Cloud cipher machine data migration method and device and electronic equipment

Abstract

The embodiment of the invention provides a cloud cipher machine data migration method and device and electronic equipment. The method comprises the steps of obtaining a virtual password card and network configuration information stored in a first virtual cipher machine when it is detected that the first virtual cipher machine having a fault exists; sending the virtual password card and the network configuration information to a cloud server; sending a first fault migration instruction to a standby cloud cipher machine, the first fault migration instruction being used for instructing the standby cloud cipher machine to obtain the virtual cipher card and the network configuration information in the cloud server, and obtaining a second virtual cipher machine corresponding to the first virtual cipher machine according to the virtual cipher card and the network configuration information. According to the embodiment of the invention, when the virtual cipher machine of the main cloud cipher machine breaks down, the virtual cipher card and the network configuration information of the first virtual cipher machine can be obtained from the cloud server, so that data migration of the main cloud cipher machine can be completed by using the cloud server.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a cloud cryptographic machine data migration method, device and electronic device. Background Art

[0002] Cloud Hardware Security Module (CHSM), referred to as cloud cryptographic machine, is a hardware device specially used to generate, store and manage encryption keys. In actual applications, cloud cryptographic machine uses virtualization technology to create virtual cryptographic machine, and uses SR-IOV virtualization technology to virtualize physical cryptographic card into virtual cryptographic card, and manages the keys in virtual cryptographic card through virtual hardware pass-through technology and virtual cryptographic card protocol, so as to realize the functions of virtualized server cryptographic machine, signature verification server and other equivalent hardware servers.

[0003] When a virtual cryptographic machine fails, the data of the failed virtual cryptographic machine needs to be transferred to an idle virtual cryptographic machine. Therefore, a cloud cryptographic machine data migration method, device and electronic device are urgently needed. Summary of the invention

[0004] In view of this, an embodiment of the present application provides a cloud cryptographic machine data migration method and system to at least partially solve the above-mentioned problems.

[0005] According to a first aspect of an embodiment of the present application, a cloud cryptographic machine data migration method is provided, which is applied to a main cloud cryptographic machine, wherein the main cloud cryptographic machine is provided with multiple virtual cryptographic machines, and the method includes:

[0006] When detecting that a first virtual cryptographic machine has failed, obtaining the virtual cryptographic card and network configuration information stored in the first virtual cryptographic machine;

[0007] Sending the virtual password card and the network configuration information to a cloud server;

[0008] A first fault migration instruction is sent to the standby cloud cryptographic machine, where the first fault migration instruction is used to instruct the standby cloud cryptographic machine to obtain the virtual cryptographic card and the network configuration information in the cloud server, and configure a second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual cryptographic card and the network configuration information.

[0009] In some embodiments, sending the virtual password card and the network configuration information to a cloud server includes:

[0010] Encrypting the virtual password card according to a pre-stored first key to obtain an encrypted virtual password card;

[0011] sending the encrypted virtual password card and the network configuration information to the cloud server;

[0012] The first fault migration instruction is used to instruct the backup cloud cryptographic machine to obtain the encrypted virtual cryptographic card and the network configuration information in the cloud server to migrate the faulty virtual cryptographic machine to the backup cloud cryptographic machine.

[0013] In some embodiments, before detecting that the virtual cryptographic machine has a fault, the method further includes:

[0014] Obtaining user key information and log data information stored in the virtual cryptographic machine;

[0015] Encrypting the user key information and the log data information according to a pre-stored first key to obtain a first backup file;

[0016] Sending the first backup file to the cloud server;

[0017] The first fault migration instruction is also used to instruct the standby cloud cryptographic machine to obtain the first backup file in the cloud server.

[0018] In some embodiments, the method further comprises:

[0019] In response to a successful migration instruction sent by the backup cloud cryptographic machine, the first virtual cryptographic machine is deactivated, wherein the successful migration instruction is sent by the backup cloud cryptographic machine to the main cloud cryptographic machine when the backup cloud cryptographic machine determines that the second virtual cryptographic machine is working normally.

[0020] According to a second aspect of an embodiment of the present application, a cloud cryptographic machine data migration method is provided, which is applied to a cloud server, and the method includes:

[0021] Receive the virtual password card and network configuration information of the first virtual password machine sent by the main cloud password machine, and store the virtual password card and the network configuration information in a setting location;

[0022] In response to a second fault migration instruction sent by the backup cloud cryptographic machine, the virtual cryptographic card and the network configuration information are sent to the backup cloud cryptographic machine, wherein the second fault migration instruction is sent by the backup cloud cryptographic machine to the cloud server when the backup cloud cryptographic machine receives the first fault migration instruction.

