A cryptographic resource allocation method and system for subscription-based cloud cryptographic services

Abstract

The present invention discloses a cryptographic resource allocation method and system for subscription-based cloud cryptographic services, belonging to the technical field of cloud cryptographic services, the method comprising: calculating the specifications of the required cryptographic resources according to the requirements of the subscription-based packages; the cryptographic resources comprising: key resources and cryptographic hardware resources; creating and integrating a corresponding number of key resources and cryptographic hardware resources according to the specifications of the required cryptographic resources, forming a cryptographic resource logical entity that is authorized and bound to each other; recording and maintaining the association between the cryptographic resource logical entity and the subscription-based packages. The present invention can enable each subscription-based cloud cryptographic service package to have independent cryptographic resources, exclusive key resources and hardware cryptographic resources, avoid security issues such as data leakage and insufficient coverage of permission design due to sharing, and greatly improve the security of cloud cryptographic services.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud cryptographic services, and more specifically to a cryptographic resource allocation method and system for subscription-based cloud cryptographic services. Background Art

[0002] At present, cloud computing is widely used in the information construction of various industries with its advantages of flexibility, agility, intensiveness and efficiency. Cryptography technology, as one of the fundamental technologies of information security, is also constantly exploring its combination with cloud computing. Cryptography technology is still mainly delivered in the form of cryptographic software and cryptographic hardware at this stage. However, many companies are unable to use high-quality cryptographic services due to the long construction cycle, high cost and lack of professional cryptographic operation and maintenance technicians of the cryptographic system. Therefore, adopting a cryptographic supply method based on the cloud service model is a feasible technical route. By building a high-quality cryptographic infrastructure, equipping professional cryptographic technicians, and providing services and billing to users in the form of cloud services (IaaS, PaaS and SaaS), users can immediately obtain high-quality cryptographic services and focus on their own business development.

[0003] In addition, the billing model of cloud service model is also diverse, such as subscription-based, usage-based, etc. Due to the advantages of subscription-based model such as predictable income, user stickiness and low secondary sales cost, it has become the mainstream choice of cloud service billing model. This model supports selling service types in the form of packages. For example, encryption and decryption services can be set as trial version, basic version, professional version and enterprise version. The functions and computing power included in each package are set in a step-by-step manner to facilitate user selection.

[0004] As a new service model that combines cryptographic technology with cloud services, cloud cryptographic services are essentially an extension of cryptographic technology. Cryptographic technology is a secure, economical, and reliable technology based on mathematical proof. A secure and complete cryptographic operation includes elements such as cryptographic algorithms, keys, and secure cryptographic operation spaces. Therefore, the secure implementation of cryptographic technology must rely on relevant cryptographic resources. This technical feature of cryptographic technology determines the difference between cloud cryptographic services and general cloud services. That is: cloud cryptographic services must have supporting cryptographic resources when providing services to the outside world, not just the computing, storage, and network resources of general cloud services.

[0005] In engineering applications, cryptographic resources are generally provided by hardware cryptographic modules. This is because cryptographic technology is a "black box" technology, and it is necessary to ensure that the cryptographic operation process cannot be peeped. Therefore, a separate hardware module is required to provide an independent operation carrier, so as to ensure the safe implementation of cryptographic technology.

[0006] The implementation of conventional subscription-based cloud cryptographic services mainly includes two parts: subscription-based billing management and cloud cryptographic services. The former mainly implements the various functions of subscription-based licensing, including purchase, verification, renewal, and change, by establishing a license management system. The latter combines cryptographic technology with cloud technology to realize the cloud service of cryptographic technology, with the main features of elasticity, agility, service-oriented supply, and leasing. Cloud cryptographic services generally include computing resources, storage resources, network resources, and cryptographic resources. The subscription management system controls the external use of cloud cryptographic services by setting different packages and restricting the use conditions within the packages. As a service entity, cloud cryptographic services are no longer divided into more fine-grained categories for different packages.

