Password resource allocation method, apparatus and device, and computer storage medium

Abstract

The invention provides a password resource allocation method, device and equipment and a computer storage medium, relates to the technical field of computers, and is used for improving the utilization efficiency of password resources. The method comprises the following steps: continuously obtaining a target data stream; dividing the target data stream into at least two sub-data streams based on a preset time interval; the acquisition time corresponding to the data contained in each sub-data stream is in the same time period, and the time periods corresponding to different sub-data streams are different; acquiring corresponding flow change information based on a target sub-data stream corresponding to a target time period in which the current time is located and an adjacent sub-data stream corresponding to an adjacent time period adjacent to the target time period; the flow change information represents the change condition of the data volume of the target data flow along with time in unit time; based on the traffic change information, adjusting the access number of the password devices in the password device group; and providing a password service for the target data stream based on the adjusted password device group.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device and equipment for allocating cryptographic resources and a computer storage medium. Background Art

[0002] With the continuous development of science and society, combining one's own business with the Internet has become a general development trend in all walks of life. In such a situation, an unavoidable problem is how to ensure the security of information transmission and storage on the Internet. For this reason, information security technology has become the technology of all information technologies. Among the technologies related to information security, cryptographic equipment, as the core of information security, has become an important part of the information system and also a risk point in the application of the information system.

[0003] A cryptographic device (cryptographic machine for short) is a hardware device specially designed to provide cryptographic services such as data encryption, decryption, digital signature and signature verification. Its main purpose is to ensure the security of stored and transmitted data and prevent unauthorized access and data leakage.

[0004] However, in the related art, in a data center or service system, the cryptographic devices providing cryptographic services are usually pre-set, which results in the cryptographic resources that the cryptographic service can provide being fixed, but the data traffic required by the cryptographic server being not fixed. This results in the cryptographic resources provided by the cryptographic service being insufficient when the data traffic is too large, resulting in low efficiency of the encryption business and even downtime problems; and when the data traffic is small, the cryptographic resources provided by the cryptographic service are excessive, resulting in a waste of cryptographic resources.

[0005] Therefore, how to manage and allocate cryptographic resources to improve the utilization efficiency of cryptographic resources is a technical problem that needs to be solved urgently. Summary of the invention

[0006] The embodiments of the present application provide a method, apparatus, device and computer storage medium for allocating cryptographic resources, so as to improve the utilization efficiency of cryptographic resources.

[0007] In a first aspect, an embodiment of the present application provides a method for allocating cryptographic resources, including:

[0008] Continuously acquiring a target data stream, the target data stream being provided with cryptographic services by a preset cryptographic device group;

[0009] Based on a preset time interval, the target data stream is divided into at least two sub-data streams; wherein the acquisition time corresponding to the data contained in each sub-data stream is in the same time period, and different sub-data streams correspond to different time periods;

[0010] Based on the target sub-data stream corresponding to the target time period at the current time, and the adjacent sub-data stream corresponding to the adjacent time period adjacent to the target time period, corresponding flow change information is obtained; the flow change information represents: the data volume of the target data stream per unit time, and the change over time;

[0011] Based on the traffic change information, adjusting the access quantity of the cryptographic devices in the cryptographic device group;

[0012] Based on the adjusted cryptographic device group, cryptographic services are provided for the target data stream.

[0013] Optionally, the acquiring corresponding traffic change information based on the target sub-data flow corresponding to the target time period in which the current time is located, and the adjacent sub-data flow corresponding to the adjacent time period adjacent to the target time period, includes:

[0014] Based on the length of the target time period and the data volume of the target sub-data flow acquired in the target time period, acquiring the corresponding target time period flow;

[0015] Based on the length of the adjacent time period and the amount of data of the adjacent sub-data flow obtained in the adjacent time period, obtaining the corresponding adjacent time period flow;

[0016] Based on the difference between the flow rate in the target time period and the flow rate in the adjacent time period, corresponding flow rate change information is obtained.

[0017] Optionally, adjusting the access quantity of the cryptographic devices in the cryptographic device group based on the traffic change information includes:

[0018] When the traffic change information indicates that the traffic has increased, a resource address of a newly added cryptographic device is obtained, and the resource address is added to a configuration file corresponding to the cryptographic device group, so as to increase the number of access cryptographic devices in the cryptographic device group;

[0019] When the traffic change information indicates that the traffic is reduced, the resource addresses of the preset number of cryptographic devices recorded in the configuration file corresponding to the cryptographic device group are deleted to reduce the number of access cryptographic devices in the cryptographic device group.

[0020] Optionally, in the cryptographic device group, the data processing specifications corresponding to the cryptographic devices are different;

[0021] Then, the cryptographic device group based on the adjustment provides cryptographic services for the target data stream, including:

[0022] For each piece of data to be processed in the target data stream, perform the following operations respectively:

[0023] Obtaining a request identifier corresponding to the data to be processed; the request identifier represents: a target data processing specification corresponding to the data to be processed;

[0024] Based on the target data processing specification, encapsulating the data to be processed into first data having a target data format corresponding to the target data processing specification;

[0025] Sending the first data to a target cryptographic device corresponding to the target data processing specification, so that the target cryptographic device performs a data processing operation on the first data and feeds back a processing result;

[0026] Receive the processing result from the target cryptographic device, encapsulate the processing result into second data with a preset data format; and set a corresponding specification identifier for the second data; wherein the specification identifier is used to characterize the data processing specification corresponding to the second data.

[0027] Optionally, the cryptographic devices in the cryptographic device group correspond to different operating systems;

[0028] Before continuously acquiring the target data stream, the method further includes:

[0029] Selecting a cryptographic device as a source cryptographic device, and selecting a cryptographic device having an operating system different from the source operating system corresponding to the source cryptographic device as a target cryptographic device;

[0030] Obtaining source key data in a source operating system corresponding to the source cryptographic device;

[0031] Based on the source key data, the target key data in the target cryptographic device is replaced so that the operating systems of the cryptographic devices in the cryptographic device group have the same source key data.

