Virtual cipher machine management method and device, equipment, medium and product

Abstract

The invention discloses a virtual cipher machine management method and device, equipment, a medium and a product, and relates to the technical field of computers, and the method comprises the steps: in response to a cipher machine application request, determining a target client identifier of a target client and the cipher machine number of virtual cipher machines required by the target client; determining a target address storage space corresponding to the target client according to the target client identifier, and determining target address information of a target virtual cipher machine from an idle cipher machine list according to the number of cipher machines; wherein the idle cipher machine list stores candidate address information of the candidate virtual cipher machine which is in an idle state at present; and moving the target address information from the idle cipher machine list to the target address storage space, so that the target client obtains the target address information in the target address storage space, and is connected with the target virtual cipher machine by using the target address information. The management and maintenance difficulty of the virtual cipher machine is reduced, and the management and maintenance efficiency of the virtual cipher machine is further improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a management method, device, equipment, medium and product of a virtual cryptographic machine. Background Art

[0002] The cloud server cryptographic machine in the cloud cryptographic service platform uses virtualization technology to create multiple virtual cryptographic machines on a physical server and allocate them to different users, thereby improving the flexibility of resource allocation and the utilization rate of a physical server. However, the number of virtual cryptographic machines that can be created by a physical server is limited after all. A platform that provides cryptographic machine services to the outside world cannot have only one physical server. If many physical servers are involved, the management of virtual cryptographic machines is essential.

[0003] The prior art maintains the logical relationship between users, physical servers and virtual cryptographic machines in a database. When a user applies to use a virtual cryptographic machine, the logical relationship is used to allocate corresponding virtual cryptographic machines to different users.

[0004] However, in actual applications, this logical relationship will be adjusted frequently, which forces external services to make corresponding adjustments. In addition, external services are also required to do load, which further increases the difficulty of managing and maintaining the virtual cipher machine and affects the management and maintenance efficiency of the virtual cipher machine. Summary of the invention

[0005] The present invention provides a management method, device, equipment, medium and product for a virtual cryptographic machine to solve the problem that the prior art relies on the logical relationship between users, physical servers and virtual cryptographic machines to manage and maintain virtual cryptographic machines, which has the problem of great difficulty in management and maintenance and leads to low management and maintenance efficiency.

[0006] According to one aspect of the present invention, there is provided a method for managing a virtual cryptographic machine, comprising:

[0007] In response to the cryptographic machine application request sent by the target client, determine the target client identifier of the target client and the number of cryptographic machines of the virtual cryptographic machine required by the target client;

[0008] Determine the target address storage space corresponding to the target client according to the target client identifier, and determine the target address information of the target virtual cryptographic machine from the idle cryptographic machine list according to the number of cryptographic machines; wherein the idle cryptographic machine list stores the candidate address information of the candidate virtual cryptographic machines currently in an idle state, and the candidate address information includes the IP information and / or port information of the candidate virtual cryptographic machine;

[0009] The target address information is moved from the idle cryptographic machine list to the target address storage space, so that the target client obtains the target address information in the target address storage space and uses the target address information to connect to the target virtual cryptographic machine.

[0010] According to another aspect of the present invention, there is provided a management device for a virtual cryptographic machine, comprising:

[0011] An information determination module, configured to determine a target client identifier of the target client and the number of virtual cryptographic machines required by the target client in response to a cryptographic machine application request sent by the target client;

[0012] a target address information determination module, used to determine the target address storage space corresponding to the target client according to the target client identifier, and determine the target address information of the target virtual cryptographic machine from the idle cryptographic machine list according to the number of cryptographic machines; wherein the idle cryptographic machine list stores the candidate address information of the candidate virtual cryptographic machines currently in an idle state, and the candidate address information includes the IP information and / or port information of the candidate virtual cryptographic machine;

[0013] The address information moving module is used to move the target address information from the idle cryptographic machine list to the target address storage space, so that the target client obtains the target address information in the target address storage space and uses the target address information to connect to the target virtual cryptographic machine.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the virtual cryptographic machine management method described in any one of the embodiments of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to implement the virtual cryptographic machine management method described in any one of the present invention when executed by a processor.