[0023] In some embodiments, the method further comprises:

[0024] Receiving a first backup file of the first virtual cryptographic machine sent by the main cloud cryptographic machine, wherein the first backup file is obtained by encrypting the user key information and the log data information by the main cloud cryptographic machine according to a pre-stored first key;

[0025] Detecting whether a second backup file corresponding to the first backup file is stored, wherein the second backup file is generated earlier than the first backup file;

[0026] If it exists, use the first backup file to replace the second backup file;

[0027] The step of sending the encrypted virtual cryptographic card and the network configuration information to the standby cloud cryptographic machine in response to the second fault migration instruction sent by the standby cloud cryptographic machine includes:

[0028] In response to the second fault migration instruction sent by the standby cloud cryptographic machine, the encrypted virtual cryptographic card, the network configuration information and the first backup file are sent to the standby cloud cryptographic machine.

[0029] According to a third aspect of an embodiment of the present application, a cloud cryptographic machine data migration method is provided, which is applied to a backup cloud cryptographic machine, wherein the backup cloud cryptographic machine is provided with multiple virtual cryptographic machines, and the method includes:

[0030] In response to the first failure migration instruction sent by the primary cloud cryptographic machine, sending a second failure migration instruction to the cloud server;

[0031] Receiving a virtual password card and network configuration information of a first virtual password machine sent by the cloud server, so as to obtain the virtual password card and the network configuration information in the cloud server;

[0032] A second virtual cryptographic machine corresponding to the first virtual cryptographic machine is configured according to the virtual cryptographic card and network configuration information of the first virtual cryptographic machine.

[0033] In some embodiments, the method further comprises:

[0034] Performing a function test on the second virtual cryptographic machine;

[0035] When the second virtual cryptographic machine is working normally, a migration success instruction is sent to the main cloud cryptographic machine to instruct the main cloud cryptographic machine to deactivate the first virtual cryptographic machine.

[0036] According to a fourth aspect of an embodiment of the present application, a cloud cryptographic machine data migration device is provided, which is applied to a main cloud cryptographic machine, wherein the main cloud cryptographic machine is provided with a plurality of virtual cryptographic machines, and the device comprises:

[0037] an acquisition module, for acquiring the virtual password card and network configuration information stored in the first virtual password machine when a faulty first virtual password machine is detected;

[0038] A first sending module, used for sending the virtual password card and the network configuration information to a cloud server;

[0039] The second sending module is used to send a first fault migration instruction to the standby cloud cryptographic machine, wherein the first fault migration instruction is used to instruct the standby cloud cryptographic machine to obtain the virtual cryptographic card and the network configuration information in the cloud server, and configure a second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual cryptographic card and the network configuration information.

[0040] According to the fifth aspect of the embodiment of the present application, a cloud cryptographic machine data migration system includes a main cloud cryptographic machine, a cloud server and a backup cloud cryptographic machine, wherein the main cloud cryptographic machine and the backup cloud cryptographic machine are both provided with multiple virtual cryptographic machines, the main cloud cryptographic machine and the backup cryptographic machine are both connected to the cloud server, the main cloud cryptographic machine is used to execute the cloud cryptographic machine data migration method described in the first aspect of the claim, the cloud server is used to execute the cloud cryptographic machine data migration method described in the second aspect of the claim, and the backup cloud cryptographic machine is used to execute the cloud cryptographic machine data migration method described in the third aspect.

[0041] According to the sixth aspect of an embodiment of the present application, there is provided an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the data migration method described in the embodiment of the present application.

[0042] According to a seventh aspect of an embodiment of the present application, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the data migration method as described in the embodiment of the present application is implemented.

[0043] According to the cloud cryptographic machine data migration method provided by the embodiment of the present application, when the main cloud cryptographic machine detects the existence of a first virtual cryptographic machine that has failed, it obtains the virtual password card and network configuration information stored in the first virtual cryptographic machine, sends the virtual password card and network configuration information to the cloud server, and sends a first fault migration instruction to the standby cloud cryptographic machine to instruct the standby cloud cryptographic machine to obtain the virtual password card and network configuration information in the cloud server, and configures the second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual password card and the network configuration information. The main cloud cryptographic machine of the present application sends the virtual password card and network configuration information of the first virtual cryptographic machine to the cloud server when the first virtual cryptographic machine that has failed is detected. When the virtual password machine of the main cloud cryptographic machine fails, the virtual password card and network configuration information of the first virtual cryptographic machine can be obtained in the cloud server, and then the cloud server can be used to complete the data migration of the main cloud cryptographic machine, avoiding the problem of being unable to read the virtual password card and network configuration of the first virtual cryptographic machine locally on the cloud cryptographic machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0045] Figure 1 A flowchart of a data migration method according to an embodiment of the present application;