[0007] Because of this, the current implementation method causes different subscription packages to share the same cloud cryptographic service entity, and only the upper-level license management system is used to implement logical package division and restrictions. This will significantly reduce the security of the cloud cryptographic service. This is because different packages share the same cryptographic resource of the cloud cryptographic service, which will increase the security risks of key leakage and cryptographic calculation process being spied on. Summary of the invention

[0008] Existing subscription-based cloud cryptographic services cannot allocate independent cryptographic resources for different subscription packages, that is, all clients of different packages share access to the same set of cryptographic resources, which will significantly reduce the security of cloud cryptographic services. In view of this, the present invention provides a cryptographic resource allocation method and system for subscription-based cloud cryptographic services, which solves the problem of security reduction caused by sharing cryptographic resources between different packages, and allocates corresponding cryptographic resources to each cryptographic package.

[0009] In order to achieve the above object, the present invention adopts the following technical solution:

[0010] In a first aspect, an embodiment of the present invention provides a cryptographic resource allocation method for a subscription-based cloud cryptographic service, comprising the following steps:

[0011] Calculate the specifications of the required cryptographic resources according to the requirements of the subscription package; the cryptographic resources include: key resources and cryptographic hardware resources;

[0012] According to the specifications of the required cryptographic resources, create and integrate the corresponding number of key resources and cryptographic hardware resources to form a cryptographic resource logical entity that is authorized and bound to each other;

[0013] Record and maintain the association between the cryptographic resource logical entity and the subscription package.

[0014] Furthermore, the subscription package includes:

[0015] 1) Package ID;

[0016] 2) Types of symmetric cryptographic algorithms, number of keys corresponding to the symmetric algorithms, encryption performance indicators, and decryption performance indicators;

[0017] 3) Types of asymmetric cryptographic algorithms, number of key pairs corresponding to asymmetric algorithms, signature performance indicators, signature verification performance indicators, encryption performance indicators, and decryption performance indicators.

[0018] Furthermore, the specifications of the cryptographic resources required for the calculation include:

[0019] Calculate the number of key resources required:

[0020] (1)

[0022] (1) In the formula, K represents the number of keys required; Indicates the number of keys of the i-th symmetric encryption algorithm; represents the number of key pairs of the jth asymmetric encryption algorithm; n represents the number of algorithm types of symmetric encryption algorithms; m represents the number of algorithm types of asymmetric encryption algorithms;

[0023] Calculate the minimum number of hardware cryptographic resources required:

[0024] (2)

[0026] (2) In the formula, Q represents the minimum number of hardware cryptographic resources required; represents the ceiling function; represents the maximum value function; Indicates the xth performance indicator of the i-th symmetric encryption algorithm in the package; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the package; It represents the xth performance index of the i-th symmetric cryptographic algorithm in the minimum hardware cryptographic resource; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the minimum specification hardware cryptographic resources.

[0027] Furthermore, the creation and integration of a corresponding number of key resources and cryptographic hardware resources includes:

[0028] Create and manage key resources through the key management unit;

[0029] Create and manage cryptographic hardware resources through the hardware cryptographic resource management unit.

[0030] Furthermore, it also includes: feeding back the identity ID of the cryptographic resource logical entity to the cloud cryptographic service.

[0031] In a second aspect, an embodiment of the present invention further provides a cryptographic resource allocation system for a subscription-based cloud cryptographic service, comprising:

[0032] A cryptographic resource calculation module, used to calculate the specifications of the required cryptographic resources according to the requirements of the subscription package; the cryptographic resources include: key resources and cryptographic hardware resources;

[0033] The cryptographic resource integration module is used to create and integrate the corresponding number of key resources and cryptographic hardware resources according to the specifications of the required cryptographic resources to form a cryptographic resource logical entity that is authorized and bound to each other;

[0034] The password resource association module is used to record and maintain the association relationship between the password resource logical entity and the subscription package.