[0019] According to another aspect of the present invention, there is provided a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method for managing a virtual cryptographic machine as described in any one of the above-mentioned embodiments of the present invention.

[0020] The present invention records the candidate address information of the candidate virtual cryptographic machines that are currently in an idle state in the idle cryptographic machine list, so that when the target client sends a cryptographic machine application request, the service platform directly determines the target address information of the target virtual cryptographic machine that is in an idle state from the idle cryptographic machine list, and moves the target address information from the idle cryptographic machine list to the target address storage space exclusive to the target client, so that the target client can connect to the target virtual cryptographic machine. This achieves the effect of allocating an idle virtual cryptographic machine to the user for connection by only recording the candidate address information of the candidate virtual cryptographic machine that is currently in an idle state. Compared with the prior art that needs to maintain the logical relationship between the user, the physical server and the virtual cryptographic machine to realize the virtual cryptographic machine allocation solution, this greatly reduces the difficulty of managing and maintaining the virtual cryptographic machine, and further improves the management and maintenance efficiency of the virtual cryptographic machine.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 A flowchart of a method for managing a virtual cryptographic machine provided in Embodiment 1 of the present invention;

[0024] Figure 2 A flowchart of a method for managing a virtual cryptographic machine provided in Embodiment 2 of the present invention;

[0025] Figure 3 A schematic diagram of the structure of a virtual cryptographic machine management device provided in Embodiment 3 of the present invention;

[0026] Figure 4 It is a structural schematic diagram of an electronic device for implementing the management method of a virtual cryptographic machine according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "candidate", "target", "auxiliary", "other", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 This is a flowchart of a virtual cryptographic machine management method provided in the first embodiment of the present invention. This embodiment is applicable to the case where a service platform responds to a cryptographic machine application request sent by a client and allocates a virtual cryptographic machine to the client for connection. The method can be executed by a virtual cryptographic machine management device, which can be implemented in the form of hardware and / or software, such as a service platform implementation. Figure 1 As shown, the method includes:

[0031] S101. In response to a cryptographic machine application request sent by a target client, determine a target client identifier of the target client and the number of cryptographic machines of a virtual cryptographic machine required by the target client.

[0032] The target client refers to the client held by the target user, including but not limited to personal computers, smart phones or servers, etc. The target client can be understood as a client that has the need to use a virtual cipher. A virtual cipher refers to a virtualized cipher created on a physical server (physical cipher) using virtualization technology. A virtual cipher can provide data encryption / decryption, integrity verification, true random number generation, key generation and management for the client, maximize the performance of hardware resources, and provide secure and confidential data communication services for computer network systems in cloud environments.

[0033] The target client identifier refers to the unique identity identifier of the target client, that is, the corresponding target client can be uniquely identified according to the target client identifier. The target client identifier includes but is not limited to the client code, client version number or hardware device number of the target client.

[0034] In one embodiment, the target client generates a cryptographic machine application request according to the target client identifier and the number of cryptographic machines of the required virtual cryptographic machines, and sends the cryptographic machine application request to the service platform. The service platform obtains the cryptographic machine application request sent by the target client, and parses the cryptographic machine application request to obtain the target client identifier and the number of cryptographic machines of the virtual cryptographic machines required by the target client. The number of cryptographic machines of the virtual cryptographic machines required by the target client refers to the number of virtual cryptographic machines that the target client expects to apply to the service platform.

[0035] For example, assuming that the target client identifier is "000x111" and the number of virtual cryptographic machines required is three, a cryptographic machine application request is generated according to "000x111" and "three virtual cryptographic machines". The service platform parses the cryptographic machine application request accordingly to obtain the target client identifier "000x111" and the number of cryptographic machines "three virtual cryptographic machines".