[0032] Optionally, replacing the target key data in the target cryptographic device based on the source key data includes:

[0033] Based on the operating system of the target cryptographic device, generating a corresponding original image file;

[0034] Deleting the target key data in the original image file, and adding the source key data to the original image file to obtain a corresponding target image file;

[0035] Push the target image file to the target cryptographic device.

[0036] In a second aspect, an embodiment of the present application provides a device for allocating cryptographic resources, including:

[0037] An acquisition module, used for continuously acquiring a target data stream, the target data stream being provided with a cryptographic service by a preset cryptographic device group;

[0038] A division module, used for dividing the target data stream into at least two sub-data streams based on a preset time interval; wherein the acquisition time corresponding to the data contained in each sub-data stream is in the same time period, and different sub-data streams correspond to different time periods;

[0039] A processing module, configured to obtain corresponding flow change information based on a target sub-data flow corresponding to a target time period at a current time and an adjacent sub-data flow corresponding to an adjacent time period adjacent to the target time period; the flow change information represents: the data volume of the target data flow per unit time, and the change over time;

[0040] The adjustment module is used to adjust the access quantity of the cryptographic devices in the cryptographic device group based on the traffic change information; and provide cryptographic services for the target data flow based on the adjusted cryptographic device group.

[0041] Optionally, the processing module is used to obtain corresponding traffic change information based on the target sub-data flow corresponding to the target time period in which the current time is located, and the adjacent sub-data flow corresponding to the adjacent time period adjacent to the target time period, specifically for:

[0042] Based on the length of the target time period and the data volume of the target sub-data flow acquired in the target time period, acquiring the corresponding target time period flow;

[0043] Based on the length of the adjacent time period and the amount of data of the adjacent sub-data flow obtained in the adjacent time period, obtaining the corresponding adjacent time period flow;

[0044] Based on the difference between the flow rate in the target time period and the flow rate in the adjacent time period, corresponding flow rate change information is obtained.

[0045] Optionally, when the adjustment module is used to adjust the access quantity of the cryptographic devices in the cryptographic device group based on the traffic change information, it is specifically used to:

[0046] When the traffic change information indicates that the traffic has increased, a resource address of a newly added cryptographic device is obtained, and the resource address is added to a configuration file corresponding to the cryptographic device group, so as to increase the number of access cryptographic devices in the cryptographic device group;

[0047] When the traffic change information indicates that the traffic is reduced, the resource addresses of the preset number of cryptographic devices recorded in the configuration file corresponding to the cryptographic device group are deleted to reduce the number of access cryptographic devices in the cryptographic device group.

[0048] Optionally, in the cryptographic device group, the cryptographic devices correspond to different data processing specifications; then the adjustment module is used to provide cryptographic services for the target data stream based on the adjusted cryptographic device group, specifically for:

[0049] For each piece of data to be processed in the target data stream, perform the following operations respectively:

[0050] Obtaining a request identifier corresponding to the data to be processed; the request identifier represents: a target data processing specification corresponding to the data to be processed;

[0051] Based on the target data processing specification, encapsulating the data to be processed into first data having a target data format corresponding to the target data processing specification;

[0052] Sending the first data to a target cryptographic device corresponding to the target data processing specification, so that the target cryptographic device performs a data processing operation on the first data and feeds back a processing result;

[0053] Receive the processing result from the target cryptographic device, encapsulate the processing result into second data with a preset data format; and set a corresponding specification identifier for the second data; wherein the specification identifier is used to characterize the data processing specification corresponding to the second data.

[0054] Optionally, the cryptographic devices in the cryptographic device group correspond to different operating systems; then before continuously acquiring the target data stream, the acquisition module is further used to:

[0055] Selecting a cryptographic device as a source cryptographic device, and selecting a cryptographic device having an operating system different from the source operating system corresponding to the source cryptographic device as a target cryptographic device;

[0056] Obtaining source key data in a source operating system corresponding to the source cryptographic device;

[0057] Based on the source key data, the target key data in the target cryptographic device is replaced so that the operating systems of the cryptographic devices in the cryptographic device group have the same source key data.

[0058] Optionally, when the acquisition module is used to replace the target key data in the target cryptographic device based on the source key data, it is specifically used to:

[0059] Based on the operating system of the target cryptographic device, generating a corresponding original image file;

[0060] Deleting the target key data in the original image file, and adding the source key data to the original image file to obtain a corresponding target image file;

[0061] Push the target image file to the target cryptographic device.

[0062] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the at least one processor executes the method described in the first aspect or any optional embodiment of the first aspect.

[0063] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the method in the first aspect or any optional implementation of the first aspect is implemented.

[0064] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, wherein the computer program product stores instructions that, when executed on a computer, enable the computer to execute the method described in the first aspect or any optional implementation of the first aspect.