[0046] Figure 2 A flowchart of a data migration method according to an embodiment of the present application;

[0047] Figure 3 A flowchart of a data migration method according to an embodiment of the present application;

[0048] Figure 4 is a structural block diagram of a data migration system according to an embodiment of the present application;

[0049] Figure 5 is a structural block diagram of a data migration device according to an embodiment of the present application;

[0050] Figure 6 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0052] The specific implementation of the embodiment of the present application is further explained below in conjunction with the accompanying drawings of the embodiment of the present application.

[0053] Cloud Hardware Security Module (CHSM), referred to as cloud cryptographic machine, is a hardware device specially used to generate, store and manage encryption keys. The mainstream cloud server cryptographic machine in the industry uses virtualization technology to create virtual machines, and uses SR-IOV virtualization technology to virtualize physical cryptographic cards into virtual cryptographic cards. Through virtual hardware pass-through technology and virtual cryptographic card protocol, the keys in the virtual cryptographic cards are managed to achieve the same hardware server functions as virtualized server cryptographic machines and signature verification servers.

[0054] When a cloud cryptographic machine or a virtual cryptographic machine fails, data migration is required. The current mainstream virtual machine migration methods include offline manual migration and online cold migration. Offline manual migration is to back up the virtual machine and key data with the help of command lines and storage media, and find idle virtual machines to restore and release old virtual machine resources. This method has defects such as service interruption, low efficiency, and low security. Online automatic cold migration is to back up virtual machine data and key data with the help of management protocols, select idle virtual machines and restore backups. This method has defects such as service interruption and poor real-time performance. At the same time, when a virtual cryptographic machine fails, the cloud cryptographic machine where it is located is also likely to have a high probability of failure risk, which will make it impossible to successfully export the virtual cryptographic card from the virtual cryptographic machine, affecting the progress of virtual machine migration.

[0055] In view of this, the embodiment of the present application provides a cloud cryptographic machine data migration method, which is applied to a main cloud cryptographic machine, where the main cloud cryptographic machine is provided with multiple virtual cryptographic machines. The specific steps are as follows: Figure 1 As shown, the method includes:

[0056] S101, when detecting that a first virtual cryptographic machine has failed, obtaining a virtual cryptographic card and network configuration information stored in the first virtual cryptographic machine.

[0057] In the embodiment of the present application, the main cloud cryptographic machine will perform fault detection on the running virtual cryptographic machine. When the main cloud cryptographic machine detects that there is a faulty first virtual cryptographic machine, the main cloud cryptographic machine will obtain the virtual cryptographic card stored in the virtual cryptographic machine and the network configuration information of the virtual cryptographic machine in the first virtual cryptographic machine. The virtual cryptographic card in the first virtual cryptographic machine is obtained by virtualizing the physical cryptographic card in the main cloud cryptographic machine using SR-IOV virtualization technology.

[0058] S102, sending the virtual password card and network configuration information to the cloud server.

[0059] In an embodiment of the present application, after the main cloud cryptographic machine obtains the virtual cryptographic card and network configuration information in the first virtual cryptographic machine, the obtained virtual cryptographic card and network configuration information of the first virtual cryptographic machine are sent to the cloud server to perform fault migration of the first virtual cryptographic machine through the cloud server.

[0060] S103, sending a first fault migration instruction to the backup cloud cryptographic machine.

[0061] In an embodiment of the present application, after the main cloud cryptographic machine sends the virtual cryptographic card and network configuration information of the first virtual cryptographic machine to the cloud server, the main cloud cryptographic machine generates a first fault migration instruction and sends the first fault migration instruction to the backup cloud cryptographic machine to instruct the backup cloud cryptographic machine to obtain the virtual cryptographic card and network configuration information in the cloud server, and configure a second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual cryptographic card and network configuration information.

[0062] Specifically, the second virtual cryptographic machine implements the same function as the first virtual cryptographic machine.