[0036] S102: Determine the target address storage space corresponding to the target client according to the target client identifier, and determine the target address information of the target virtual cryptographic machine from the idle cryptographic machine list according to the number of cryptographic machines.

[0037] The idle cryptographic machine list stores the candidate address information of the candidate virtual cryptographic machines that are currently in an idle state. The candidate virtual cryptographic machines in an idle state refer to the virtual cryptographic machines that have not been applied for by any client. The candidate address information refers to the address information that enables the client to connect to the candidate virtual cryptographic machine, including the IP information and / or port information of the candidate virtual cryptographic machine. The target address storage space is the exclusive storage space allocated by the service platform to the target client, which is used to store the address information of the virtual cryptographic machine allocated by the service platform to the target client.

[0038] In one implementation, the service platform determines the target address storage space corresponding to the target client from at least one candidate address storage space included in the service platform according to the target client identifier and the association relationship between the candidate client identifier and the candidate address storage space.

[0039] In addition, the service platform determines the number of candidate cryptographic machines of the candidate virtual cryptographic machines that are currently in an idle state according to the idle cryptographic machine list, and compares the number of candidate cryptographic machines with the number of cryptographic machines of the virtual cryptographic machines required by the target client.

[0040] If the number of candidate cipher machines is less than the number of cipher machines, it means that the candidate virtual cipher machines currently in idle state cannot meet the number of virtual cipher machines required by the target client, then all candidate virtual cipher machines currently recorded in the idle cipher machine list will be used as target virtual cipher machines, and the candidate address information of all candidate virtual cipher machines will be used as the target address information of the target virtual cipher machines.

[0041] If the number of candidate cryptographic machines is greater than or equal to the number of cryptographic machines, it means that the candidate virtual cryptographic machines currently in the idle state can meet the number of cryptographic machines required by the target client. Then, according to the number of cryptographic machines, a corresponding number of candidate virtual cryptographic machines are extracted from all candidate virtual cryptographic machines currently recorded in the idle cryptographic machine list as target virtual cryptographic machines, and the candidate address information of the corresponding number of candidate virtual cryptographic machines is used as the target address information of the target virtual cryptographic machine. For example, assuming that the number of cryptographic machines required by the target client is "3", 3 candidate virtual cryptographic machines are extracted from the idle cryptographic machine list as target virtual cryptographic machines, and the candidate address information of these 3 candidate virtual cryptographic machines is used as the target address information of the target virtual cryptographic machine.

[0042] S103, moving the target address information from the idle cryptographic machine list to the target address storage space, so that the target client obtains the target address information in the target address storage space, and uses the target address information to connect to the target virtual cryptographic machine.

[0043] The service platform moves the target address information from the idle cipher machine list to the target address storage space, that is, deletes the target address information from the idle cipher machine list, and stores the target address information in the target address storage space.

[0044] The target client accesses the target address storage space in the service platform through the gateway, obtains the target address information from the target address storage space, and uses the IP information and port information of the target address information to connect to the target virtual cryptographic machine through the gateway.

[0045] The embodiment of the present invention records the candidate address information of the candidate virtual cryptographic machines that are currently in an idle state in the idle cryptographic machine list, so that when the target client sends a cryptographic machine application request, the service platform directly determines the target address information of the target virtual cryptographic machine that is in an idle state from the idle cryptographic machine list, and moves the target address information from the idle cryptographic machine list to the target address storage space exclusive to the target client, so that the target client can connect to the target virtual cryptographic machine. This achieves the effect of allocating an idle virtual cryptographic machine to the user for connection by only recording the candidate address information of the candidate virtual cryptographic machine that is currently in an idle state. Compared with the prior art that needs to maintain the logical relationship between the user, the physical server and the virtual cryptographic machine to realize the virtual cryptographic machine allocation solution, the management and maintenance difficulty of the virtual cryptographic machine is greatly reduced, and the management and maintenance efficiency of the virtual cryptographic machine is further improved.