[0065] The beneficial effects of this application are as follows:

[0066] In this solution, by continuously acquiring the target data flow, the change trend of the data flow that requires cryptographic service is determined according to the change of the flow rate per unit time on the time scale of the target data flow, and based on the change trend, the access number of the cryptographic devices accessing the cryptographic device group is adjusted. In this way, the cryptographic resources that can be provided by the cryptographic device group can be adjusted at any time according to the change trend of the flow rate, so that the supply and demand of cryptographic resources are in a state of dynamic balance, which avoids the situation where too much cryptographic resources are provided but the demand is small, resulting in the waste of control of some cryptographic resources, and avoids the situation where too few cryptographic resources are provided but the demand is large, resulting in the overload of the cryptographic device and the possible reduction of data processing efficiency, or the downtime caused by the overload. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0068] Figure 1 A schematic diagram of possible application scenarios provided for embodiments of the present application;

[0069] Figure 2 A flowchart of a method for allocating cryptographic resources provided in an embodiment of the present application;

[0070] Figure 3 A schematic diagram of data traffic corresponding to a time period provided in an embodiment of the present application;

[0071] Figure 4 A logical diagram of target data traffic distribution provided by an embodiment of the present application;

[0072] Figure 5 A flowchart of a method for obtaining flow change information provided in an embodiment of the present application;

[0073] Figure 6 A schematic diagram of the length corresponding to a time period provided in an embodiment of the present application;

[0074] Figure 7 A logical schematic diagram of a cryptographic resource management method provided in an embodiment of the present application;

[0075] Figure 8 A flowchart of a packaging method proposed in an embodiment of the present application;

[0076] Fig. 9 A logic schematic diagram of a packaging method proposed in an embodiment of the present application;

[0077] Fig.10 A logical schematic diagram of a method for obtaining a target image file proposed in an embodiment of the present application;

[0078] Fig.11 A logical schematic diagram of a method for pushing a target image file proposed in an embodiment of the present application;

[0079] Fig.12 A schematic diagram of the structure of a cryptographic resource allocation device provided in an embodiment of the present application;

[0080] Fig.13 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0082] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0083] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0084] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0085] With the continuous development of science and society, more and more industries choose to transfer their business data to online processing. Therefore, information security is an important concern when transmitting data on the Internet. Among the technologies related to information security, cryptographic devices, as the core of information security, have become an important part of the information system and also a risk point in the application of the information system.

[0086] However, in the related art, in a data center or service system, the cryptographic devices providing cryptographic services are usually pre-set, which results in the cryptographic resources that the cryptographic service can provide being fixed, but the data traffic required by the cryptographic server is not fixed. This results in the cryptographic resources provided by the cryptographic service being insufficient when the data traffic is too large, resulting in low efficiency of the encryption business and even downtime problems; and when the data traffic is small, the cryptographic resources provided by the cryptographic service are excessive, resulting in a waste of cryptographic resources.

[0087] In view of this, the present application proposes a method for allocating cryptographic resources to improve the utilization efficiency of cryptographic resources. First, it is necessary to continuously obtain a target data stream, which is provided with cryptographic services by a preset cryptographic device group. In other words, it is necessary to continuously obtain a target data stream that needs to use cryptographic services. Then, based on a preset time interval, the target data can be divided into at least two sub-data streams. The acquisition events corresponding to the data contained in each of the at least two sub-data streams are all in the same time period, and different sub-data streams correspond to different time periods.

[0088] Next, based on the target sub-data stream corresponding to the target time period of the current time, and the adjacent sub-data stream corresponding to the adjacent event segment adjacent to the target time period, the flow change information is obtained to characterize how the amount of data in the unit data stream changes over time within a unit time. In this way, the number of access cryptographic devices in the cryptographic device group can be adjusted according to the flow change information, so that cryptographic services can be provided for the target data stream according to the adjusted cryptographic device group.

[0089] In this way, the number of access cryptographic devices in the cryptographic device group is dynamically adjusted as the traffic of the target data stream changes, which can effectively improve the utilization efficiency of cryptographic resources and prevent the waste of cryptographic resources.

[0090] After completing the introduction of the main inventive ideas of the embodiments of the present application, the specific implementation of the method for allocating cryptographic resources proposed in the embodiments of the present application will be introduced below through some specific embodiments and drawings.

[0091] The following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0092] See also Figure 1 , which is a schematic diagram of a possible application scenario provided in an embodiment of the present application. In this scenario, a terminal device 101 and a server 102 may be included.

[0093] The terminal device 101 may be a mobile phone, a tablet computer (PAD), a personal computer (PC), a wearable device, a vehicle-mounted terminal, etc. The server 102 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0094] The terminal device 101 and the server 102 may be directly or indirectly connected to each other through one or more communication networks 103. The communication network 103 may be a wired network or a wireless network, for example, a mobile cellular network or a wireless fidelity (Wireless-Fidelity, WIFI) network, or other possible networks, which are not limited in the embodiment of the present invention.

[0095] It should be noted that the method for allocating cryptographic resources in the embodiment of the present application can be executed by a computer device, which can be a terminal device 101 or a server 102. For example, when the method for allocating cryptographic resources is performed by the server 102, the server can obtain target data streams from various terminal devices or other servers, and then determine the adjustment method for the number of cryptographic devices accessed in the cryptographic device group according to the data volume of the target data stream per unit time within a set time range in the target data stream, and the change over time, and provide cryptographic services for the target data stream based on the adjusted cryptographic device group.

[0096] It should be noted that Figure 1 What is shown is just an example. In fact, the number and communication mode of terminal devices and servers are not limited and are not specifically limited in the embodiments of the present application.

[0097] The following describes the method of cryptographic resource allocation provided by the exemplary embodiment of the present application in combination with the application scenario described above and with reference to the accompanying drawings. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this regard.

[0098] See also Figure 2 , is a flow chart of a method for allocating cryptographic resources provided in an embodiment of the present application, and the execution subject of the method may be Figure 1The terminal device and / or server shown in the figure is not limited in this application. For the convenience of subsequent description, the data processing method proposed in this application will be introduced below by taking the execution subject as a server as an example.

[0099] like Figure 2 As shown, the specific implementation steps of this method are as follows:

[0100] Step S201: continuously acquiring a target data stream, the target data stream being provided with cryptographic services by a preset cryptographic device group.

