Password calculation method and device, equipment and medium

Abstract

The invention discloses a password calculation method and device, equipment and a medium, and relates to the technical field of information security, and the method comprises the steps: a first password calculation service integrated in a preset gateway in advance determines target processing performance required by a transaction request; if the target processing performance belongs to the first preset category processing performance, asynchronously calling a password device locally to carry out password calculation on the transaction request; if the target processing performance is a second preset type processing performance, sending the transaction request to a second password calculation service so as to call a password device to carry out password calculation on the transaction request; the first preset category processing performance is higher than the second preset category processing performance; the processing performance of the first cryptographic computing service is higher than that of the second cryptographic computing service, and the resource occupation of the first cryptographic computing service is smaller than that of the second cryptographic computing service. Through differentiated password calculation, the request processing rate can be improved, and resource consumption can be reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a cryptographic calculation method, device, equipment and medium. Background Art

[0002] In the traditional cryptographic computing model, the user side calls SDK (Software Development Kit) and forwards the transaction request to the cryptographic computing service outside the gateway through Nginx (engine x, a high-performance HTTP and reverse proxy web server) gateway, so that the cryptographic computing service sends the transaction request to the cryptographic machine to calculate the transaction request. However, when sending the transaction request to the cryptographic computing service outside the gateway through the Nginx gateway, the Nginx gateway needs to decapsulate the transaction request and then encapsulate it before sending the transaction request to the cryptographic computing service. However, the Nginx gateway needs to perform seven-layer protocol conversion for the decapsulation and encapsulation operations of the request, which is easy to affect the processing speed of the transaction request. In addition, if the processing performance required for the transaction request is different, if the transaction request is processed by the same cryptographic computing service, it is easy to cause the problem of slow processing speed and waste of resources. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a cryptographic calculation method, device, equipment and medium, which can integrate cryptographic calculation services in a preset gateway, so as to reduce the steps of encapsulating transaction requests by the preset gateway during the cryptographic calculation process, and improve the processing speed of transaction requests. In addition, this solution can also improve the processing speed of transaction requests by differentially processing different transaction requests, and reduce the resources consumed in the process of request processing. The specific scheme is as follows:

[0004] In a first aspect, the present application provides a cryptographic calculation method, which is applied to a first cryptographic calculation service pre-integrated in a preset gateway, comprising:

[0005] When a transaction request sent by a user is obtained, determining a target processing performance required for the transaction request;

[0006] If the target processing performance belongs to the first preset category processing performance, asynchronously calling the corresponding first cryptographic device locally to perform cryptographic calculation on the transaction request;

[0007] If the target processing performance belongs to the second preset category processing performance, sending the transaction request to a second cryptographic computing service located outside the preset gateway, so that the second cryptographic computing service calls a corresponding second cryptographic device to perform cryptographic computing on the transaction request;

[0008] Among them, the processing performance of the first preset category is higher than the processing performance of the second preset category; and, the first cryptographic computing service and the second cryptographic computing service are services developed based on different computer languages, the processing performance of the first cryptographic computing service is stronger than that of the second cryptographic computing service, and the resource occupancy of the first cryptographic computing service is less than that of the second cryptographic computing service.

[0009] Optionally, the locally asynchronously calling a corresponding first cryptographic device to perform cryptographic calculation on the transaction request includes:

[0010] The first cryptographic device is selected from a plurality of cryptographic devices that have established a first communication connection with the first cryptographic computing service in advance, and the first cryptographic device is asynchronously called locally to perform cryptographic computing on the transaction request.

[0011] Optionally, sending the transaction request to a second cryptographic computing service located outside the preset gateway so that the second cryptographic computing service calls a corresponding second cryptographic device to perform cryptographic computing on the transaction request includes:

[0012] A target second cryptographic computing service is selected from several second cryptographic computing services that have pre-established a second communication connection with the preset gateway, and the transaction request is sent to the target second cryptographic computing service, so that the target second cryptographic computing service selects the second cryptographic device from several cryptographic devices that have pre-established the first communication connection with the target second cryptographic computing service, and calls the second cryptographic device to perform cryptographic calculation on the transaction request.

[0013] Optionally, the first communication connection is a communication connection established based on the Transmission Control Protocol, and the second communication connection is a communication connection established based on the Hypertext Protocol.

[0014] Optionally, after the locally asynchronously calling the corresponding first cryptographic device to perform cryptographic calculation on the transaction request, the method further includes:

[0015] Obtain a first cryptographic calculation result obtained after the first cryptographic device performs cryptographic calculation on the transaction request, and send the first cryptographic calculation result to a preset development tool via a request forwarding module in the preset gateway, so that the preset development tool sends the first cryptographic calculation result to the user end.