[0035] Furthermore, the subscription package includes:

[0036] 1) Package ID;

[0037] 2) Types of symmetric cryptographic algorithms, number of keys corresponding to the symmetric algorithms, encryption performance indicators, and decryption performance indicators;

[0038] 3) Types of asymmetric cryptographic algorithms, number of key pairs corresponding to asymmetric algorithms, signature performance indicators, signature verification performance indicators, encryption performance indicators, and decryption performance indicators.

[0039] Furthermore, the cryptographic resource calculation module includes:

[0040] The key resource calculation unit is used to calculate the number of required key resources according to the requirements of the subscription package:

[0041] (1)

[0043] (1) In the formula, K represents the number of keys required; Indicates the number of keys of the i-th symmetric encryption algorithm; represents the number of key pairs of the jth asymmetric encryption algorithm; n represents the number of algorithm types of symmetric encryption algorithms; m represents the number of algorithm types of asymmetric encryption algorithms;

[0044] The hardware password resource calculation unit is used to calculate the minimum number of hardware password resources required based on the requirements of the subscription package:

[0045] (2)

[0047] (2) In the formula, Q represents the minimum number of hardware cryptographic resources required; represents the ceiling function; It represents the maximum value function; Indicates the xth performance indicator of the i-th symmetric encryption algorithm in the package; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the package; It represents the xth performance index of the i-th symmetric cryptographic algorithm in the minimum hardware cryptographic resource; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the minimum specification hardware cryptographic resources.

[0048] Furthermore, the password resource integration module includes:

[0049] The key management unit is used to manage key resources, create required key resources and feed them back to the cryptographic resource integration module;

[0050] The hardware password resource management unit is used to manage hardware password resources, create hardware password resources of required specifications and quantity, and feed back to the password resource integration module.

[0051] Furthermore, the cryptographic resource association module is also used to feed back the identity ID of the cryptographic resource logical entity to the cloud cryptographic service.

[0052] It can be seen from the above technical solutions that compared with the prior art, the present invention has the following technical advantages:

[0053] The implementation of the present invention will enable each subscription-based cloud cryptographic service package to have independent cryptographic resources, exclusive key resources and hardware cryptographic resources, thereby avoiding security issues such as data leakage caused by sharing and insufficient coverage of permission design, and the security of cloud cryptographic services is greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0055] Figure 1 A flow chart of the cryptographic resource allocation method for subscription-based cloud cryptographic services provided by the present invention.

[0056] Figure 2 A block diagram of the cryptographic resource allocation system for subscription-based cloud cryptographic services provided by the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] Before describing the technical solution of the present invention, the abbreviations and key terms involved are first described as follows:

[0059] Subscription service: A cloud service billing model that divides the service into different service levels / packages according to the service content, and allows users to pay regularly based on time dimensions, such as month / year, etc.

[0060] Cloud cryptographic service: a cryptographic service provided in a cloud service model, including IaaS, PaaS and SaaS services. It allows users to use cryptographic services on a rental basis, including encryption and decryption services, signature verification services, etc.

[0061] Cryptographic resources: A combination of all elements required to achieve secure and complete cryptographic operations. Mainly including keys, cryptographic algorithms, secure cryptographic operation space, and secure key storage space.

[0062] Cryptographic hardware module: A hardware carrier that provides secure and reliable cryptographic resources. Its forms include but are not limited to cryptographic cards (PCI-E HSM), cryptographic machines (HSM) and virtual cryptographic machines (VSM).

[0063] Embodiment 1:

[0064] The embodiment of the present invention discloses a cryptographic resource allocation method for a subscription-based cloud cryptographic service, referring to Figure 1 As shown, it includes steps S10 to S30:

[0065] S10. Calculate the specifications of the required cryptographic resources according to the requirements of the subscription package; the cryptographic resources include: key resources and cryptographic hardware resources;

[0066] In the specific implementation, the instruction information sent by the cloud cryptographic service is received to parse the content of the subscription package, including: package ID, key specifications and cryptographic operation performance specifications; for example: the type of symmetric cryptographic algorithm, the number of keys corresponding to the symmetric algorithm, encryption performance indicators and decryption performance indicators; for example: the type of asymmetric cryptographic algorithm, the number of key pairs corresponding to the asymmetric algorithm, signature performance indicators, signature verification performance indicators, encryption performance indicators and decryption performance indicators.