[0101] When the server starts the cryptographic service for data, it will first set up the corresponding cryptographic device group according to the preset configuration parameters of the cryptographic device group. The cryptographic device group includes at least one cryptographic device, and the specific number of cryptographic devices is determined by the cryptographic resources that can be provided by a cryptographic device and the maximum cryptographic resources that the server needs to provide.

[0102] For example, assuming that the server needs to provide cryptographic services for the transmission and storage of data in a cloud storage system, then when initializing the configuration of the cryptographic device group, the server needs to estimate the maximum business data volume of the cloud storage system, and then set the original cryptographic device group based on the cryptographic resources required for the maximum business data volume. At this time, the cryptographic resources provided by the connected cryptographic devices in the cryptographic device group can cover the cryptographic resource requirements for the maximum business data volume of the cloud storage system.

[0103] However, under normal circumstances, the maximum amount of business data is not always maintained in the cloud storage system. Therefore, if the maximum number of device accesses is always maintained in the cryptographic device group, it will cause idle waste of cryptographic resources. Therefore, this application proposes a cryptographic resource allocation method to improve the utilization rate of cryptographic resources.

[0104] The target data stream mentioned in the above step S201 is the data that requires cryptographic services provided by the cryptographic device group. This data can come from different business servers or systems, and this application does not make any distinction. However, no matter what the source of this data is, it needs to be provided with cryptographic services by the cryptographic device group, that is, encryption, decryption, digital signature, signature authentication and other services.

[0105] Data from different servers or systems will be continuously transmitted to the server providing cryptographic services. Therefore, the server providing cryptographic services can continuously obtain the target data stream for subsequent operations.

[0106] Step S202: based on a preset time interval, the target data stream is divided into at least two sub-data streams; wherein the acquisition time corresponding to the data contained in each sub-data stream is in the same time period, and each sub-data stream corresponds to a different time period.

[0107] The server continuously obtains the target data stream. Therefore, for these data streams, the server can divide them according to a preset time interval; wherein, the preset time interval can be set according to the actual needs of the application, such as one minute or half a minute, etc., and this application does not impose any restrictions on this.

[0108] When the server continuously obtains the target data stream, the server can divide the time into different time periods according to the time interval, and the data stream obtained in the same time period can be used as the sub-data stream corresponding to the time period. In this way, the target data stream is divided into at least two sub-data streams.

[0109] Exemplarily, assuming that the preset time interval is T, the data stream obtained in the time period [0, T) can be used as sub-data stream 1, the data stream obtained in the time period [T, 2T) can be used as sub-data stream 2, and so on, until the current time, the server can obtain n sub-data streams.

[0110] It should be noted that if Figure 3 As shown, since the server continuously obtains the target data stream, but the amount of data contained in the obtained data stream is not evenly distributed, the amount of data contained in the at least two sub-data streams obtained by division is not necessarily the same.

[0111] In a possible implementation manner, the server may obtain the sub-data stream in the following manner:

[0112] When acquiring the target data stream, the server may set corresponding time identifiers for the data streams received in different time periods according to preset time intervals, so as to characterize the corresponding relationship between the data stream and the time period.

[0113] For example, assume that the server has Figure 4 The structure shown executes the above method, wherein the time slicer sets corresponding time markers for the data in the target data stream, and the generator forwards the data with the markers set to the corresponding receiving queue.

[0114] So if Figure 4 As shown in the figure, a data stream X{.....} will have a time marker t added to it after passing through the time slicer. i , and get the data stream X{.....,t i}, where i is the serial number of the time identifier.

[0115] And the data stream X{.....,t iAfter passing through the generator, it will be sent to the corresponding receiving queue based on the time stamp in it. Figure 4 As shown, different data stream receiving queues correspond to different time periods. In other words, data streams received in the same time period will be sent to the same data stream receiving queue. The data in these receiving queues will be transmitted to the cryptographic device group based on the first-in-first-out principle to execute the corresponding cryptographic service.

[0116] Step S203: Based on the target sub-data flow corresponding to the target time period of the current time, and the adjacent sub-data flow corresponding to the adjacent time period adjacent to the target time period, obtain corresponding traffic change information; wherein, the traffic change information represents: the data volume of the target data flow per unit time, and how it changes over time.

[0117] For sub-data streams in different time periods, the server can use the current time period as the target time period, and obtain the time period adjacent to the target time period as the adjacent time period. In this way, the target sub-data stream corresponding to the target time period and the adjacent sub-data stream corresponding to the adjacent time period can obtain corresponding traffic change information to characterize: the data volume of the target data stream per unit time changes over time.

[0118] In a possible implementation manner, when the server obtains the flow change information, it can Figure 5 The method shown is carried out.

[0119] See also Figure 5 , is a flow chart of a method for obtaining flow change information provided by an embodiment of the present application, such as Figure 5 As shown, the specific implementation steps of this method are as follows:

[0120] Step S501: based on the length of the target time period and the data volume of the target sub-data flow acquired in the target time period, the corresponding target time period flow is acquired.

[0121] Step S502: Based on the length of the adjacent time period and the data volume of the adjacent sub-data flow obtained in the adjacent time period, the corresponding adjacent time period flow is obtained.

[0122] Among them, Figure 6 As shown, since the time length of the target time period of the current time is not necessarily the same as the time length of the adjacent time period, it is necessary to obtain the corresponding time period traffic for the sub-data flows corresponding to the target time period and the adjacent time period respectively.

[0123] Specifically, the data flow in different time periods can be obtained in the same way, that is, the data flow is obtained by dividing the amount of data in the sub-data stream received in the corresponding time period by the corresponding time length.

[0124] After obtaining the target time period traffic and adjacent time period traffic in this way, the server can continue to perform the following operations:

[0125] Step S503: Based on the difference between the flow rate in the target time period and the flow rate in the adjacent time period, corresponding flow rate change information is obtained.