[0016] Optionally, after sending the transaction request to a second cryptographic computing service located outside the preset gateway so that the second cryptographic computing service calls a corresponding second cryptographic device to perform cryptographic computing on the transaction request, the method further includes:

[0017] Obtaining a second cryptographic calculation result sent by the second cryptographic device via the second cryptographic calculation service; the second cryptographic calculation result is a calculation result obtained after the second cryptographic device performs cryptographic calculation on the transaction request;

[0018] The second password calculation result is sent to the preset development tool via the request forwarding module, so that the preset development tool sends the second password calculation result to the user end.

[0019] Optionally, before determining the target processing performance required for the transaction request, the method further includes:

[0020] Obtain the transaction request sent by the user terminal via the request forwarding module in the preset gateway; wherein the transaction request is a request sent by the user terminal to the request forwarding module by calling a preset development tool; the preset gateway is a gateway selected from a gateway cluster by the preset development tool based on a preset load balancing strategy, and each gateway in the gateway cluster is integrated with the first cryptographic computing service.

[0021] In a second aspect, the present application provides a cryptographic computing device, which is applied to a first cryptographic computing service pre-integrated in a preset gateway, including:

[0022] A processing performance determination module, used to determine the target processing performance required for the transaction request when obtaining the transaction request sent by the user terminal;

[0023] A first cryptographic calculation module, configured to asynchronously call a corresponding first cryptographic device locally to perform cryptographic calculation on the transaction request if the target processing performance belongs to a first preset category of processing performance;

[0024] A second cryptographic computing module is configured to send the transaction request to a second cryptographic computing service located outside the preset gateway if the target processing performance belongs to a second preset category processing performance, so that the second cryptographic computing service calls a corresponding second cryptographic device to perform cryptographic calculations on the transaction request; wherein the first preset category processing performance is higher than the second preset category processing performance; and wherein the first cryptographic computing service and the second cryptographic computing service are services developed based on different computer languages, the processing performance of the first cryptographic computing service is stronger than that of the second cryptographic computing service, and the resource occupancy of the first cryptographic computing service is less than that of the second cryptographic computing service.

[0025] In a third aspect, the present application provides an electronic device, including:

[0026] Memory, used to store computer programs;

[0027] The processor is used to execute the computer program to implement the aforementioned cryptographic calculation method.

[0028] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned cryptographic calculation method when executed by a processor.

[0029] As can be seen from the above, before performing cryptographic calculation, the present application needs to determine the target processing performance required for the transaction request when obtaining the transaction request sent by the user end; if the target processing performance belongs to the first preset category processing performance, the corresponding cryptographic device is asynchronously called locally to perform cryptographic calculation on the transaction request; if the target processing performance is the second preset category processing performance, the transaction request is sent to the second cryptographic calculation service located outside the preset gateway, so that the second cryptographic calculation service calls the corresponding cryptographic device to perform cryptographic calculation on the transaction request; wherein the first preset category processing performance is higher than the second preset category processing performance; and the first cryptographic calculation service and the second cryptographic calculation service are services developed based on different computer languages, the processing performance of the first cryptographic calculation service is stronger than that of the second cryptographic calculation service, and the resource occupancy of the first cryptographic calculation service is less than that of the second cryptographic calculation service. It can be seen from this that in the process of cryptographic calculation, the present application constructs a first cryptographic calculation service with high processing performance and integrates the first cryptographic calculation service into the preset gateway, so that the transaction request is processed by the first cryptographic calculation service inside the preset gateway. Compared with forwarding the transaction request to the second cryptographic calculation service outside the gateway for processing, the steps of encapsulating the transaction request by the preset gateway are reduced, and the processing speed of the transaction request is improved. Furthermore, since the processing performance of the first cryptographic computing service inside the gateway is stronger than that of the second cryptographic computing service outside the gateway, and the resource occupancy of the first cryptographic computing service inside the gateway is less than that of the second cryptographic computing service outside the gateway; therefore, the present application processes transaction requests with high processing performance through the first cryptographic computing service inside the gateway, and sends transaction requests with low processing performance to the second cryptographic computing service outside the gateway, so that the transaction requests are processed by the second cryptographic computing service, thereby improving the processing speed of transaction requests through differentiated processing and reducing the resources consumed in the request processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0031] Figure 1 A flowchart of a password calculation method disclosed in this application;

[0032] Figure 2 A schematic diagram of a flow chart of a password calculation method for a transaction request with high processing performance disclosed in this application;

[0033] Figure 3 A flowchart of a specific password calculation method disclosed in this application;

[0034] Figure 4 A schematic diagram of the structure of a cryptographic computing device disclosed in this application;