[0063] The cloud cryptographic machine data migration method provided in the embodiment of the present application is that when the main cloud cryptographic machine detects the existence of a first virtual cryptographic machine that has failed, it obtains the virtual password card and network configuration information stored in the first virtual cryptographic machine, sends the virtual password card and network configuration information to the cloud server, and sends a first fault migration instruction to the standby cloud cryptographic machine to instruct the standby cloud cryptographic machine to obtain the virtual password card and network configuration information in the cloud server, and configures a second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual password card and the network configuration information. The main cloud cryptographic machine of the present application sends the virtual password card and network configuration information of the first virtual cryptographic machine to the cloud server when detecting the existence of a first virtual cryptographic machine that has failed. When the virtual password machine of the main cloud cryptographic machine fails, the virtual password card and network configuration information of the first virtual cryptographic machine can be obtained in the cloud server, and then the cloud server can be used to complete the data migration of the main cloud cryptographic machine, avoiding the problem of being unable to read the virtual password card and network configuration of the first virtual cryptographic machine locally on the cloud cryptographic machine.

[0064] Furthermore, in the embodiment of the present application, sending the virtual password card and the network configuration information to the cloud server may include the following steps:

[0065] S1021, encrypting the virtual password card according to a pre-stored first key to obtain an encrypted virtual password card.

[0066] In the embodiment of the present application, when the cloud master cloud cryptographic machine sends the virtual password card and network configuration information to the cloud server, the cloud master cloud cryptographic machine first obtains the first key pre-stored in itself, and uses the first key to encrypt the virtual password card to obtain an encrypted virtual password card.

[0067] S1022, sending the encrypted virtual password card and network configuration information to the cloud server.

[0068] In the embodiment of the present application, after the main cloud cryptographic machine completes the encryption of the virtual cryptographic card, the main cloud cryptographic machine sends the encrypted virtual cryptographic card and network configuration information to the cloud server, thereby improving the security of the virtual cryptographic machine migration through the first key. Specifically, the first fault migration instruction is specifically used to instruct the backup cloud cryptographic machine to obtain the encrypted virtual cryptographic card and network configuration information in the cloud server to migrate the faulty virtual cryptographic machine to the backup cloud cryptographic machine.

[0069] Furthermore, before detecting that the virtual cryptographic machine has a fault, the embodiment of the present application may further include the following steps:

[0070] S104, obtaining user key information and log data information stored in the virtual cryptographic machine.

[0071] In an embodiment of the present application, during the operation of the virtual cryptographic machine, user key information and log data information during the operation will be stored, and the main cloud cryptographic machine will periodically read the user key information and log data information in the virtual cryptographic machine to obtain the user key information and log data information stored in the virtual cryptographic machine.

[0072] S105: Encrypt the user key information and the log data information according to a pre-stored first key to obtain a first backup file.

[0073] In an embodiment of the present application, after obtaining the user key information and log data information stored in the virtual cryptographic machine, the main cloud cryptographic machine uses a pre-stored first key to encrypt the user key information and log data information to obtain a first backup file.

[0074] S106, sending the first backup file to the cloud server.

[0075] In the embodiment of the present application, the main cloud cryptographic machine sends the obtained first backup file to the cloud server to complete the backup of the virtual cryptographic machine. Specifically, the first fault migration instruction is also used to instruct the backup cloud cryptographic machine to obtain the first backup file in the cloud server to configure the second virtual cryptographic machine using the first backup file.

[0076] In an embodiment of the present application, user key information and log data information are read in a virtual cryptographic machine through a main cloud cryptographic machine to obtain user key information and log data information stored in the virtual cryptographic machine, and the user key information and log data information are encrypted to obtain a first backup file. The data stored in the virtual cryptographic machine can be backed up to the cloud server in a timely manner, so that during fault migration, the data of the first virtual cryptographic machine can be migrated to the second virtual cryptographic machine through the cloud server, thereby ensuring the integrity of the data during fault migration and improving the disaster recovery capability during fault migration.

[0077] Furthermore, the cloud cryptographic machine data migration method of the embodiment of the present application may also include the following steps:

[0078] S107, in response to the migration success instruction sent by the backup cloud cryptographic machine, deactivate the first virtual cryptographic machine.

[0079] In an embodiment of the present application, after the backup cloud cryptographic machine completes the configuration of the second virtual cryptographic machine and determines that the second virtual cryptographic machine is operating normally, the backup cloud cryptographic machine sends a migration success instruction to the main cloud cryptographic machine. After receiving the migration success instruction, the main cloud cryptographic machine responds to the migration success instruction and deactivates the first virtual cryptographic machine to reclaim the hardware resources of the main cloud cryptographic machine.