[0126] In this way, through the flow difference between two adjacent time periods, the server can determine the flow change information corresponding to the target data flow at the current time.

[0127] The flow change information can represent different contents. For example, the flow change information can be used to determine the flow change trend based on the relationship between the difference and zero, that is:

[0128] When the difference is greater than zero, it is considered that the trend is rising, the pressure on the cryptographic equipment group to process data is increasing, and the cryptographic resources can be appropriately increased;

[0129] When the difference is equal to zero, the trend remains unchanged, the cryptographic equipment group has appropriate data processing capabilities, and the current cryptographic resources remain unchanged;

[0130] When the difference is less than zero, it is considered that the trend is decreasing and the cryptographic device group has excess data processing capacity, so some cryptographic resources can be removed.

[0131] Furthermore, in addition to the zero mentioned above, the difference can also be compared with other thresholds, that is, only when the difference is greater than a certain threshold, indicating that the trend change is more obvious, the number of access devices in the cryptographic device group needs to be adjusted.

[0132] After the server obtains the corresponding traffic change information, it can continue to perform the following operations:

[0133] Step S204: Based on the traffic change information, the access quantity of the cryptographic devices in the cryptographic device group is adjusted.

[0134] The server will adjust the number of access devices in the cryptographic device group according to the meaning represented by the traffic change information.

[0135] In a possible implementation manner, the server may adjust the access quantity in the following manner:

[0136] When the traffic change information indicates that the traffic has increased, the resource address of the newly added cryptographic device is obtained, and the resource address is added to the configuration file corresponding to the cryptographic device group to increase the number of access cryptographic devices in the cryptographic device group;

[0137] When the traffic change information indicates that the traffic is reduced, the resource addresses of the preset number of cryptographic devices recorded in the configuration file corresponding to the cryptographic device group are deleted to reduce the number of access cryptographic devices in the cryptographic device group.

[0138] Step S205: Based on the adjusted cryptographic device group, provide cryptographic services for the target data stream.

[0139] In this way, the server can provide cryptographic services for the target data stream based on the adjusted cryptographic device group.

[0140] In this solution, by continuously acquiring the target data flow, the change trend of the data flow that requires cryptographic service is determined according to the change of the flow rate per unit time on the time scale of the target data flow, and based on the change trend, the access number of the cryptographic devices accessing the cryptographic device group is adjusted. In this way, the cryptographic resources that can be provided by the cryptographic device group can be adjusted at any time according to the change trend of the flow rate, so that the supply and demand of cryptographic resources are in a state of dynamic balance, which avoids the situation where too much cryptographic resources are provided but the demand is small, resulting in the waste of control of some cryptographic resources, and avoids the situation where too few cryptographic resources are provided but the demand is large, resulting in the overload of the cryptographic device and the possible reduction of data processing efficiency, or the downtime caused by the overload.

[0141] The above introduces some possible implementation methods of the cryptographic resource management method provided in the embodiments of the present application. In order to clarify the above scheme, the method will be introduced as a whole through an example below.

[0142] See also Figure 7 , is a logical diagram of a cryptographic resource management method provided in an embodiment of the present application, such as Figure 7 As shown, the specific implementation steps of this method are as follows:

[0143] The cryptographic device group needs to provide cryptographic services for the business server or business system. Therefore, the business server or business system will continue to transmit data to the cryptographic device group. At this time, the cryptographic server corresponding to the cryptographic device group can continuously obtain the target data stream and input the target data stream into the time slicer, so that the time slicer sets the corresponding time identifier for the data input to the time slicer based on the preset time interval, and then transmits it to the generator. The generator sends each data stream to the corresponding receiving queue, and finally the data in the queue with the smallest queue number in the receiving queue is transmitted to the cryptographic device group according to the first-in-first-out principle.

[0144] At the same time, the generator can also obtain corresponding traffic change information based on the data volume information of the sub-data streams with different time identifiers, and then transmit the traffic change information to the decision analyzer, which determines the adjustment strategy of the cryptographic device group and transmits the adjustment strategy to the cryptographic device group.

[0145] On the other hand, the cryptographic device group has a structure such as Figure 7 As shown, it includes structures such as device selector, decision executor, dynamic forwarding configuration library, and dynamic forwarder.

[0146] The device selector receives the target data stream from the receiving queue and transmits it to the dynamic forwarder. The decision executor receives the adjustment policy from the generator and transmits the adjustment policy to the dynamic forwarding configuration library. The dynamic forwarding configuration library adjusts the access quantity of the cryptographic device based on the adjustment policy.

[0147] Exemplarily, after receiving the adjustment strategy from the generator, the decision executor may convert the adjustment strategy into a corresponding enumeration value (Add, Delete, Keep), and then forward the enumeration value to the dynamic configuration library to perform related operations on password resource configuration.

[0148] Among them, when the enumeration value is Add, the original cryptographic device resources remain unchanged, and then the newly added working cryptographic device resource address is filled in the dynamic configuration library. When the configuration file is saved, it will trigger the dynamic forwarder to load the latest configuration into the memory and perform the forwarding operation of the target data stream.

[0149] When the enumeration value is Delete, the original cryptographic device resources need to be deleted. The decision executor will use a random strategy to delete the cryptographic device resources in the configuration file. Each decision result only affects one record. When the cryptographic device resource configuration file is saved, it will trigger the dynamic forwarder to load the latest configuration into the memory and perform the forwarding operation of the target data flow.

[0150] When the enumeration value is Keep, the password device resource remains unchanged.

[0151] In this way, the cryptographic server completes the adjustment of the cryptographic device group, and then can provide cryptographic services for the target data stream based on the adjusted cryptographic device group.