[0046] Embodiment 2

[0047] Figure 2 This is a flowchart of a virtual cryptographic machine management method provided in Embodiment 2 of the present invention. This embodiment further optimizes and expands the above embodiment and can be combined with the above optional implementations. Figure 2 As shown, the method includes:

[0048] S201. In response to a cryptographic machine application request sent by a target client, determine a target client identifier of the target client and the number of cryptographic machines of the virtual cryptographic machine required by the target client.

[0049] S202: Match the target client identifier with at least one candidate client identifier, and use the candidate client identifier that matches the target client identifier as an auxiliary client identifier.

[0050] Exemplarily, assuming that the target client identifier is "0000010", "0000010" in the candidate client identifier is used as the auxiliary client identifier.

[0051] S203: According to the association relationship between the candidate client identifier and the candidate address storage space, the candidate address storage space associated with the auxiliary client identifier is used as the target address storage space corresponding to the target client.

[0052] For example, assuming that the auxiliary client identifier is "0000010", and in the association relationship between the candidate client identifier and the candidate address storage space, there is an association relationship between the candidate client identifier "0000010" and the candidate address storage space "storage space 1", then "storage space 1" is used as the target address storage space corresponding to the target client.

[0053] By matching the target client identifier with at least one candidate client identifier, and using the candidate client identifier that matches the target client identifier as the auxiliary client identifier; according to the association relationship between the candidate client identifier and the candidate address storage space, using the candidate address storage space that has an association relationship with the auxiliary client identifier as the target address storage space corresponding to the target client, thereby ensuring the compatibility between the target address storage space and the target client by using the identifier matching method, avoiding the problem of further storage errors of target address information due to incorrect determination of the target address storage space, and ensuring that the target client can accurately connect to the target virtual cryptographic machine.

[0054] S204: Determine the target address information of the target virtual cryptographic machine from the idle cryptographic machine list according to the number of cryptographic machines, and move the target address information from the idle cryptographic machine list to the address cache subspace in the target address storage space.

[0055] The address cache subspace is a subspace belonging to the target address storage space, and is used to temporarily cache the address information of the virtual cipher machine allocated to the target client, so as to further allocate the address information of the virtual cipher machine to different business types of the target client.

[0056] In one embodiment, the service platform determines the target address information of the target virtual cryptographic machine from the idle cryptographic machine list based on the number of cryptographic machines, and moves the target address information from the idle cryptographic machine list to the address cache subspace in the target address storage space, that is, deletes the target address information from the idle cryptographic machine list and stores the target address information in the address cache subspace.

[0057] S205 . In response to the target service type of the target service sent by the target client, determine a target service subspace corresponding to the target service type from at least one candidate service subspace included in the target address storage space.

[0058] Among them, the target client will execute different businesses, and different businesses may correspond to different business types. The target client will choose to use the target virtual cipher machine for any business type of business according to its actual business needs, and this business type is the target business type, and the business of this business type is the target business.

[0059] The target address storage space includes at least one candidate service subspace, each candidate service subspace being used to store address information of a virtual cryptographic machine to be used by a corresponding candidate service type. It can be understood that the target service subspace is a subspace belonging to the target address storage space, and is used to store target address information of a target virtual cryptographic machine to be used by a target service type.

[0060] In one implementation, the target client determines the target service type of the target service that needs to use the target virtual cryptographic machine according to its actual service needs, and sends the target service type of the target service to the service platform. The service platform obtains the target service type of the target service sent by the target client, and determines the target service subspace corresponding to the target service type from each candidate service subspace according to the target service type and the candidate service types corresponding to each candidate service subspace.

[0061] Optionally, determining a target service subspace corresponding to the target service type from at least one candidate service subspace included in the target address storage space includes:

[0062] The target business type is matched with the candidate business types corresponding to each candidate business subspace; and the candidate business subspace corresponding to the candidate business type matching the target business type is used as the target business subspace corresponding to the target business type.