[0035] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] In the traditional cryptographic computing mode, when a transaction request is sent to a cryptographic computing service outside the gateway through the Nginx gateway, the Nginx gateway needs to first decapsulate the transaction request and then perform an encapsulation operation before sending the transaction request to the cryptographic computing service. However, the Nginx gateway needs to perform a seven-layer protocol conversion for both the decapsulation and encapsulation operations of the request, which can easily affect the processing speed of the transaction request. In addition, when the processing performance required for the transaction request is different, if the transaction request is processed by the same cryptographic computing service, it is easy to cause problems such as slow processing speed and waste of resources. To this end, the present application provides a cryptographic computing method, which integrates a cryptographic computing service in a preset gateway to reduce the steps of encapsulating the transaction request by the preset gateway during the cryptographic calculation process, while improving the processing speed of the transaction request. In addition, this solution can also improve the processing speed of the transaction request by differentially processing different transaction requests, and reduce the resources consumed in the request processing process.

[0038] See also Figure 1 As shown, an embodiment of the present invention discloses a cryptographic calculation method, which is applied to a first cryptographic calculation service pre-integrated in a preset gateway, comprising:

[0039] Step S11: when a transaction request sent by a user terminal is obtained, a target processing performance required by the transaction request is determined.

[0040] In this embodiment, before determining the target processing performance required for the transaction request, a transaction request sent by the user terminal needs to be received. It is understandable that the number of the above transaction requests can be one or more, which is not specifically limited here. Secondly, the above transaction request can be a request sent by one user terminal or a request sent by multiple user terminals. Specifically, before determining the target processing performance required for the transaction request, it can also include: obtaining a transaction request sent by the user terminal via a request forwarding module in a preset gateway; wherein the transaction request is a request sent by the user terminal to the request forwarding module by calling a preset development tool; the preset gateway is a gateway selected from a gateway cluster by a preset development tool based on a preset load balancing strategy, and each gateway in the gateway cluster is integrated with a first cryptographic computing service. It is understandable that the preset gateway can be an Nginx gateway, the preset development tool can be an SDK, and the transaction request can be an HTTP (Hypertext TransferProtocol, i.e., Hypertext Transfer Protocol) request. The above preset gateway, preset development tool and transaction request can be determined according to actual needs, and are not specifically limited here.

[0041] It is worth mentioning that before obtaining the transaction request sent by the user end through the request forwarding module in the preset gateway, it is necessary to use the preset development tool to select a preset gateway from several gateways in the gateway cluster based on the preset load balancing strategy, that is, the preset gateway is the gateway selected from the gateway cluster by the preset development tool based on the preset load balancing strategy, each gateway in the gateway cluster is integrated with the first cryptographic computing service, and each gateway in the gateway cluster corresponds to a unique gateway identifier. Among them, for the preset load balancing strategy, in the first specific implementation, the gateway closest to the preset development tool among several gateways in the gateway cluster can be selected as the preset gateway, that is, the preset gateway is selected from the gateway cluster based on the principle of proximity; in the second specific implementation, the number of current pending requests in each gateway of the gateway cluster can be counted, and the gateway with the least number of current pending requests can be selected from the gateway cluster as the preset gateway. It can be understood that the above-mentioned preset gateway can be determined according to actual needs, and it is not specifically limited here.

[0042] In one embodiment, the preset gateway is a gateway selected by the preset development tool from a gateway cluster based on a preset load balancing strategy, and each gateway in the above gateway cluster is configured with a unique URL (uniform resource locator, i.e., uniform resource locator system). Before the preset development tool uses the above URL to assign a preset gateway to a transaction request, the URL corresponding to each gateway in the gateway cluster needs to be pre-loaded or configured into the preset development tool, so that when the preset development tool receives a transaction request, it will first select a thread from a plurality of preset threads and assign it to the above transaction request, and assign a preset gateway to the selected thread based on the URL; wherein, the selection of the thread may also follow the load balancing strategy.

[0043] It is worth mentioning that the above gateway identification can be determined according to actual needs, and any information that can uniquely identify the gateway can be applied to this embodiment. For example, a string of characters can be used to mark each preset gateway, which is not specifically limited here.

[0044] In this embodiment, after obtaining the transaction request, the target processing performance required for the transaction request needs to be determined. In a specific implementation, the target processing performance can be determined based on the amount of data processed per unit time required for the transaction request (for example, the amount of transactions per second (TPS)), so as to determine the size relationship between the target processing performance and the preset performance threshold, and perform corresponding operations based on the size relationship between the target processing performance and the preset performance threshold. It is worth mentioning that when the target processing performance is greater than or equal to the preset performance threshold, it can be determined that the target processing performance required for the transaction request is the first preset category processing performance, that is, high processing performance; when the target processing performance is less than the preset performance threshold, it can be determined that the target processing performance required for the transaction request is the second preset category processing performance, that is, low processing performance.