[0067] The above two types of cryptographic algorithms require calculation of the required key resource size and the required hardware cryptographic resource size:

[0068] 1. Key resource calculation:

[0069] Symmetric Algorithm: Count the number of keys required for each symmetric algorithm.

[0070] Asymmetric algorithms: Count the number of key pairs required for each asymmetric algorithm and multiply the result by 2 (because an asymmetric algorithm consists of a pair of public and private keys).

[0071] Add the number of keys for all algorithms to get the total number of keys.

[0072] 2. Hardware password resource calculation:

[0073] Compare the performance requirements of each algorithm in the plan with the performance of the minimum hardware cryptographic resources.

[0074] Calculate the minimum hardware cryptographic resources required for each algorithm to meet performance requirements.

[0075] Use the maximum value function to select the maximum value of the number of hardware cryptographic resources required for each algorithm to obtain the total number of hardware cryptographic resources required.

[0076] For example:

[0077] Assume that the symmetric encryption algorithm is identified by S, and different symmetric encryption algorithms are S1, S2, S3, etc. There are many common symmetric encryption algorithms, such as SM4, SM1, AES algorithm, etc. Assume that the asymmetric encryption algorithm is identified by A, and different asymmetric encryption algorithms are A1, A2, A3, etc. Common asymmetric encryption algorithms include SM2, RSA, ECC, etc.

[0078] Then, the size of the key is calculated as follows:

[0079] (1)

[0081] (1) In the formula, K represents the number of keys required; Indicates the number of keys of the i-th symmetric encryption algorithm; represents the number of key pairs of the jth asymmetric encryption algorithm; n represents the number of algorithm types of symmetric encryption algorithms; m represents the number of algorithm types of asymmetric encryption algorithms; an asymmetric encryption algorithm contains a pair of public and private keys, so the number of keys needs to be multiplied by 2.

[0082] In addition, the provision of hardware cryptographic resources for cloud cryptographic services is mainly achieved by superimposing the minimum specification hardware cryptographic resources. Assume that the computing performance of the minimum specification hardware cryptographic resources is M, and the password computing performance requirement parsed in the package is P. The overall calculation idea is to divide the two. However, it should be noted that computing performance includes different algorithms and multiple different performance indicators within the algorithm.

[0083] Then, the minimum number of hardware cryptographic resources required is:

[0084] (2)

[0086] (2) In the formula, Q represents the minimum number of hardware cryptographic resources required; represents the ceiling function; represents the maximum value function; Indicates the xth performance indicator of the i-th symmetric encryption algorithm in the package; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the package; It represents the xth performance index of the i-th symmetric cryptographic algorithm in the minimum hardware cryptographic resource; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the minimum specification hardware cryptographic resources.

[0087] Based on the minimum specifications of hardware cryptographic resources, a calculation method for the optimal required cryptographic resources is proposed, which is mainly based on the two dimensions of key resources and hardware cryptographic resources. This calculation method is applicable to complex scenarios such as multiple algorithm types and multiple performance indicators.

[0088] Finally, the calculated K and Q are the specifications of the required cryptographic resources.

[0089] S20. According to the specifications of the required cryptographic resources, create and integrate a corresponding number of key resources and cryptographic hardware resources to form a cryptographic resource logical entity that is authorized and bound to each other;

[0090] In this step, key resources and hardware cryptographic resources are created based on the calculated K and Q, and are combined into a logical entity.

[0091] Specifically, the required number of key resources is created by using the key management unit, and the required number of hardware password resources is created by using the hardware password resource management unit.

[0092] Then, the created key resource and hardware password resource are matched and bound through permission control to form a logical password resource entity and assigned a unique ID. That is, only the associated key and hardware password resource are allowed to access each other.