[0080] Furthermore, the present application embodiment provides a cloud cryptographic machine data migration method, which is applied to a cloud server, and the specific steps are as follows: Figure 2 As shown, including:

[0081] S201, receiving the virtual password card and network configuration information of the first virtual password machine sent by the main cloud cryptographic machine, and storing the virtual password card and the network configuration information to the setting location.

[0082] In the embodiment of the present application, the cloud server receives the virtual password card and network configuration information of the first virtual password machine sent by the main cloud password machine, and stores the virtual password card and network configuration information in the setting location. Specifically, in the embodiment of the present application, each virtual password machine corresponds to a unique setting location, the cloud server obtains the setting location corresponding to the first virtual password machine, and stores the virtual password card and network configuration information of the first virtual password machine in the setting location corresponding to the first virtual password machine.

[0083] In one example, an encrypted virtual cryptographic card and network configuration information of a first virtual cryptographic machine sent by a main cloud cryptographic machine are received, and the encrypted virtual cryptographic card and network configuration information are stored in a setting location.

[0084] S202, in response to the second fault migration instruction sent by the backup cloud cryptographic machine, the virtual cryptographic card and network configuration information are sent to the backup cloud cryptographic machine.

[0085] In an embodiment of the present application, when the backup cloud cryptographic machine receives the first fault migration sent by the main cloud cryptographic machine, the backup cloud cryptographic machine generates a second fault migration instruction and sends the second fault migration instruction to the cloud server. When the cloud server receives the second fault migration instruction, it responds to the second fault migration instruction and sends the virtual cryptographic card and network configuration information of the first virtual cryptographic machine to the backup cloud cryptographic machine.

[0086] In one example, the cloud server sends the encrypted virtual cryptographic card and network configuration information to the backup cloud cryptographic machine in response to the second fault migration instruction sent by the backup cloud cryptographic machine.

[0087] The embodiment of the present application stores the virtual password card and network configuration information of the first virtual machine through the cloud server. When the virtual password machine of the main cloud cryptographic machine fails, the virtual password card and network configuration information of the first virtual cryptographic machine can be obtained in the cloud server, and then the cloud server can be used to complete the data migration of the main cloud cryptographic machine, avoiding the problem of being unable to read the virtual password card and network configuration of the first virtual cryptographic machine locally on the cloud cryptographic machine.

[0088] Furthermore, the cloud cryptographic machine data migration method of the embodiment of the present application may also include the following steps:

[0089] S203, receiving the first backup file of the first virtual cryptographic machine sent by the main cloud cryptographic machine.

[0090] In an embodiment of the present application, after the main cloud cryptographic machine encrypts the user key information and log data information according to the pre-stored first key to obtain the first backup file, it sends the first backup file to the cloud server, and then the cloud server receives the first backup file.

[0091] S204: Detect whether a second backup file corresponding to the first backup file is stored.

[0092] In the embodiment of the present application, after receiving the first backup file, the cloud server detects whether it stores a second backup file corresponding to the first backup file, and the generation time of the second backup file is earlier than that of the first backup file.

[0093] S205: If it exists, use the first backup file to replace the second backup file.

[0094] In the embodiment of the present application, if the cloud server determines that the second backup file exists, the cloud server uses the first backup file to replace the second backup file to update the backup file of the first virtual cryptographic machine.

[0095] The embodiment of the present application detects whether there is a second backup file corresponding to the first backup file through the cloud server, and can accurately update the backup file of the first virtual cryptographic machine, thereby maintaining the accuracy of the backup file of the virtual cryptographic machine.

[0096] Furthermore, the embodiment of the present application provides a cloud cryptographic machine data migration method, which is applied to a backup cloud cryptographic machine, where the backup cloud cryptographic machine is provided with multiple virtual cryptographic machines. The specific steps are as follows: Figure 3 As shown, including:

[0097] S301, in response to the first fault migration instruction sent by the main cloud cryptographic machine, send a second fault migration instruction to the cloud server.

[0098] In an embodiment of the present application, after receiving the first fault migration instruction sent by the main cloud cryptographic machine, the backup cloud cryptographic machine generates a second fault migration instruction and sends the second fault migration instruction to the cloud server.

[0099] S302, receiving a virtual password card and network configuration information of a first virtual password machine sent by a cloud server, so as to obtain the virtual password card and the network configuration information in the cloud server.

[0100] In an embodiment of the present application, after receiving the second fault migration instruction, the cloud server sends the virtual password card and network configuration information of the first virtual cryptographic machine to the backup cloud cryptographic machine, and the backup cloud cryptographic machine receives the virtual password card and network configuration information of the first virtual cryptographic machine to obtain the virtual password card and network configuration information in the cloud server.