[0045] Step S12: If the target processing performance belongs to the first preset category processing performance, a corresponding first cryptographic device is asynchronously called locally to perform cryptographic calculation on the transaction request.

[0046] In this embodiment, if the target processing performance is the first preset category processing performance, it indicates that the target processing performance required by the transaction request has reached the threshold value preset in the embodiment of the present application, and the processing performance requirement is relatively high. For example, symmetric encryption and decryption, signature verification, etc. are all transaction requests with relatively high processing performance requirements; and the first cryptographic computing service will asynchronously call the first cryptographic device so that the first cryptographic device performs cryptographic calculations on the transaction request sent by the first cryptographic computing service to obtain the first cryptographic result. Specifically, asynchronously calling the corresponding first cryptographic device locally to perform cryptographic calculations on the transaction request may include: selecting the first cryptographic device from a number of cryptographic devices that have established a first communication connection with the first cryptographic computing service in advance, and asynchronously calling the first cryptographic device locally to perform cryptographic calculations on the transaction request, wherein the first cryptographic device may be a cryptographic machine or a virtual cryptographic machine. In a specific implementation, the first communication connection may be a communication connection established based on the Transmission Control Protocol (TCP). It is worth mentioning that the above-mentioned first communication connection may select different network protocols to establish a communication connection according to actual needs. Any network protocol that can establish a communication connection may be applicable to this embodiment, and it is not specifically limited here.

[0047] It is worth mentioning that when selecting the first cryptographic device from a number of cryptographic devices that have established a first communication connection with the first cryptographic computing service in advance, it is necessary to select the first cryptographic device to be used from the number of cryptographic devices based on the load balancing strategy. Among them, load balancing is based on the existing network structure, providing a cheap, effective and transparent method to expand the bandwidth of network devices and servers, increase throughput, enhance network data processing capabilities and improve network flexibility and availability. It can be understood that in this embodiment, load balancing is to distribute a number of transaction requests to a number of cryptographic devices for execution, so that the above-mentioned several cryptographic devices can jointly complete the cryptographic calculation of the transaction request when the time period overlaps.

[0048] In this embodiment, a first cryptographic calculation result obtained after cryptographic calculation is performed on a transaction request whose target processing performance belongs to the first preset category of processing performance is returned to the user end so that the user end can use the first cryptographic calculation result in the business. Specifically, after the corresponding first cryptographic device is asynchronously called locally to perform cryptographic calculation on the transaction request, the method may also include: obtaining the first cryptographic calculation result obtained after the first cryptographic device performs cryptographic calculation on the transaction request, and sending the first cryptographic calculation result to the preset development tool via the request forwarding module in the preset gateway, so that the preset development tool sends the first cryptographic calculation result to the user end.

[0049] In this embodiment, when the target processing performance of the transaction request belongs to the first preset category processing performance, that is, when the target processing performance of the transaction request is high processing performance, the step of asynchronously calling the corresponding first cryptographic device locally to perform cryptographic calculation on the transaction request is triggered. The specific process is as follows Figure 2 The application system (i.e., the user end) calls the preset development tool to access the Nginx gateway. When accessing the Nginx gateway through the preset development tool, it is necessary to use HTTP The RESTful interface initiates a transaction request to the Nginx gateway; wherein the first cryptographic computing service is integrated in the Nginx gateway; after the Nginx gateway receives the transaction request, the Nginx gateway can directly send the transaction request to the first cryptographic computing service without encapsulating the above transaction request; after receiving the transaction request, the above first cryptographic computing service determines the target processing performance of the above transaction request, and if the target processing performance is high processing performance, asynchronously calls the cryptographic machine or virtual cryptographic machine so that the above cryptographic machine or virtual cryptographic machine calculates the transaction request sent by the first cryptographic computing service; then, after the cryptographic machine or virtual cryptographic machine performs cryptographic computing on the transaction request, a first cryptographic computing result will be obtained, and the first cryptographic computing result will be returned to the first cryptographic computing service; then, the first cryptographic computing service will return the above first cryptographic computing result to the preset development tool via the Nginx gateway, and the preset development tool will return the first cryptographic computing result to the user end after receiving the first cryptographic computing result, so that the user end can use the first cryptographic computing result.

[0050] Step S13: If the target processing performance belongs to the second preset category processing performance, the transaction request is sent to a second cryptographic computing service located outside the preset gateway, so that the second cryptographic computing service calls the corresponding second cryptographic device to perform cryptographic calculations on the transaction request; wherein the first preset category processing performance is higher than the second preset category processing performance; and the first cryptographic computing service and the second cryptographic computing service are services developed based on different computer languages, the processing performance of the first cryptographic computing service is stronger than that of the second cryptographic computing service, and the resource occupancy of the first cryptographic computing service is less than that of the second cryptographic computing service.