[0093] S30, record and maintain the association between the cryptographic resource logic entity and the subscription package. Feedback the identity ID of the cryptographic resource logic entity to the cloud cryptographic service. In this step, by recording the correspondence between the cryptographic resource entity ID and the subscription package ID, the management and use of the subsequent cloud cryptographic service is facilitated. For example, it is used for the cloud cryptographic service to locate the corresponding cryptographic resources and respond to package requirements.

[0094] Through the above three steps, the embodiment of the invention converts the performance indicators in the package into the demand indicators of the cryptographic resources and creates the corresponding cryptographic resources. Then, the relationship between the cryptographic resource combination and the package is recorded and maintained, and the cryptographic resource integration combination is sent to the cloud cryptographic service. The cryptographic resource allocation for the subscription cloud cryptographic service package is realized, ensuring that each package has independent key resources and hardware cryptographic resources, thereby improving the security of the cloud cryptographic service.

[0095] The above calculation scheme is described in detail through the content of a specific package:

[0096] The subscription management system sends a command: Create a data encryption and decryption service package with ID T1. The package includes the following:

[0097] SM4 algorithm (symmetric algorithm): 300 keys, encryption / decryption performance: 10,000 TPS; TPS means transactions per second, and encryption / decryption performance of 10,000 TPS means that the cryptographic service needs to complete 10,000 encryption or decryption operations within 1 second.

[0098] SM1 algorithm (symmetric algorithm): 300 keys, encryption / decryption performance: 8000TPS;

[0099] AES algorithm (symmetric algorithm): 100 keys, encryption / decryption performance: 5000TPS;

[0100] SM2 algorithm (asymmetric algorithm): 200 key pairs, signature / verification performance: 10000TPS / 3000PS; encryption / decryption performance: 2000TPS / 3000TPS

[0101] RSA2048 (asymmetric algorithm): 100 key pairs, signature / verification performance: 1000PS / 30000TPS encryption / decryption performance: 30000TPS / 1000TPS.

[0102] Performance indicators of the current minimum hardware cryptographic resources of the cloud service system:

[0103] SM4 algorithm (symmetric algorithm): encryption / decryption performance: 3000TPS;

[0104] SM1 algorithm (symmetric algorithm): encryption / decryption performance: 3000TPS;

[0105] AES algorithm (symmetric algorithm): encryption / decryption performance: 2000TPS;

[0106] SM2 algorithm (asymmetric algorithm): signature / verification performance: 2000TPS / 600PS; encryption / decryption performance: 1000TPS / 1500TPS

[0107] RSA2048 (asymmetric algorithm): signature / verification performance: 500PS / 15000TPS; encryption / decryption performance: 15000TPS / 500TPS.

[0108] RSA3072 (asymmetric algorithm): Signature / verification performance: 200TPS / 5000TPS; encryption / decryption performance index: 5000TPS / 200TPS.

[0109] First, calculate the key resources required for the package:

[0110]

[0111] That is 1300 keys.

[0112] Then, calculate the minimum number of hardware cryptographic resources required for the plan:

[0113]

[0114] That is, 1,300 keys and 5 minimum-specification hardware password resources need to be allocated for this package, and they are bound to a logical password resource entity through permission control and given an ID value of Z1.

[0115] Next, associate T1 with Z1 and send Z1 to the cloud cryptographic service for the service to bind the corresponding cryptographic resources.

[0116] Embodiment 2:

[0117] The embodiment of the present invention also provides a cryptographic resource allocation system for subscription-based cloud cryptographic services, referring to Figure 2 As shown, the system is located in Figure 2The dotted box in the figure includes: cryptographic resource calculation module, cryptographic resource integration module and cryptographic resource association module. The system is logically located after the license management system and cloud cryptographic service. The license management system sends relevant requests (creation / change, etc.) to the cloud cryptographic service, and attaches the constraints in the package. After processing, the cloud cryptographic service sends instructions for cryptographic resource allocation to the dotted box. The multiple modules in the dotted box jointly process to realize the cryptographic resource allocation under the cloud cryptographic service package.