[0063] For example, assuming that the target business type is "business type A", assuming that the candidate business type corresponding to candidate business subspace 1 is "business type A", the candidate business type corresponding to candidate business subspace 2 is "business type B", and the candidate business type corresponding to candidate business subspace 3 is "business type C". Since the candidate business type corresponding to candidate business subspace 1 matches the target business type, candidate business subspace 1 is used as the target business subspace corresponding to the target business type.

[0064] By matching the target business type with the candidate business types corresponding to each candidate business subspace; using the candidate business subspace corresponding to the candidate business type that matches the target business type as the target business subspace corresponding to the target business type, the adaptability between the target business subspace and the target business type is ensured, avoiding the problem of target address information storage errors caused by incorrect determination of the target business subspace, and ensuring that the target client can accurately connect to the target virtual cipher machine when executing the target business.

[0065] S206, moving the target address information from the address cache subspace to the target service subspace, so that when the target client executes the target service, the target address information is obtained in the target service subspace, and the target virtual cryptographic machine is connected using the target address information.

[0066] In one implementation, the service platform moves the target address information from the address cache subspace to the target service subspace, that is, deletes the target address information from the address cache subspace, and stores the target address information in the target service subspace.

[0067] When the target client executes the target business, it accesses the target business subspace in the service platform through the gateway, obtains the target address information from the target business subspace, and uses the IP information and port information of the target address information to connect to the target virtual cryptographic machine through the gateway.

[0068] By moving the target address information from the idle cipher machine list to the address cache subspace in the target address storage space; in response to the target business type of the target business sent by the target client, determining the target business subspace corresponding to the target business type from at least one candidate business subspace included in the target address storage space; moving the target address information from the address cache subspace to the target business subspace, so that when the target client executes the target business, the target address information is obtained in the target business subspace, and the target address information is used to connect to the target virtual cipher machine, thereby meeting the requirement that the client can use a specific virtual cipher machine when executing different business types of business, achieving the effect of isolating different virtual cipher machines according to business types, and ensuring the stability and security of client business implementation.

[0069] Optionally, also include:

[0070] A1. Determine the current access flow value of the target virtual cipher machine at the current moment, and compare the current access flow value with the flow value threshold.

[0071] The current access traffic value reflects the access traffic value of the target virtual cryptographic machine at the current moment. The traffic threshold represents the upper limit of the traffic that the target virtual cryptographic machine can carry, and is used to identify whether the current access traffic value of the target virtual cryptographic machine is too large. That is, if the current access traffic value is greater than the traffic threshold, it means that the current access traffic value is too large.

[0072] In one embodiment, the service platform determines the current access traffic value of the target virtual cryptographic machine at the current moment, obtains the traffic threshold, and then compares the current access traffic value with the traffic value threshold.

[0073] A2. When the current access traffic value is greater than the traffic value threshold, obtain other address information of any other virtual cryptographic machine from the address cache subspace.

[0074] Among them, if the current access traffic value is greater than the traffic value threshold, it means that the current access traffic value is too large and has exceeded the upper limit of the traffic that the target virtual cipher machine can carry, so the virtual cipher machine needs to be expanded to meet the current access traffic value. Other virtual cipher machines refer to virtual cipher machines other than the target virtual cipher machine stored in the address cache subspace, and correspondingly, other address information refers to the address information corresponding to other virtual cipher machines.

[0075] In one implementation, if the service platform determines that the current access traffic value is greater than the traffic value threshold, it obtains other address information of any other virtual cryptographic machine from the address cache subspace in the target address storage space.

[0076] A3. Move other address information from the address cache subspace to the target service subspace, so that when the target client executes the target service, it obtains other address information in the target service subspace and uses the other address information to connect to the other virtual cryptographic machine.

[0077] In one implementation, the service platform moves other address information from the address cache subspace to the target service subspace, that is, deletes other address information from the address cache subspace, and stores other address information in the target service subspace.