[0051] In this embodiment, if the target processing performance is less than the preset performance threshold, it can be determined that the target processing performance required by the transaction request is low processing performance; that is, the target processing performance required by the transaction request fails to reach the threshold preset in the embodiment of the present application, and the processing performance requirement is low, so that the above transaction request can be sent to the second cryptographic computing service through the first cryptographic computing service, so that the second cryptographic computing service calls the corresponding second cryptographic device to perform cryptographic calculation on the transaction request. It is worth mentioning that the above second cryptographic computing service is not integrated into the preset gateway, and the processing performance is lower than the first cryptographic computing service. Specifically, sending the transaction request to the second cryptographic computing service located outside the preset gateway, so that the second cryptographic computing service calls the corresponding second cryptographic device to perform cryptographic calculation on the transaction request, can include: selecting a target second cryptographic computing service from a plurality of second cryptographic computing services that have established a second communication connection with the preset gateway in advance, and sending the transaction request to the target second cryptographic computing service, so that the target second cryptographic computing service selects a second cryptographic device from a plurality of cryptographic devices that have established a first communication connection with the target second cryptographic computing service in advance, and calls the second cryptographic device to perform cryptographic calculation on the transaction request.

[0052] It is understandable that the second communication connection is a communication connection established based on the Hypertext Transfer Protocol (HTTP). It is worth mentioning that the second communication connection can select different network protocols to establish a communication connection according to actual needs. Any network protocol that can establish a communication connection can be applicable to this embodiment, and will not be described one by one here.

[0053] It is worth mentioning that the first cryptographic computing service is a cryptographic computing service developed based on C language, and the second cryptographic computing service is a cryptographic computing service developed based on Java language. In addition, due to the differences in language expression and implemented functions between C language and Java language, the first cryptographic computing service can provide much higher performance than the second cryptographic computing service on key interfaces, and compared with the second cryptographic computing service, the first cryptographic computing service has a lower occupancy rate of CPU and memory resources.

[0054] In addition, when selecting a target second cryptographic computing service from a number of second cryptographic computing services that have established a second communication connection with a preset gateway in advance, it is necessary to select the target second cryptographic computing service from the number of second cryptographic computing services based on a load balancing strategy. In one embodiment, the second cryptographic computing service closest to the preset gateway among the number of second cryptographic computing services can be selected as the target second cryptographic computing service; in another specific embodiment, the number of currently pending requests in each second cryptographic computing service can be counted so as to select the second cryptographic computing service with the least number of currently pending requests from each second cryptographic computing service as the target second cryptographic computing service. It can be understood that the above-mentioned target second cryptographic computing service can be selected according to actual needs, and it is not specifically limited here.

[0055] In this embodiment, the second cryptographic calculation result obtained after cryptographic calculation is performed on the transaction request whose target processing performance belongs to the second preset category processing performance is returned to the user end, so that the above-mentioned user end can use the above-mentioned second cryptographic calculation result in the business. Specifically, after sending the transaction request to the second cryptographic calculation service located outside the preset gateway so that the second cryptographic calculation service calls the corresponding second cryptographic device to perform cryptographic calculation on the transaction request, it can also include: obtaining the second cryptographic calculation result sent by the second cryptographic device via the second cryptographic calculation service; the second cryptographic calculation result is the calculation result obtained after the second cryptographic device performs cryptographic calculation on the transaction request; sending the second cryptographic calculation result to the preset development tool via the request forwarding module, so that the preset development tool sends the second cryptographic calculation result to the user end.

[0056] In the present application, in the process of cryptographic calculation, when the transaction request sent by the user end is obtained, the target processing performance required for the transaction request is determined; if the target processing performance belongs to the first preset category processing performance, the corresponding cryptographic device is asynchronously called locally to perform cryptographic calculation on the transaction request; if the target processing performance is the second preset category processing performance, the transaction request is sent to the second cryptographic calculation service located outside the preset gateway, so that the second cryptographic calculation service calls the corresponding cryptographic device to perform cryptographic calculation on the transaction request; wherein the first preset category processing performance is higher than the second preset category processing performance; and the first cryptographic calculation service and the second cryptographic calculation service are services developed based on different computer languages, the processing performance of the first cryptographic calculation service is stronger than that of the second cryptographic calculation service, and the resource occupancy of the first cryptographic calculation service is less than that of the second cryptographic calculation service. It can be seen that in the process of cryptographic calculation, the present application constructs a first cryptographic calculation service with high processing performance and integrates the first cryptographic calculation service into the preset gateway, so that the transaction request is processed by the first cryptographic calculation service inside the preset gateway. Compared with forwarding the transaction request to the second cryptographic calculation service outside the gateway for processing, the steps of encapsulating the transaction request by the preset gateway are reduced, and the processing speed of the transaction request is improved. Furthermore, since the processing performance of the first cryptographic computing service inside the gateway is stronger than that of the second cryptographic computing service outside the gateway, and the resource occupancy of the first cryptographic computing service inside the gateway is less than that of the second cryptographic computing service outside the gateway; therefore, the present application uses the first cryptographic computing service inside the gateway to process transaction requests with high processing performance, and sends the transaction requests with low processing performance to the second cryptographic computing service outside the gateway, so that the transaction requests can be processed by the second cryptographic computing service, thereby improving the processing speed of transaction requests through differentiated processing and reducing the resources consumed in the request processing process.