[0118] 1) Cryptographic resource calculation module: mainly used to calculate the specifications of cryptographic resources required for subscription packages. Cryptographic resources mainly include key resources and cryptographic hardware resources (providing cryptographic algorithms, secure cryptographic operation space, and secure key storage space, etc.).

[0119] The cryptographic resource calculation module specifically includes:

[0120] The key resource calculation unit is used to calculate the number of required key resources according to the requirements of the subscription package:

[0121] (1)

[0123] (1) In the formula, K represents the number of keys required; Indicates the number of keys of the i-th symmetric encryption algorithm; represents the number of key pairs of the jth asymmetric encryption algorithm; n represents the number of algorithm types of symmetric encryption algorithms; m represents the number of algorithm types of asymmetric encryption algorithms;

[0124] The hardware password resource calculation unit is used to calculate the minimum number of hardware password resources required based on the requirements of the subscription package:

[0125] (2)

[0127] (2) In the formula, Q represents the minimum number of hardware cryptographic resources required; represents the ceiling function; It represents the maximum value function; Indicates the xth performance indicator of the i-th symmetric encryption algorithm in the package; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the package; It represents the xth performance index of the i-th symmetric cryptographic algorithm in the minimum hardware cryptographic resource; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the minimum specification hardware cryptographic resources.

[0128] The cryptographic resource calculation module sends the calculated K and Q to the cryptographic resource integration module.

[0129] 2) Cryptographic resource integration module: It mainly creates and integrates the calculated cryptographic resources, matches the key resources and cryptographic hardware resources, and forms a logical entity of cryptographic resources that are authorized and bound to each other.

[0130] It includes:

[0131] Key management unit: used to manage key resources, create required key resources and feed them back to the cryptographic resource integration module.

[0132] Hardware password resource management unit: used to manage hardware password resources, create hardware password resources of specified specifications and quantity, and feed back to the password resource integration module.

[0133] In this module, the cryptographic resource integration module calls the key management unit and the hardware cryptographic resource management unit to create a corresponding number of key resources and hardware cryptographic resources according to the calculation results of the cryptographic resource calculation module. Then, these resources are integrated and associated into a logical cryptographic resource entity, and an identity ID is given. After the cryptographic resource entity is associated, its key and hardware cryptographic resource are bound through permission control, that is, only the associated key and hardware cryptographic resource are allowed to access each other.

[0134] 3) Password resource association module: mainly records the relationship between the integrated password resource logical entity and the subscription package, and feeds back the password resource logical entity ID to the cloud password service.

[0135] The password resource association module associates the package ID with the password resource ID and maintains the mapping relationship in the database. At the same time, this module is responsible for feeding back the password resource ID to the cloud password service for the cloud password service to retrieve and confirm the corresponding password resource.

[0136] The system consists of multiple functional modules, including password resource calculation, integration, association, etc., to achieve efficient management. Each module has a clear functional positioning and modular design, which is easy to maintain and manage. It can dynamically calculate and create the required password resources according to the package performance requirements to achieve flexible resource matching. In addition, it improves security and avoids security risks caused by password resource sharing.

[0137] This technical solution provides a more secure and flexible resource allocation method for subscription-based cloud cryptographic services, helping to improve the security and service quality of cloud cryptographic services.