[0101] In one example, the standby cloud cryptographic machine receives an encrypted virtual cryptographic card, network configuration information, and a first backup file of the first virtual cryptographic machine sent by a cloud server.

[0102] S303: obtain a second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual cryptographic card and network configuration information of the first virtual cryptographic machine.

[0103] In an embodiment of the present application, the backup cloud cryptographic machine is configured according to the virtual cryptographic card and network configuration information of the first virtual cryptographic machine to obtain a second virtual cryptographic machine corresponding to the first virtual cryptographic machine, so that the second virtual cryptographic machine has the same specific functions as the first virtual cryptographic machine.

[0104] In one example, when configuring the second virtual cryptographic machine, the backup cloud cryptographic machine decrypts the encrypted virtual cryptographic card according to the pre-stored second key to obtain the virtual cryptographic card, and then obtains the second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual cryptographic card, the network configuration information configuration and the first backup file configuration.

[0105] Furthermore, the cloud cryptographic machine data migration method of the embodiment of the present application may also include the following steps:

[0106] S304, performing a function test on the second virtual cryptographic machine.

[0107] In the embodiment of the present application, after the backup cloud cryptographic machine completes the configuration of the second virtual cryptographic machine, it performs a functional test on the second virtual cryptographic machine to determine whether the second virtual cryptographic machine can work normally.

[0108] S305, when the second virtual cryptographic machine is working normally, a migration success instruction is sent to the main cloud cryptographic machine to instruct the main cloud cryptographic machine to deactivate the first virtual cryptographic machine.

[0109] In an embodiment of the present application, when the backup cloud cryptographic machine determines that the second virtual cryptographic machine is working normally, it sends a migration success instruction to the main cloud cryptographic machine to instruct the main cloud cryptographic machine to deactivate the first virtual cryptographic machine, thereby releasing the hardware resources of the main cloud cryptographic machine.

[0110] Furthermore, in the embodiment of the present application, the main cloud cryptographic machine is recorded as A, and multiple virtual cryptographic machines A1, A2,..., An are arranged on the main cloud cryptographic machine; the backup cloud cryptographic machine is recorded as B, and multiple virtual cryptographic machines B1, B2,..., Bn are arranged on the backup cloud cryptographic machine. The embodiment of the present application takes the virtual cryptographic machine A1 as an example to further illustrate the cloud cryptographic machine data migration method.

[0111] Specifically, the main cloud cryptographic machine A periodically reads the user key information and log data information stored in the virtual cryptographic machine A1, and uses the first key to encrypt the user key information and log data information to obtain a first backup file. After obtaining the first backup file of the virtual cryptographic machine A1, the main cloud cryptographic machine A sends the first backup file to the cloud server. After receiving the first backup file of the virtual cryptographic machine A1, the cloud server detects whether it stores the second backup file of the virtual cryptographic machine A1. If so, the cloud server uses the first backup file to replace the second backup file.

[0112] Furthermore, when the main cloud cryptographic machine A detects that the virtual cryptographic machine A1 has a fault, the main cloud cryptographic machine A obtains the virtual password card and network configuration information in the virtual cryptographic machine A1, and uses the first key to encrypt the virtual password card of the virtual cryptographic machine A1 to obtain an encrypted virtual password card, and then the main cloud cryptographic machine A sends the encrypted virtual password card and network configuration information of the virtual cryptographic machine A1 to the cloud server, and the cloud server stores the encrypted virtual password card and network configuration information to the set location.

[0113] Furthermore, the main cloud cryptographic machine A sends a first fault migration instruction to the backup cloud cryptographic machine B, the backup cloud cryptographic machine B generates a second fault migration instruction based on the first fault migration instruction, and sends the second fault migration instruction to the cloud server. The cloud server responds to the second fault migration instruction sent by the backup cloud cryptographic machine and sends the encrypted virtual cryptographic card, network configuration information and first backup file of the virtual cryptographic machine A1 to the backup cloud cryptographic machine B.

[0114] Furthermore, after receiving the encrypted virtual password card, network configuration information and first backup file of virtual password machine A1, standby cloud cipher machine B decrypts the encrypted password card according to the pre-stored second key to obtain the virtual password card of virtual password machine A1, and then obtains the virtual password machine B1 corresponding to virtual password machine A1 according to the virtual password card, network configuration information configuration and first backup file configuration of virtual password machine A1.