[0057] See also Figure 3 As shown, an embodiment of the present invention discloses a password calculation method, including:

[0058] In this embodiment, the overall flow chart of the above steps is as follows: Figure 3 In a specific implementation, the embodiment of the present application selects to integrate the first cryptographic computing service as an extension module into the Nginx gateway, and enables the first cryptographic computing service to work together with the Nginx gateway, thereby improving the business processing capability of the cryptographic computing service in the HTTP protocol mode.

[0059] The embodiment of the present application chooses to use C language to develop and build a cryptographic computing extension model on the Nginx gateway, that is, the first cryptographic computing service, to achieve fast cryptographic computing processing of transaction requests corresponding to high processing performance; in addition, the first cryptographic computing service can also cooperate with the second cryptographic computing service developed in Java language outside the Nginx gateway to provide complete cryptographic computing capabilities. It is worth mentioning that due to the differences in the language expression and implemented functions of C language and Java language, the first cryptographic computing service can provide much higher performance than the second cryptographic computing service on key interfaces, and compared with the second cryptographic computing service, the first cryptographic computing service has a lower occupancy rate of CPU and memory resources.

[0060] Among them, the first cryptographic computing service can establish a second communication connection with each second cryptographic computing service, that is, an HTTP connection, and can also establish a first communication connection with a cryptographic machine or a virtual cryptographic machine in different tenants. In addition, the second cryptographic computing service can also establish a second communication connection with a cryptographic machine or a virtual cryptographic machine, that is, a TCP connection. It is worth mentioning that the second cryptographic computing service can only establish a first communication connection with a cryptographic machine or a virtual cryptographic machine in the same tenant.

[0061] In this embodiment, when the first cryptographic computing service pre-integrated in the Nginx gateway obtains the transaction request sent by the user end through HTTP connection using the preset development tool and through the Nginx gateway, it will first determine the target processing performance required for the transaction request; if the target processing performance belongs to the first preset category of processing performance, that is, high processing performance, then the corresponding cryptographic machine or virtual cryptographic machine is asynchronously called locally through a TCP connection to perform cryptographic calculations on the transaction request; if the target processing performance belongs to the second preset category of processing performance, that is, low processing performance, the transaction request is sent through an HTTP connection to a second cryptographic computing service located outside the preset gateway, so that the second cryptographic computing service calls the corresponding cryptographic machine or virtual cryptographic machine through a TCP connection to perform cryptographic calculations on the transaction request.

[0062] In this way, the present application shortens the network processing path of transaction requests corresponding to high processing performance requirements through the first cryptographic computing service inside the gateway, and the request processing efficiency of the first cryptographic computing service developed using the C language is much higher than that of the second cryptographic computing service, that is, the first cryptographic computing service inside the gateway can provide higher processing performance to the outside world; in addition, because the second cryptographic computing service is mainly responsible for the cryptographic computing processing of transaction requests corresponding to low processing performance, relatively basic CPU (Central Processing Unit) resources and memory resources can be allocated to it, and because the first cryptographic computing service developed using the C language itself occupies a lower amount of resources than the second cryptographic computing service developed using the Java language itself, the overall occupancy rate of the CPU and memory resources of the cryptographic computing service is greatly reduced.

[0063] Accordingly, see Figure 4 As shown, the present application also provides a cryptographic computing device, which is applied to a first cryptographic computing service pre-integrated in a preset gateway, including:

[0064] The processing performance determination module 11 is used to determine the target processing performance required for the transaction request when obtaining the transaction request sent by the user terminal;

[0065] A first cryptographic calculation module 12, configured to asynchronously call a corresponding first cryptographic device locally to perform cryptographic calculation on the transaction request if the target processing performance belongs to a first preset category of processing performance;

[0066] The second cryptographic computing module 13 is configured to send the transaction request to a second cryptographic computing service located outside the preset gateway if the target processing performance belongs to a second preset category processing performance, so that the second cryptographic computing service calls a corresponding second cryptographic device to perform cryptographic calculation on the transaction request; wherein the first preset category processing performance is higher than the second preset category processing performance; and wherein the first cryptographic computing service and the second cryptographic computing service are services developed based on different computer languages, the processing performance of the first cryptographic computing service is stronger than that of the second cryptographic computing service, and the resource occupancy of the first cryptographic computing service is less than that of the second cryptographic computing service.