[0078] When the target client executes the target service, it accesses the target service subspace in the service platform through the gateway, obtains other address information from the target service subspace, and uses the IP information and port information of other address information to connect to other virtual cryptographic machines through the gateway. That is, when the target client executes the target service, it connects to the target virtual cryptographic machine and other virtual cryptographic machines at the same time, completing the expansion of the virtual cryptographic machine.

[0079] By determining the current access traffic value of the target virtual cipher machine at the current moment, and comparing the current access traffic value with the traffic value threshold; when the current access traffic value is greater than the traffic value threshold, obtaining other address information of any other virtual cipher machine from the address cache subspace; moving the other address information from the address cache subspace to the target business subspace, so that when the target client executes the target business, the other address information is obtained in the target business subspace, and the other virtual cipher machine is connected by using the other address information, so that if the current access traffic value exceeds the upper limit of the traffic that the target virtual cipher machine can carry, the effect of expanding the capacity of the virtual cipher machines available to the target client is achieved, thereby ensuring that the target client can use the virtual cipher machine stably and securely.

[0080] Optionally, also include:

[0081] B1. Determine the connection duration of the target client to the target virtual cryptographic machine, and compare the connection duration with the duration upper limit.

[0082] The duration upper limit value indicates the duration of use of the target client authorized by the service platform to the target client. It is understandable that when the connection duration of the target client to the target virtual cryptographic machine exceeds the duration upper limit value, the target client is no longer authorized to continue to be used.

[0083] In one implementation, the service platform determines the connection duration of the target client to the target virtual cryptographic machine and the upper limit of the duration associated with the target client, and then compares the connection duration with the upper limit of the duration.

[0084] B2. When the connection duration exceeds the upper limit, disconnect the connection between the target virtual cipher machine and the target client, and move the target address information from the target business subspace to the idle cipher machine list.

[0085] In one embodiment, if the service platform determines that the connection duration exceeds the upper limit of the duration, indicating that the target client has no right to continue to use the target client, the service platform actively disconnects the connection between the target virtual cipher machine and the target client, and moves the target address information from the target business subspace to the idle cipher machine list, that is, deletes the target address information from the target business subspace, and stores the target address information in the idle cipher machine list for other clients to continue to use.

[0086] By determining the connection time of the target client to the target virtual cryptographic machine, and comparing the connection time with the upper limit of the time; when the connection time exceeds the upper limit of the time, disconnecting the connection between the target virtual cryptographic machine and the target client, and moving the target address information from the target business subspace to the idle cryptographic machine list, the virtual cryptographic machine that exceeds the authorization period can be actively recovered in a timely manner, thereby ensuring the efficiency of virtual cryptographic machine management and maintenance.

[0087] Optionally, also include:

[0088] Obtain a disconnect request for a target virtual cryptographic machine sent by a target client; disconnect the connection between the target virtual cryptographic machine and the target client in response to the disconnect request, and move the target address information from the target business subspace to the address cache subspace.

[0089] In one embodiment, if the target client does not need to use the target virtual cryptographic machine temporarily, a disconnection request for the target virtual cryptographic machine is generated and sent to the service platform. The service platform obtains the disconnection request for the target virtual cryptographic machine sent by the target client, and disconnects the connection between the target virtual cryptographic machine and the target client in response to the disconnection request. In addition, the target address information is moved from the target business subspace to the address cache subspace, that is, the target address information is deleted from the target business subspace, and the target address information is stored in the address cache subspace, so that when the target client needs to continue to use the target virtual cryptographic machine, the target address information is called from the address cache subspace.

[0090] By obtaining a disconnect request sent by a target client to a target virtual cryptographic machine; disconnecting the connection between the target virtual cryptographic machine and the target client in response to the disconnect request, and moving the target address information from the target business subspace to the address cache subspace, the efficiency of virtual cryptographic machine management and maintenance is ensured.