[0152] The above introduces the method of allocating cryptographic resources, including the method of increasing the number of cryptographic device accesses. In actual applications, cryptographic devices may come from multiple manufacturers, which may lead to inconsistent models and manufacturers of cryptographic devices, which in turn leads to large differences in the implementation of interfaces in different cryptographic devices. For example, in cryptographic devices provided by different manufacturers, even if the data interfaces with the same functions are provided, the corresponding data processing specifications may be different. For example, the method of generating the public key fingerprint of the cryptographic device of manufacturer 1 is:

[0153] Signature1=Base64(SM3(password));

[0154] The method for generating the public key fingerprint of the cryptographic device of manufacturer 2 is:

[0155] Signature2=SM3(Base64(password));

[0156] The public key fingerprint generation function provided by the two has different data processing specifications corresponding to it.

[0157] Therefore, the present application proposes a compatibility method for devices of different types and manufacturers.

[0158] In a possible implementation, in a cryptographic device group, the data processing specifications corresponding to the cryptographic devices are different. For this purpose, the present application proposes the following implementation:

[0159] See also Figure 8 , which is a flow chart of an encapsulation method proposed in an embodiment of the present application. In order to clarify the specific implementation steps of the method, the following will introduce the method by targeting a piece of data to be processed in the target data stream, such as Figure 8 As shown, the specific implementation steps of this method are as follows:

[0160] Step S801: Obtain a request identifier corresponding to the data to be processed, where the request identifier represents: a target data processing specification corresponding to the data to be processed.

[0161] Since there are cryptographic devices with different corresponding data processing specifications in the cryptographic device group, the data to be processed in the target data stream that needs to provide cryptographic services by the cryptographic device group needs to carry the corresponding request identifier to represent the target data processing specification that it expects to use. Furthermore, in order to ensure the smooth progress of the cryptographic service, different business systems or users using the cryptographic services provided by the cryptographic device group need to indicate a fixed data processing specification to ensure the correct progress of the encryption, decryption, verification and other processes.

[0162] Step S802: Based on the target data processing specification, encapsulate the data to be processed into first data having a target data format corresponding to the target data processing specification.

[0163] In this way, after the server encapsulates the data to be processed into the first data, the first data can be distributed to the corresponding cryptographic device based on its corresponding request identifier, that is:

[0164] Step S803: Send the first data to a target cryptographic device corresponding to the target data processing specification, so that the target cryptographic device performs a data processing operation on the first data and feeds back a processing result.

[0165] After the first data is sent to the target cryptographic device, the target cryptographic device can perform corresponding data processing operations on the first data, such as encryption or decryption or data signing or signature verification, etc. This application does not impose any restrictions on this.

[0166] When the server receives the processing result fed back by the target cryptographic device, it can perform the following operations:

[0167] Step S804: receiving the processing result from the target cryptographic device, encapsulating the processing result into second data having a preset data format; and setting a corresponding specification identifier for the second data; wherein the specification identifier is used to characterize the data processing specification corresponding to the second data.

[0168] After receiving the processing result, the processing result is a processing result with a target data format. For the cryptographic device group, it includes multiple data processing specifications, which will include multiple target data formats. However, for the business server or business system that uses the cryptographic service provided by the cryptographic device group, when facing the cryptographic device group, it does not expect to obtain data with different data formats.

[0169] Therefore, after receiving the processing result, the server will encapsulate the processing result into second data with a preset data format, so that the data returned to various business systems will have the same data format, that is, the preset data format.

[0170] In this way, from the perspective of the upper layer application, it cannot perceive the various data transmission specifications existing in the cryptographic device group, thereby ensuring the consistency and standardization of the cryptographic services used. Fig. 9 As shown, the above operations are integrated in the device middle layer for execution. In this way, the target data from the business system will enter the device middle layer through the device selector, and after being encapsulated, it will be sent to the cryptographic devices corresponding to different data processing specifications. The processing results are then fed back to the device middle layer, and then uniformly encapsulated to obtain the second data with a preset data format, and then the processing results are returned to the business system.

[0171] In a possible implementation, the cryptographic devices in the cryptographic device group have different corresponding operating systems. Thus, when creating a cryptographic device group using different cryptographic devices, the following operations need to be performed:

[0172] First, a cryptographic device is selected as a source cryptographic device, and a cryptographic device having an operating system different from the source operating system corresponding to the source cryptographic device is selected as a target cryptographic device.

[0173] Next, the source key data in the source operating system corresponding to the source cryptographic device is obtained.

[0174] For the cryptographic devices in a cryptographic device group, since the cryptographic services they provide need to be consistent, all the cryptographic devices in the cryptographic device group need to have the same key data. To this end, the server can select a cryptographic device as the source cryptographic device and use the key data contained therein as the source key data. Optionally, the source key data can be data pre-set and input into the source cryptographic device by an administrator, and this application does not limit this.

[0175] Finally, based on the source key data, the target key data in the target cryptographic device is replaced so that the operating systems of the cryptographic devices in the cryptographic device group have the same source key data.

[0176] The source key data is used to replace the target key data in other cryptographic devices, so that all cryptographic devices in the cryptographic device group have the same source key data. In this way, the cryptographic services provided by the cryptographic device group can be consistent.

[0177] Optionally, during the process of replacing the target cryptographic device, the server can complete the process in the following ways:

[0178] like Fig.10 As shown, the server first generates a corresponding original image file based on the operating system of the target cryptographic device, then deletes the target key data therein, and adds the source key data to the corresponding address of the original image file, so that the corresponding target image file can be obtained.

[0179] Next, the obtained target image file is pushed to the corresponding target cryptographic device to complete the replacement of the key data in the target cryptographic device.