[0067] As can be seen from the above, before performing cryptographic calculation, the embodiment of the present application needs to determine the target processing performance required for the transaction request when the transaction request sent by the user end is obtained; if the target processing performance belongs to the first preset category processing performance, the corresponding cryptographic device is asynchronously called locally to perform cryptographic calculation on the transaction request; if the target processing performance is the second preset category processing performance, the transaction request is sent to the second cryptographic calculation service located outside the preset gateway, so that the second cryptographic calculation service calls the corresponding cryptographic device to perform cryptographic calculation on the transaction request; wherein the first preset category processing performance is higher than the second preset category processing performance; and the first cryptographic calculation service and the second cryptographic calculation service are services developed based on different computer languages, the processing performance of the first cryptographic calculation service is stronger than that of the second cryptographic calculation service, and the resource occupancy of the first cryptographic calculation service is less than that of the second cryptographic calculation service. In this way, the present application constructs a first cryptographic calculation service with high processing performance and integrates the first cryptographic calculation service into the preset gateway, so that the transaction request is processed by the first cryptographic calculation service inside the preset gateway. Compared with forwarding the transaction request to the second cryptographic calculation service outside the gateway for processing, the steps of encapsulating the transaction request by the preset gateway are reduced, and the processing speed of the transaction request is improved. Furthermore, since the processing performance of the first cryptographic computing service inside the gateway is stronger than that of the second cryptographic computing service outside the gateway, and the resource occupancy of the first cryptographic computing service inside the gateway is less than that of the second cryptographic computing service outside the gateway; therefore, the present application processes transaction requests with high processing performance through the first cryptographic computing service inside the gateway, and sends transaction requests with low processing performance to the second cryptographic computing service outside the gateway, so that the transaction requests are processed by the second cryptographic computing service, thereby improving the processing speed of transaction requests through differentiated processing and reducing the resources consumed in the request processing process.

[0068] In some specific implementations, the first password calculation module 12 includes:

[0069] The cryptographic device calling unit is used to select the first cryptographic device from a plurality of cryptographic devices that have established a first communication connection with the first cryptographic computing service in advance, and asynchronously call the first cryptographic device locally to perform cryptographic computing on the transaction request.

[0070] In some specific implementations, the second password calculation module 13 includes:

[0071] A transaction request sending unit is used to select a target second cryptographic computing service from several second cryptographic computing services that have pre-established a second communication connection with the preset gateway, and send the transaction request to the target second cryptographic computing service, so that the target second cryptographic computing service selects the second cryptographic device from several cryptographic devices that have pre-established the first communication connection with the target second cryptographic computing service, and calls the second cryptographic device to perform cryptographic calculation on the transaction request.

[0072] In some specific implementations, the first communication connection is a communication connection established based on the Transmission Control Protocol, and the second communication connection is a communication connection established based on the Hypertext Protocol.

[0073] In some specific implementations, the cryptographic computing device further includes:

[0074] The first result transceiver unit is used to obtain a first cryptographic calculation result obtained after the first cryptographic device performs cryptographic calculation on the transaction request, and send the first cryptographic calculation result to the preset development tool via the request forwarding module in the preset gateway, so that the preset development tool sends the first cryptographic calculation result to the user end.

[0075] In some specific implementations, the cryptographic computing device further includes:

[0076] A second result transceiver unit is used to obtain a second cryptographic calculation result sent by the second cryptographic device via the second cryptographic calculation service; the second cryptographic calculation result is a calculation result obtained after the second cryptographic device performs cryptographic calculation on the transaction request;

[0077] The third result transceiver unit is used to send the second password calculation result to the preset development tool via the request forwarding module, so that the preset development tool sends the second password calculation result to the user end.

[0078] In some specific implementations, the cryptographic computing device further includes:

[0079] A transaction request acquisition unit is used to acquire the transaction request sent by the user terminal via the request forwarding module in the preset gateway; wherein the transaction request is a request sent by the user terminal to the request forwarding module by calling a preset development tool; the preset gateway is a gateway selected from a gateway cluster by the preset development tool based on a preset load balancing strategy, and each gateway in the gateway cluster is integrated with the first cryptographic computing service.