[0091] Embodiment 3

[0092] Figure 3 This is a schematic diagram of the structure of a virtual cryptographic machine management device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0093] An information determination module 31, for determining a target client identifier of the target client and the number of virtual cryptographic machines required by the target client in response to a cryptographic machine application request sent by the target client;

[0094] The target address information determination module 32 is used to determine the target address storage space corresponding to the target client according to the target client identifier, and determine the target address information of the target virtual cryptographic machine from the idle cryptographic machine list according to the number of cryptographic machines; wherein the idle cryptographic machine list stores the candidate address information of the candidate virtual cryptographic machines currently in an idle state, and the candidate address information includes the IP information and / or port information of the candidate virtual cryptographic machine;

[0095] The address information moving module 33 is used to move the target address information from the idle cryptographic machine list to the target address storage space, so that the target client obtains the target address information in the target address storage space and uses the target address information to connect to the target virtual cryptographic machine.

[0096] Optionally, the target address information determination module 32 is specifically configured to:

[0097] Matching the target client identifier with at least one candidate client identifier, and using the candidate client identifier that matches the target client identifier as an auxiliary client identifier;

[0098] According to the association relationship between the candidate client identifier and the candidate address storage space, the candidate address storage space associated with the auxiliary client identifier is used as the target address storage space corresponding to the target client.

[0099] Optionally, the address information moving module 33 is specifically used to:

[0100] Moving the target address information from the idle cipher machine list to an address cache subspace in the target address storage space;

[0101] In response to a target service type of a target service sent by the target client, determining a target service subspace corresponding to the target service type from at least one candidate service subspace included in the target address storage space;

[0102] The target address information is moved from the address cache subspace to the target service subspace, so that when the target client executes the target service, the target address information is obtained in the target service subspace, and the target virtual cryptographic machine is connected using the target address information.

[0103] Optionally, the address information moving module 33 is further configured to:

[0104] Matching the target service type with the candidate service types corresponding to each of the candidate service subspaces;

[0105] The candidate service subspace corresponding to the candidate service type matching the target service type is used as the target service subspace corresponding to the target service type.

[0106] Optionally, the device further includes a virtual cipher machine expansion module, which is specifically used to:

[0107] Determine the current access flow value of the target virtual cryptographic machine at the current moment, and compare the current access flow value with the flow value threshold;

[0108] When the current access traffic value is greater than the traffic value threshold, obtaining other address information of any other virtual cryptographic machine from the address cache subspace;

[0109] The other address information is moved from the address cache subspace to the target service subspace, so that when the target client executes the target service, the other address information is obtained in the target service subspace, and the other virtual cryptographic machine is connected using the other address information.

[0110] Optionally, the device further includes a first connection interruption module, specifically configured to:

[0111] Determine the connection time of the target client to the target virtual cryptographic machine, and compare the connection time with the time upper limit;

[0112] When the connection duration exceeds the duration upper limit, the connection between the target virtual cryptographic machine and the target client is disconnected, and the target address information is moved from the target service subspace to the idle cryptographic machine list.

[0113] Optionally, the device further includes a second connection interruption module, specifically configured to:

[0114] Obtaining a disconnection request for the target virtual cryptographic machine sent by the target client;

[0115] In response to the disconnection request, the connection between the target virtual cryptographic machine and the target client is disconnected, and the target address information is moved from the target service subspace to the address cache subspace.

[0116] The management device of the virtual cryptographic machine provided in the embodiment of the present invention can execute the management method of the virtual cryptographic machine provided in any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0117] Embodiment 4

[0118] Figure 4 A schematic diagram of the structure of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0119] like Figure 4 As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0120] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0121] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 41 executes the various methods and processes described above, such as a management method of a virtual cryptographic machine.

[0122] In some embodiments, the management method of the virtual cryptographic machine can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the management method of the virtual cryptographic machine described above can be performed. Alternatively, in other embodiments, the processor 41 can be configured to execute the management method of the virtual cryptographic machine by any other appropriate means (for example, by means of firmware).