[0138] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0139] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A cryptographic resource allocation method for subscription-based cloud cryptographic services, characterized in that: The following steps are involved: Calculate the specifications of the required cryptographic resources according to the requirements of the subscription package; the cryptographic resources include: key resources and cryptographic hardware resources; According to the specifications of the required cryptographic resources, create and integrate the corresponding number of key resources and cryptographic hardware resources to form a cryptographic resource logical entity that is authorized and bound to each other; Record and maintain the association between the cryptographic resource logical entity and the subscription package; The subscription package includes: 1) Package ID; 2) Types of symmetric cryptographic algorithms, number of keys corresponding to the symmetric algorithms, encryption performance indicators, and decryption performance indicators; 3) Types of asymmetric cryptographic algorithms, number of key pairs corresponding to asymmetric algorithms, signature performance indicators, signature verification performance indicators, encryption performance indicators, and decryption performance indicators; The specifications of the cryptographic resources required for the calculation include: Calculate the number of key resources required: (1)In the formula, K represents the number of keys required; Indicates the number of keys of the i-th symmetric encryption algorithm; represents the number of key pairs of the jth asymmetric encryption algorithm; n represents the number of algorithm types of symmetric encryption algorithms; m represents the number of algorithm types of asymmetric encryption algorithms; Calculate the minimum number of hardware cryptographic resources required: (2)In the formula, Q represents the number of minimum hardware cryptographic resources required; represents the rounding up function; MAX(·) represents the maximum value function; Indicates the xth performance indicator of the i-th symmetric encryption algorithm in the package; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the package; It represents the xth performance index of the i-th symmetric cryptographic algorithm in the minimum hardware cryptographic resource; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the minimum specification hardware cryptographic resources.

2. A cryptographic resource allocation method for subscription-based cloud cryptographic services according to claim 1, characterized in that: The creation and integration of a corresponding number of key resources and cryptographic hardware resources includes: Create and manage key resources through the key management unit; Create and manage cryptographic hardware resources through the hardware cryptographic resource management unit.

3. A cryptographic resource allocation method for subscription-based cloud cryptographic services according to claim 1, characterized in that: Also includes: Feedback the identity ID of the cryptographic resource logical entity to the cloud cryptographic service.

4. A cryptographic resource allocation system for subscription-based cloud cryptographic services, characterized in that: include: The cryptographic resource calculation module is used to calculate the specifications of the required cryptographic resources according to the requirements of the subscription package; The cryptographic resources include: key resources and cryptographic hardware resources; The cryptographic resource integration module is used to create and integrate the corresponding number of key resources and cryptographic hardware resources according to the specifications of the required cryptographic resources to form a cryptographic resource logical entity that is authorized and bound to each other; A password resource association module, used to record and maintain the association relationship between the password resource logical entity and the subscription package; The subscription package includes: 1) Package ID; 2) Types of symmetric cryptographic algorithms, number of keys corresponding to the symmetric algorithms, encryption performance indicators, and decryption performance indicators; 3) Types of asymmetric cryptographic algorithms, number of key pairs corresponding to asymmetric algorithms, signature performance indicators, signature verification performance indicators, encryption performance indicators, and decryption performance indicators; The cryptographic resource calculation module comprises: The key resource calculation unit is used to calculate the number of required key resources according to the requirements of the subscription package: (1)In the formula, K represents the number of keys required; Indicates the number of keys of the i-th symmetric encryption algorithm; represents the number of key pairs of the jth asymmetric encryption algorithm; n represents the number of algorithm types of symmetric encryption algorithms; m represents the number of algorithm types of asymmetric encryption algorithms; The hardware password resource calculation unit is used to calculate the minimum number of hardware password resources required based on the requirements of the subscription package: (2)In the formula, Q represents the number of minimum hardware cryptographic resources required; represents the rounding up function; MAX(·) represents the maximum value function; Indicates the xth performance indicator of the i-th symmetric encryption algorithm in the package; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the package; It represents the xth performance index of the i-th symmetric cryptographic algorithm in the minimum hardware cryptographic resource; Represents the yth performance indicator of the jth asymmetric cryptographic algorithm in the minimum specification hardware cryptographic resources.

5. A cryptographic resource allocation system for subscription-based cloud cryptographic services according to claim 4, characterized in that: The password resource integration module includes: The key management unit is used to manage key resources, create required key resources and feed them back to the cryptographic resource integration module; The hardware password resource management unit is used to manage hardware password resources, create hardware password resources of required specifications and quantity, and feed back to the password resource integration module.

6. A cryptographic resource allocation system for subscription-based cloud cryptographic services according to claim 4, characterized in that: The cryptographic resource association module is also used to feed back the identity ID of the cryptographic resource logical entity to the cloud cryptographic service.

Images