[0080] Furthermore, the present application also discloses an electronic device. Figure 5This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the cryptographic calculation method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0081] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0082] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0083] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the cryptographic calculation method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0084] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed cryptographic calculation method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0085] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0086] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0087] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0088] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0089] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A cryptographic calculation method, characterized in that: The first cryptographic computing service pre-integrated in the preset gateway includes: When a transaction request sent by a user is obtained, determining a target processing performance required for the transaction request; If the target processing performance belongs to the first preset category processing performance, asynchronously calling the corresponding first cryptographic device locally to perform cryptographic calculation on the transaction request; If the target processing performance belongs to the second preset category processing performance, sending the transaction request to a second cryptographic computing service located outside the preset gateway, so that the second cryptographic computing service calls a corresponding second cryptographic device to perform cryptographic computing on the transaction request; Among them, the processing performance of the first preset category is higher than the processing performance of the second preset category; and, the first cryptographic computing service and the second cryptographic computing service are services developed based on different computer languages, the processing performance of the first cryptographic computing service is stronger than that of the second cryptographic computing service, and the resource occupancy of the first cryptographic computing service is less than that of the second cryptographic computing service.

2. The cryptographic calculation method according to claim 1, characterized in that: The locally asynchronously calling the corresponding first cryptographic device to perform cryptographic calculation on the transaction request includes: The first cryptographic device is selected from a plurality of cryptographic devices that have established a first communication connection with the first cryptographic computing service in advance, and the first cryptographic device is asynchronously called locally to perform cryptographic computing on the transaction request.

3. The password calculation method according to claim 2, characterized in that: The sending the transaction request to a second cryptographic computing service located outside the preset gateway so that the second cryptographic computing service calls a corresponding second cryptographic device to perform cryptographic computing on the transaction request includes: A target second cryptographic computing service is selected from several second cryptographic computing services that have pre-established a second communication connection with the preset gateway, and the transaction request is sent to the target second cryptographic computing service, so that the target second cryptographic computing service selects the second cryptographic device from several cryptographic devices that have pre-established the first communication connection with the target second cryptographic computing service, and calls the second cryptographic device to perform cryptographic calculation on the transaction request.

4. The password calculation method according to claim 3, characterized in that: The first communication connection is a communication connection established based on the transmission control protocol, and the second communication connection is a communication connection established based on the hypertext protocol.

5. The cryptographic calculation method according to claim 1, characterized in that: After the locally asynchronously calling the corresponding first cryptographic device to perform cryptographic calculation on the transaction request, the method further includes: Obtain a first cryptographic calculation result obtained after the first cryptographic device performs cryptographic calculation on the transaction request, and send the first cryptographic calculation result to a preset development tool via a request forwarding module in the preset gateway, so that the preset development tool sends the first cryptographic calculation result to the user end.

6. The password calculation method according to claim 5, characterized in that: After sending the transaction request to a second cryptographic computing service located outside the preset gateway so that the second cryptographic computing service calls a corresponding second cryptographic device to perform cryptographic computing on the transaction request, the method further includes: Obtaining a second cryptographic calculation result sent by the second cryptographic device via the second cryptographic calculation service; the second cryptographic calculation result is a calculation result obtained after the second cryptographic device performs cryptographic calculation on the transaction request; The second password calculation result is sent to the preset development tool via the request forwarding module, so that the preset development tool sends the second password calculation result to the user end.

7. The cryptographic calculation method according to any one of claims 1 to 6, characterized in that: Before determining the target processing performance required for the transaction request, the method further includes: Obtain the transaction request sent by the user terminal via the request forwarding module in the preset gateway; wherein the transaction request is a request sent by the user terminal to the request forwarding module by calling a preset development tool; the preset gateway is a gateway selected from a gateway cluster by the preset development tool based on a preset load balancing strategy, and each gateway in the gateway cluster is integrated with the first cryptographic computing service.

8. A cryptographic computing device, characterized in that: The first cryptographic computing service pre-integrated in the preset gateway includes: A processing performance determination module, used to determine the target processing performance required for the transaction request when obtaining the transaction request sent by the user terminal; A first cryptographic calculation module, configured to asynchronously call a corresponding first cryptographic device locally to perform cryptographic calculation on the transaction request if the target processing performance belongs to a first preset category of processing performance; A second cryptographic computing module is configured to send the transaction request to a second cryptographic computing service located outside the preset gateway if the target processing performance belongs to a second preset category processing performance, so that the second cryptographic computing service calls a corresponding second cryptographic device to perform cryptographic calculations on the transaction request; wherein the first preset category processing performance is higher than the second preset category processing performance; and wherein the first cryptographic computing service and the second cryptographic computing service are services developed based on different computer languages, the processing performance of the first cryptographic computing service is stronger than that of the second cryptographic computing service, and the resource occupancy of the first cryptographic computing service is less than that of the second cryptographic computing service.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the cryptographic calculation method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the steps of the cryptographic calculation method according to any one of claims 1 to 7 are implemented.

Images