[0180] It should be noted that, since there may be multiple operating systems in the cryptographic device group, Fig.11 As shown, after selecting a cryptographic device corresponding to an operating system as the source cryptographic device, for other types of cryptographic devices, the server needs to perform the above operations respectively, and then use the source key data to replace the key data of different operating systems.

[0181] Based on the same inventive concept, an embodiment of the present application also provides a device for allocating cryptographic resources.

[0182] See also Fig.12 , which is a structural diagram of a device for allocating cryptographic resources provided in an embodiment of the present application. The device may be the above-mentioned server or a chip or integrated circuit in the device, etc. The device includes a module / unit / technical means for executing the method executed by the server in the above-mentioned method embodiment.

[0183] Exemplarily, the device 1200 includes:

[0184] The acquisition module 1201 is used to continuously acquire a target data stream, where the target data stream is provided with a cryptographic service by a preset cryptographic device group;

[0185] The division module 1202 is used to divide the target data stream into at least two sub-data streams based on a preset time interval; wherein the acquisition time corresponding to the data contained in each sub-data stream is in the same time period, and different sub-data streams correspond to different time periods;

[0186] The processing module 1203 is used to obtain corresponding flow change information based on the target sub-data flow corresponding to the target time period at the current time and the adjacent sub-data flow corresponding to the adjacent time period adjacent to the target time period; the flow change information represents: the data volume of the target data flow per unit time, and the change over time;

[0187] The adjustment module 1204 is used to adjust the access quantity of the cryptographic devices in the cryptographic device group based on the traffic change information; and provide cryptographic services for the target data flow based on the adjusted cryptographic device group.

[0188] Optionally, the processing module 1203 is used to obtain corresponding traffic change information based on the target sub-data flow corresponding to the target time period in which the current time is located, and the adjacent sub-data flow corresponding to the adjacent time period adjacent to the target time period, specifically for:

[0189] Based on the length of the target time period and the data volume of the target sub-data flow acquired in the target time period, acquiring the corresponding target time period flow;

[0190] Based on the length of the adjacent time period and the amount of data of the adjacent sub-data flow obtained in the adjacent time period, obtaining the corresponding adjacent time period flow;

[0191] Based on the difference between the flow rate in the target time period and the flow rate in the adjacent time period, corresponding flow rate change information is obtained.

[0192] Optionally, the adjustment module 1204 is used to adjust the access quantity of the cryptographic devices in the cryptographic device group based on the traffic change information, specifically to:

[0193] When the traffic change information indicates that the traffic has increased, a resource address of a newly added cryptographic device is obtained, and the resource address is added to a configuration file corresponding to the cryptographic device group, so as to increase the number of access cryptographic devices in the cryptographic device group;

[0194] When the traffic change information indicates that the traffic is reduced, the resource addresses of the preset number of cryptographic devices recorded in the configuration file corresponding to the cryptographic device group are deleted to reduce the number of access cryptographic devices in the cryptographic device group.

[0195] Optionally, in the cryptographic device group, the data processing specifications corresponding to the cryptographic devices are different; then the adjustment module 1204 is used to provide cryptographic services for the target data stream based on the adjusted cryptographic device group, specifically for:

[0196] For each piece of data to be processed in the target data stream, perform the following operations respectively:

[0197] Obtaining a request identifier corresponding to the data to be processed; the request identifier represents: a target data processing specification corresponding to the data to be processed;

[0198] Based on the target data processing specification, encapsulating the data to be processed into first data having a target data format corresponding to the target data processing specification;

[0199] Sending the first data to a target cryptographic device corresponding to the target data processing specification, so that the target cryptographic device performs a data processing operation on the first data and feeds back a processing result;

[0200] Receive the processing result from the target cryptographic device, encapsulate the processing result into second data with a preset data format; and set a corresponding specification identifier for the second data; wherein the specification identifier is used to characterize the data processing specification corresponding to the second data.

[0201] Optionally, the cryptographic devices in the cryptographic device group correspond to different operating systems; then before continuously acquiring the target data stream, the acquisition module 1201 is further used to:

[0202] Selecting a cryptographic device as a source cryptographic device, and selecting a cryptographic device having an operating system different from the source operating system corresponding to the source cryptographic device as a target cryptographic device;

[0203] Obtaining source key data in a source operating system corresponding to the source cryptographic device;

[0204] Based on the source key data, the target key data in the target cryptographic device is replaced so that the operating systems of the cryptographic devices in the cryptographic device group have the same source key data.

[0205] Optionally, when the acquisition module 1201 is used to replace the target key data in the target cryptographic device based on the source key data, it is specifically used to:

[0206] Based on the operating system of the target cryptographic device, generating a corresponding original image file;

[0207] Deleting the target key data in the original image file, and adding the source key data to the original image file to obtain a corresponding target image file;

[0208] Push the target image file to the target cryptographic device.

[0209] As an example, Fig.12 The apparatus described can be used to perform Figure 2 Therefore, for the functions that can be realized by each functional module of the device, reference can be made to Figure 2 The description of the illustrated embodiment will not be repeated here.

[0210] It should be noted that, although several modules or submodules of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more units described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be embodied.

[0211] As a possible product form of the above device, see Fig.13 The embodiment of the present application further provides an electronic device 1300, including:

[0212] At least one processor 1301; and a communication interface 1303 that is communicatively connected to the at least one processor 1301; the at least one processor 1301 executes instructions stored in the memory 1302, so that the electronic device 1300 executes the method steps performed by any device in the above method embodiments through the communication interface 1303.

[0213] Optionally, the memory 1302 is located outside the electronic device 1300 .

[0214] Optionally, the electronic device 1300 includes the memory 1302, the memory 1302 is connected to the at least one processor 1301, and the memory 1302 stores instructions that can be executed by the at least one processor 1301. Fig.13 The dashed lines indicate that the memory 1302 is optional for the electronic device 1300 .

