device according to the second key information, where the fourth key operation instruction includes a second key index and a second operation type, where the second key index is an index of the second key corresponding to the second key information, and the fourth key operation instruction is used to instruct the second cryptographic device to perform an operation of the second operation type on the second key;

[0143] The acquisition module 701 is further used to obtain the second key operation result fed back by the second cryptographic device.

[0144] In some possible implementations, the device further includes:

[0145] The updating module 703 is used to update the key management information of the key index according to the first key operation result, where the key management information includes one or more of the following: key ID, key algorithm name, key type, and key version.

[0146] In some possible implementations, the first operation type includes one or more of the following:

[0147] Create type, query type, update type, delete type.

[0148] In some possible implementations, the first operation type is a creation type, and the apparatus further includes:

[0149] The recording module 704 is used to record the generated first key index into the key management information of the key index.

[0150] In some possible implementations, the sending module 702 is further used to send a key synchronization instruction to the first cryptographic device, where the key synchronization instruction includes a first key index, and the key synchronization instruction is used to synchronize the first key corresponding to the first key index to the third cryptographic device.

[0151] In some possible implementations, the acquisition module 701 is further configured to acquire a key backup instruction of a fourth cryptographic device, where the key backup instruction includes the first key index;

[0152] The acquisition module 701 is further used to acquire the first key corresponding to the first key index from the first cryptographic device;

[0153] The sending module 702 is further configured to send the first key to the fourth cryptographic device.

[0154] In some possible implementations, the cryptographic device is a physical functional device, the cryptographic device includes multiple virtual functional devices, and the multiple keys corresponding to the key index are associated with the multiple virtual functional devices through the belonging index.

[0155] In some possible implementations, the sending module 702 is further used to send a key adjustment instruction to the first cryptographic device, where the key adjustment instruction is used to instruct the first cryptographic device to adjust the distribution of the first key in the virtual function devices of the first cryptographic device and update the belonging index associated with the first key.

[0156] In actual application, the acquisition module 701, the sending module 702, the updating module 703 and the recording module 704 can be implemented by software or by hardware. Exemplarily, the implementation of the acquisition module 701 is described below by taking the acquisition module 701 as an example. Similarly, the implementation of the sending module 702, the updating module 703 and the recording module 704 can refer to the implementation of the acquisition module 701.

[0157] As an example of a software functional unit, the acquisition module 701 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the acquisition module 701 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with close geographical locations. Among them, usually a region may include multiple AZs.

[0158] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0159] The acquisition module 701 is taken as an example of a hardware functional unit, and the acquisition module 701 may include at least one computing device, such as a server, etc. Alternatively, the acquisition module 701 may also be a device implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), etc. The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0160] The multiple computing devices included in the acquisition module 701 can be distributed in the same region or in different regions. The multiple computing devices included in the acquisition module 701 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the acquisition module 701 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0161] It should be noted that, in the embodiment of the present application, the division and functional description of each module in the acquisition module 701, the sending module 702, the updating module 703 and the recording module 704 are only used as an example.

[0162] In other embodiments, the acquisition module 701 can be used to execute any step in the key processing method, the sending module 702 can be used to execute any step in the key processing method, the updating module 703 can be used to execute any step in the key processing method, and the recording module 704 can be used to execute any step in the key processing method. The steps that the acquisition module 701, the sending module 702, the updating module 703 and the recording module 704 are responsible for implementing can be specified as needed, and the acquisition module 701, the sending module 702, the updating module 703 and the recording module 704 respectively implement different steps in the key processing method to realize the full functions of the key processing device.

[0163] Above Figure 7 In the illustrated embodiment, the acquisition module 701, the sending module 702, the update module 703 and the recording module 704 may be software configured on a computing device or a computing device cluster, and by running the software on the computing device or the computing device cluster, the computing device or the computing device cluster may implement the functions of the above-mentioned devices. Below, based on the perspective of hardware device implementation, the devices involved in the code review process are described in detail.