[0123] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0125] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0128] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0129] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0130] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for managing a virtual cryptographic machine, characterized in that: include: In response to the cryptographic machine application request sent by the target client, determine the target client identifier of the target client and the number of cryptographic machines of the virtual cryptographic machine required by the target client; Determine the target address storage space corresponding to the target client according to the target client identifier, and determine the target address information of the target virtual cryptographic machine from the idle cryptographic machine list according to the number of cryptographic machines; wherein the idle cryptographic machine list stores the candidate address information of the candidate virtual cryptographic machines currently in an idle state, and the candidate address information includes the IP information and / or port information of the candidate virtual cryptographic machine; The target address information is moved from the idle cryptographic machine list to the target address storage space, so that the target client obtains the target address information in the target address storage space and uses the target address information to connect to the target virtual cryptographic machine.

2. The method according to claim 1, characterized in that The determining, according to the target client identifier, a target address storage space corresponding to the target client includes: Matching the target client identifier with at least one candidate client identifier, and using the candidate client identifier that matches the target client identifier as an auxiliary client identifier; According to the association relationship between the candidate client identifier and the candidate address storage space, the candidate address storage space associated with the auxiliary client identifier is used as the target address storage space corresponding to the target client.

3. The method according to claim 1, characterized in that The step of moving the target address information to the target address storage space so that the target client obtains the target address information in the target address storage space and uses the target address information to connect to the target virtual cryptographic machine includes: Moving the target address information from the idle cipher machine list to an address cache subspace in the target address storage space; In response to a target service type of a target service sent by the target client, determining a target service subspace corresponding to the target service type from at least one candidate service subspace included in the target address storage space; The target address information is moved from the address cache subspace to the target service subspace, so that when the target client executes the target service, the target address information is obtained in the target service subspace, and the target virtual cryptographic machine is connected using the target address information.

4. The method according to claim 3, characterized in that The determining a target service subspace corresponding to the target service type from at least one candidate service subspace included in the target address storage space comprises: Matching the target service type with the candidate service types corresponding to each of the candidate service subspaces; The candidate service subspace corresponding to the candidate service type matching the target service type is used as the target service subspace corresponding to the target service type.

5. The method according to claim 3, further comprising: Determine the current access flow value of the target virtual cryptographic machine at the current moment, and compare the current access flow value with the flow value threshold; When the current access flow value is greater than the flow value threshold, acquiring other address information of any other virtual cryptographic machine from the address cache subspace; The other address information is moved from the address cache subspace to the target service subspace, so that when the target client executes the target service, the other address information is obtained in the target service subspace, and the other virtual cryptographic machine is connected using the other address information.

6. The method according to claim 3, further comprising: Determine the connection time of the target client to the target virtual cryptographic machine, and compare the connection time with the time upper limit; When the connection duration exceeds the duration upper limit, the connection between the target virtual cryptographic machine and the target client is disconnected, and the target address information is moved from the target service subspace to the idle cryptographic machine list.

7. The method according to claim 3, further comprising: Obtaining a disconnection request for the target virtual cryptographic machine sent by the target client; In response to the disconnection request, the connection between the target virtual cryptographic machine and the target client is disconnected, and the target address information is moved from the target service subspace to the address cache subspace.

8. A management device for a virtual cryptographic machine, characterized in that: include: An information determination module, configured to determine a target client identifier of the target client and the number of virtual cryptographic machines required by the target client in response to a cryptographic machine application request sent by the target client; a target address information determination module, used to determine the target address storage space corresponding to the target client according to the target client identifier, and determine the target address information of the target virtual cryptographic machine from the idle cryptographic machine list according to the number of cryptographic machines; wherein the idle cryptographic machine list stores the candidate address information of the candidate virtual cryptographic machines currently in an idle state, and the candidate address information includes the IP information and / or port information of the candidate virtual cryptographic machine; The address information moving module is used to move the target address information from the idle cryptographic machine list to the target address storage space, so that the target client obtains the target address information in the target address storage space and uses the target address information to connect to the target virtual cryptographic machine.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the virtual cryptographic machine management method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the virtual cryptographic machine management method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the management method of a virtual cryptographic machine according to any one of claims 1 to 7.

Images