[0215] The processor 1301 and the memory 1302 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0216] The specific connection medium between the processor 1301, the memory 1302 and the communication interface 1303 is not limited in the embodiment of the present application. Fig.13 The processor 1301, the memory 1302 and the communication interface 1303 are connected via a bus 1304. Fig.13 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.13 In the example, only one thick line is used to represent the bus, but it does not mean that there is only one bus or one type of bus. It should be understood that the processor mentioned in the embodiment of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory.

[0217] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0218] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DirectRambus RAM, DR RAM).

[0219] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0220] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0221] As another possible product form, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps executed by any device in the above method example.

[0222] As another possible product form, an embodiment of the present application also provides a computer program product including instructions, wherein the computer program product stores instructions that, when executed on a computer, enable the computer to execute the method steps executed by any device in the above method embodiment.

[0223] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0224] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0225] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0226] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0227] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for allocating cryptographic resources, characterized in that: include: Continuously acquiring a target data stream, the target data stream being provided with cryptographic services by a preset cryptographic device group; Based on a preset time interval, the target data stream is divided into at least two sub-data streams; wherein the acquisition time corresponding to the data contained in each sub-data stream is in the same time period, and different sub-data streams correspond to different time periods; Based on the target sub-data stream corresponding to the target time period at the current time, and the adjacent sub-data stream corresponding to the adjacent time period adjacent to the target time period, corresponding flow change information is obtained; the flow change information represents: the data volume of the target data stream per unit time, and the change over time; Based on the traffic change information, adjusting the access quantity of the cryptographic devices in the cryptographic device group; Based on the adjusted cryptographic device group, cryptographic services are provided for the target data stream.

2. The method according to claim 1, characterized in that The step of acquiring corresponding flow change information based on a target sub-data flow corresponding to a target time period in which the current time is located, and an adjacent sub-data flow corresponding to an adjacent time period adjacent to the target time period, includes: Based on the length of the target time period and the data volume of the target sub-data flow acquired in the target time period, acquiring the corresponding target time period flow; Based on the length of the adjacent time period and the amount of data of the adjacent sub-data flow obtained in the adjacent time period, obtaining the corresponding adjacent time period flow; Based on the difference between the flow rate in the target time period and the flow rate in the adjacent time period, corresponding flow rate change information is obtained.

3. The method according to claim 1 or 2, characterized in that The adjusting the access quantity of the cryptographic devices in the cryptographic device group based on the traffic change information includes: When the traffic change information indicates that the traffic has increased, a resource address of a newly added cryptographic device is obtained, and the resource address is added to a configuration file corresponding to the cryptographic device group, so as to increase the number of access cryptographic devices in the cryptographic device group; When the traffic change information indicates that the traffic is reduced, the resource addresses of the preset number of cryptographic devices recorded in the configuration file corresponding to the cryptographic device group are deleted to reduce the number of access cryptographic devices in the cryptographic device group.

4. The method according to claim 1 or 2, characterized in that: In the cryptographic device group, the cryptographic devices correspond to different data processing specifications; Then, the cryptographic device group based on the adjustment provides cryptographic services for the target data stream, including: For each piece of data to be processed in the target data stream, perform the following operations respectively: Obtaining a request identifier corresponding to the data to be processed; the request identifier represents: a target data processing specification corresponding to the data to be processed; Based on the target data processing specification, encapsulating the data to be processed into first data having a target data format corresponding to the target data processing specification; Sending the first data to a target cryptographic device corresponding to the target data processing specification, so that the target cryptographic device performs a data processing operation on the first data and feeds back a processing result; Receive the processing result from the target cryptographic device, encapsulate the processing result into second data with a preset data format; and set a corresponding specification identifier for the second data; wherein the specification identifier is used to characterize the data processing specification corresponding to the second data.

5. The method according to claim 1 or 2, characterized in that: The cryptographic devices in the cryptographic device group correspond to different operating systems; Before continuously acquiring the target data stream, the method further includes: Selecting a cryptographic device as a source cryptographic device, and selecting a cryptographic device having an operating system different from the source operating system corresponding to the source cryptographic device as a target cryptographic device; Obtaining source key data in a source operating system corresponding to the source cryptographic device; Based on the source key data, the target key data in the target cryptographic device is replaced so that the operating systems of the cryptographic devices in the cryptographic device group have the same source key data.

6. The method according to claim 5, characterized in that The replacing the target key data in the target cryptographic device based on the source key data comprises: Based on the operating system of the target cryptographic device, generating a corresponding original image file; Deleting the target key data in the original image file, and adding the source key data to the original image file to obtain a corresponding target image file; Push the target image file to the target cryptographic device.

7. A device for allocating cryptographic resources, characterized in that: include: An acquisition module, used for continuously acquiring a target data stream, the target data stream being provided with a cryptographic service by a preset cryptographic device group; A division module, used for dividing the target data stream into at least two sub-data streams based on a preset time interval; wherein the acquisition time corresponding to the data contained in each sub-data stream is in the same time period, and different sub-data streams correspond to different time periods; A processing module, configured to obtain corresponding flow change information based on a target sub-data flow corresponding to a target time period at a current time and an adjacent sub-data flow corresponding to an adjacent time period adjacent to the target time period; the flow change information represents: the data volume of the target data flow per unit time, and the change over time; The adjustment module is used to adjust the access quantity of the cryptographic devices in the cryptographic device group based on the traffic change information; and provide cryptographic services for the target data flow based on the adjusted cryptographic device group.

8. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method as described in any one of claims 1 to 6 by executing the instructions stored in the memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising instructions, characterized in that The computer program product stores instructions, and when the computer program product is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.

Images