[0164] The present application also provides a computing device 800. Figure 8 As shown, the computing device 800 includes: a bus 802, a processor 804, a memory 806, and a communication interface 808. The processor 804, the memory 806, and the communication interface 808 communicate through the bus 802. The computing device 800 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 800.

[0165] The bus 802 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 The bus 802 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 802 may include a path for transmitting information between various components of the computing device 800 (eg, the memory 806, the processor 804, and the communication interface 808).

[0166] The processor 804 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0167] The memory 806 may include a volatile memory, such as a random access memory (RAM). The processor 804 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0168] The memory 806 stores executable program codes, and the processor 804 executes the executable program codes to respectively implement the functions of the aforementioned acquisition module 701, the sending module 702, the updating module 703, and the recording module 704, thereby implementing the key processing method. That is, the memory 806 stores instructions for executing the key processing method.

[0169] The communication interface 808 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 800 and other devices or communication networks.

[0170] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0171] like Fig. 9 As shown, the computing device cluster includes at least one computing device 800. The memory 806 in one or more computing devices 800 in the computing device cluster may store the same instructions for executing the key processing method.

[0172] It should be noted that the memory 806 in different computing devices 800 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the key processing device. That is, the instructions stored in the memory 806 in different computing devices 800 can implement the functions of one or more modules in the acquisition module 701, the sending module 702, the update module 703 and the recording module 704.

[0173] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.10 A possible implementation is shown. Fig.10 As shown, two computing devices 800A and 800B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 806 in the computing device 800A stores instructions for executing the functions of the acquisition module 701. At the same time, the memory 806 in the computing device 800B stores instructions for executing the functions of the sending module 702, the updating module 703, and the recording module 704.

[0174] Fig.10 The connection method between the computing device clusters shown can be based on the consideration that the acquisition module 701 in the key processing method provided in this application needs to interact with the user a lot, so it is considered to entrust the functions implemented by the sending module 702, the update module 703 and the recording module 704 to the computing device 800B for execution.

[0175] It should be understood that Fig.10 The functions of the computing device 800A shown in FIG. 8 may also be completed by multiple computing devices 800. Similarly, the functions of the computing device 800B may also be completed by multiple computing devices 800.

[0176] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the key processing method.

[0177] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the key processing method.

[0178] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A key processing method, the method is applied to a management system, the management system is connected to a business system, the management system manages a cryptographic device according to a key index, the method comprising: Acquire a first key operation instruction sent by a first business system in the business system, where the first key operation instruction includes first key information and a first operation type; Sending a second key operation instruction to a first cryptographic device according to the first key information, where the second key operation instruction includes a first key index and the first operation type, where the first key index is an index of the first key corresponding to the first key information, and the second key operation instruction is used to instruct the first cryptographic device to perform an operation of the first operation type on the first key; Obtain a first key operation result fed back by the first cryptographic device.

2. The method according to claim 1, characterized in that The method comprises: Acquire a third key operation instruction sent by a second business system in the business system, where the third key operation instruction includes second key information and a second operation type; sending, according to the second key information, a fourth key operation instruction to the second cryptographic device, the fourth key operation instruction including a second key index and the second operation type, the second key index being an index of the second key corresponding to the second key information, and the fourth key operation instruction being used to instruct the second cryptographic device to perform an operation of the second operation type on the second key; Obtain a second key operation result fed back by the second cryptographic device.

3. The method according to claim 1 or 2, characterized in that: After obtaining the first key operation result fed back by the first cryptographic device, the method further includes: According to the first key operation result, the key management information of the key index is updated, and the key management information includes one or more of the following: key ID, key algorithm name, key type, and key version.

4. The method according to any one of claims 1 to 3, characterized in that: The first operation type includes one or more of the following: Create type, query type, update type, delete type.

5. The method according to any one of claims 1 to 4, characterized in that: The first operation type is the creation type, and after obtaining the first key operation result fed back by the first cryptographic device, the method further includes: The generated first key index is recorded in the key management information of the key index.