[0115] Furthermore, the backup cloud cryptographic machine B performs a functional test on the virtual cryptographic machine B1. When the virtual cryptographic machine B1 works normally, the backup cloud cryptographic machine B sends a migration success instruction to the main cloud cryptographic machine A. The main cloud cryptographic machine A deactivates the first virtual cryptographic machine in response to the migration success instruction.

[0116] Furthermore, the present application embodiment provides a cloud cryptographic machine data migration system, specifically as follows Figure 4 As shown, it includes a main cloud cryptographic machine, a cloud server and a backup cloud cryptographic machine, wherein the main cloud cryptographic machine and the backup cloud cryptographic machine are both provided with multiple virtual cryptographic machines, the main cloud cryptographic machine and the backup cryptographic machine are both connected to the cloud server, the main cloud cryptographic machine is used to execute the cloud cryptographic machine data migration method of the embodiment of the present application, the cloud server is used to execute the cloud cryptographic machine data migration method of the embodiment of the present application, and the backup cloud cryptographic machine is used to execute the cloud cryptographic machine data migration method of the embodiment of the present application.

[0117] Furthermore, the embodiment of the present application provides a cloud cryptographic machine data migration device, which is applied to a main cloud cryptographic machine, wherein the main cloud cryptographic machine is provided with multiple virtual cryptographic machines, specifically Figure 5 The device shown comprises:

[0118] The acquisition module 501 is used to acquire the virtual password card and network configuration information stored in the first virtual password machine when detecting that there is a fault in the first virtual password machine;

[0119] A first sending module 502, used to send the virtual password card and network configuration information to the cloud server;

[0120] The second sending module 503 is used to send a first fault migration instruction to the standby cloud cryptographic machine, and the first fault migration instruction is used to instruct the standby cloud cryptographic machine to obtain a virtual cryptographic card and the network configuration information in the cloud server, and configure a second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual cryptographic card and the network configuration information.

[0121] The cloud cryptographic machine data migration device of this embodiment is used to implement the corresponding cloud cryptographic machine data migration method in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here. In addition, the functional implementation of each module in the cloud cryptographic machine data migration system of this embodiment can refer to the description of the corresponding parts in the aforementioned method embodiments, which will not be repeated here.

[0122] Reference Figure 6 , shows a schematic diagram of the structure of an electronic device according to an embodiment of the present application. The specific embodiment of the present application does not limit the specific implementation of the electronic device.

[0123] like Figure 6 As shown, the electronic device may include: a processor (processor) 602 , a communication interface (Communications Interface) 604 , a memory (memory) 606 , and a communication bus 608 .

[0124] in:

[0125] The processor 602 , the communication interface 604 , and the memory 606 communicate with each other via a communication bus 608 .

[0126] The communication interface 604 is used to communicate with other electronic devices or servers.

[0127] The processor 602 is used to execute the program 610, and specifically can execute the relevant steps in the above data migration method embodiment.

[0128] Specifically, the program 610 may include program codes, which include computer operation instructions.

[0129] The processor 602 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0130] The memory 606 is used to store the program 610. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0131] The program 610 may be specifically configured to enable the processor 502 to perform the following operations:

[0132] In an optional implementation, the program 610 is also used to enable the processor 602 to implement each step in the program 610. The specific implementation can refer to the corresponding descriptions in the corresponding steps and units in the above data migration method embodiment, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described devices and modules can refer to the corresponding process description in the above-mentioned method embodiment, which will not be repeated here.

[0133] An embodiment of the present application also provides a computer program product, including computer instructions, which instruct a computing device to perform operations corresponding to any cloud cryptographic machine data migration method in the above-mentioned multiple method embodiments.

[0134] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0135] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an AS IC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the data migration method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the data migration method shown here, the execution of the code converts the general-purpose computer into a dedicated computer for executing the data migration method shown here.

[0136] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0137] The above implementation methods are only used to illustrate the embodiments of the present application, and are not limitations on the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application. The scope of patent protection of the embodiments of the present application should be limited by the claims.

Claims

1. A cloud cryptographic machine data migration method, characterized in that: Applied to a main cloud cryptographic machine, the main cloud cryptographic machine is provided with a plurality of virtual cryptographic machines, the method comprises: When detecting that a first virtual cryptographic machine has failed, obtaining the virtual cryptographic card and network configuration information stored in the first virtual cryptographic machine; Sending the virtual password card and the network configuration information to a cloud server; A first fault migration instruction is sent to the standby cloud cryptographic machine, where the first fault migration instruction is used to instruct the standby cloud cryptographic machine to obtain the virtual cryptographic card and the network configuration information in the cloud server, and configure a second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual cryptographic card and the network configuration information.