6. The method according to claim 1, characterized in that The method comprises: A key synchronization instruction is sent to the first cryptographic device, where the key synchronization instruction includes the first key index, and the key synchronization instruction is used to synchronize the first key corresponding to the first key index to a third cryptographic device.

7. The method according to claim 1, characterized in that The method comprises: Obtaining a key backup instruction of a fourth cryptographic device, wherein the key backup instruction includes the first key index; Obtaining a first key corresponding to the first key index from the first cryptographic device; The first key is sent to the fourth cryptographic device.

8. The method according to any one of claims 1 to 7, characterized in that: The cryptographic device is a physical functional device, and the cryptographic device includes a plurality of virtual functional devices. The plurality of keys corresponding to the key index are associated with the plurality of virtual functional devices through a belonging index.

9. The method according to any one of claims 1 to 8, characterized in that: The method comprises: A key adjustment instruction is sent to the first cryptographic device, where the key adjustment instruction is used to instruct the first cryptographic device to adjust the distribution of the first key in the virtual function devices of the first cryptographic device and update the belonging index associated with the first key.

10. A key processing device, the device is applied to a management system, the management system is connected to a business system, the management system manages a cryptographic device according to a key index, the device comprising: An acquisition module, configured to acquire a first key operation instruction sent by a first business system in the business system, wherein the first key operation instruction includes first key information and a first operation type; a sending module, configured to send a second key operation instruction to a first cryptographic device according to the first key information, where the second key operation instruction includes a first key index and the first operation type, where the first key index is an index of the first key corresponding to the first key information, and the second key operation instruction is used to instruct the first cryptographic device to perform an operation of the first operation type on the first key; The acquisition module is further used to obtain the first key operation result fed back by the first cryptographic device.

11. The device according to claim 10, characterized in that The acquisition module is further used to acquire a third key operation instruction sent by the second business system in the business system, wherein the third key operation instruction includes second key information and a second operation type; The sending module is further used to send a fourth key operation instruction to the second cryptographic device according to the second key information, the fourth key operation instruction including a second key index and the second operation type, the second key index being an index of the second key corresponding to the second key information, and the fourth key operation instruction being used to instruct the second cryptographic device to perform an operation of the second operation type on the second key; The acquisition module is further used to obtain the second key operation result fed back by the second cryptographic device.

12. The device according to claim 10 or 11, characterized in that The device also includes: An update module is used to update the key management information of the key index according to the first key operation result, and the key management information includes one or more of the following: key ID, key algorithm name, key type, and key version.

13. The device according to any one of claims 10 to 12, characterized in that The first operation type includes one or more of the following: Create type, query type, update type, delete type.

14. The device according to any one of claims 10 to 13, characterized in that The first operation type is the creation type, and the device further includes: A recording module is used to record the generated first key index into the key management information of the key index.

15. The device according to claim 10, characterized in that The sending module is further used to send a key synchronization instruction to the first cryptographic device, where the key synchronization instruction includes the first key index, and the key synchronization instruction is used to synchronize the first key corresponding to the first key index to a third cryptographic device.

16. The device according to claim 10, characterized in that The acquisition module is further used to acquire a key backup instruction of a fourth cryptographic device, wherein the key backup instruction includes the first key index; The acquisition module is further used to acquire the first key corresponding to the first key index from the first cryptographic device; The sending module is further used to send the first key to the fourth cryptographic device.

17. The device according to any one of claims 10 to 16, characterized in that The cryptographic device is a physical functional device, and the cryptographic device includes a plurality of virtual functional devices. The plurality of keys corresponding to the key index are associated with the plurality of virtual functional devices through a belonging index.

18. The device according to any one of claims 10 to 17, characterized in that The sending module is further used to send a key adjustment instruction to the first cryptographic device, where the key adjustment instruction is used to instruct the first cryptographic device to adjust the distribution of the first key in the virtual function devices of the first cryptographic device and update the belonging index associated with the first key.

19. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 9.

20. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 9.

21. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 9.

Images