2. The method according to claim 1, wherein sending the virtual password card and the network configuration information to a cloud server comprises: Encrypting the virtual password card according to a pre-stored first key to obtain an encrypted virtual password card; sending the encrypted virtual password card and the network configuration information to the cloud server; The first fault migration instruction is used to instruct the backup cloud cryptographic machine to obtain the encrypted virtual cryptographic card and the network configuration information in the cloud server so as to migrate the faulty virtual cryptographic machine to the backup cloud cryptographic machine.

3. The method according to claim 1, characterized in that Before detecting that the virtual cryptographic machine has a fault, the method further includes: Obtaining user key information and log data information stored in the virtual cryptographic machine; Encrypting the user key information and the log data information according to a pre-stored first key to obtain a first backup file; Sending the first backup file to the cloud server; The first fault migration instruction is also used to instruct the standby cloud cryptographic machine to obtain the first backup file in the cloud server.

4. The method according to claim 1, characterized in that: The method further comprises: In response to a successful migration instruction sent by the backup cloud cryptographic machine, the first virtual cryptographic machine is deactivated, wherein the successful migration instruction is sent by the backup cloud cryptographic machine to the main cloud cryptographic machine when the backup cloud cryptographic machine determines that the second virtual cryptographic machine is working normally.

5. A cloud cryptographic machine data migration method, characterized in that: Applied to a cloud server, the method comprises: Receive the virtual password card and network configuration information of the first virtual password machine sent by the main cloud password machine, and store the virtual password card and the network configuration information in a setting location; In response to the second fault migration instruction sent by the standby cloud cryptographic machine, the virtual cryptographic card and the network configuration [HZTC-HXJMJJ241015][HS2411180CCN] information are sent to the standby cloud cryptographic machine, wherein the second fault migration instruction is sent by the standby cloud cryptographic machine to the cloud server when it receives the first fault migration instruction.

6. The method according to claim 5, characterized in that The method further comprises: Receiving a first backup file of the first virtual cryptographic machine sent by the main cloud cryptographic machine, wherein the first backup file is obtained by encrypting the user key information and the log data information by the main cloud cryptographic machine according to a pre-stored first key; Detecting whether a second backup file corresponding to the first backup file is stored, wherein the second backup file is generated earlier than the first backup file; If it exists, use the first backup file to replace the second backup file; The step of sending the encrypted virtual cryptographic card and the network configuration information to the standby cloud cryptographic machine in response to the second fault migration instruction sent by the standby cloud cryptographic machine includes: In response to the second fault migration instruction sent by the standby cloud cryptographic machine, the encrypted virtual cryptographic card, the network configuration information and the first backup file are sent to the standby cloud cryptographic machine.

7. A cloud cryptographic machine data migration method, characterized in that: Applied to a backup cloud cryptographic machine, the backup cloud cryptographic machine is provided with a plurality of virtual cryptographic machines, the method comprising: In response to the first failure migration instruction sent by the primary cloud cryptographic machine, sending a second failure migration instruction to the cloud server; Receiving a virtual password card and network configuration information of a first virtual password machine sent by the cloud server, so as to obtain the virtual password card and the network configuration information in the cloud server; A second virtual cryptographic machine corresponding to the first virtual cryptographic machine is configured according to the virtual cryptographic card and network configuration information of the first virtual cryptographic machine.

8. The method according to claim 7, characterized in that The method further comprises: Performing a function test on the second virtual cryptographic machine; When the second virtual cryptographic machine is working normally, a migration success instruction is sent to the main cloud cryptographic machine to instruct the main cloud cryptographic machine to deactivate the first virtual cryptographic machine.

9. A cloud cryptographic machine data migration device, characterized in that: Applied to a main cloud cryptographic machine, the main cloud cryptographic machine is provided with a plurality of virtual cryptographic machines, the device comprises: an acquisition module, for acquiring the virtual password card and network configuration information stored in the first virtual password machine when a faulty first virtual password machine is detected; A first sending module, used for sending the virtual password card and the network configuration information to a cloud server; The second sending module is used to send a first fault migration instruction to the standby cloud cryptographic machine, wherein the first fault migration instruction is used to instruct the standby cloud cryptographic machine to obtain the virtual cryptographic card and the network configuration information in the cloud server, and configure a second virtual cryptographic machine corresponding to the first virtual cryptographic machine according to the virtual cryptographic card and the network configuration information.

10. An electronic device, comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the key management method according to any one of claims 1-8.

Images