Key configuration method, password operation method and related equipment

Abstract

The embodiment of the invention provides a key configuration method, a password operation method and related equipment, and the key configuration method comprises the steps: obtaining identification information which is used for indicating a target virtual machine for deploying a business system of a user, and / or deploying a target host machine of the target virtual machine; the target host machine runs based on hardware resources of a physical node, and the hardware resources comprise password operation resources; determining a target key corresponding to the user; configuring the target key to a physical node corresponding to the identification information; and sending the target key to a physical node, so that the physical node deploys a cryptographic operation engine used for calling the target key, and the cryptographic operation engine is used for executing cryptographic operation based on the target key and the cryptographic operation resource. According to the key configuration method, the password operation method and the related equipment provided by the embodiment of the invention, the resource consumption of the cloud platform is reduced, and the data processing efficiency of the cloud platform is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of cloud computing technology, and in particular to a key configuration method, a cryptographic operation method and related equipment. Background Art

[0002] In a cloud computing environment, users can deploy their business systems on virtual machines based on the hardware and software resources provided by the cloud platform. At the same time, their business data is also stored on the cloud platform. To ensure the security of user data, cloud platforms usually also provide cryptographic services to encrypt and decrypt user business data.

[0003] However, cloud platforms consume a lot of resources when providing cryptographic services. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a key configuration method, a cryptographic operation method and related devices to reduce the resource consumption of a cloud platform and improve the data processing efficiency of the cloud platform.

[0005] To solve the above problems, the embodiments of the present invention provide the following technical solutions:

[0006] An embodiment of the present invention provides a key configuration method, which is applied to a cloud password management center system. The method includes:

[0007] Acquire identification information, where the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host machine for deploying the target virtual machine; the target host machine runs based on hardware resources of a physical node, where the hardware resources include cryptographic computing resources;

[0008] determining a target key corresponding to the user;

[0009] The target key is configured to a physical node corresponding to the identification information; so that the physical node deploys a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0010] Optionally, determining the target key corresponding to the user includes:

[0011] Allocate a key corresponding to a target virtual machine or a target host machine as a target key for the user;

[0012] or,

[0013] Based on the user information, a corresponding target key is generated; the user information is the user's identity information and / or the user-defined information provided by the user.

[0014] Optionally, configuring the target key to a physical node corresponding to the identification information is specifically:

[0015] Distribute the target key to the physical node corresponding to the identification information.

[0016] Optionally, before obtaining the identification information, the step further includes:

[0017] Obtaining a registration request from a user, the registration request including cryptographic operation registration information, the cryptographic operation registration information being used to indicate that the user has a cryptographic operation requirement;

[0018] Based on the registration request, identity information is configured for the user, and the identity information is fed back to the cloud resource management platform.

[0019] Optionally, the registration request further includes custom information provided by the user for generating a target key, and after configuring identity information for the user based on the registration request, the method further includes:

[0020] The custom information and the identity information are recorded as user information.

[0021] The embodiment of the present invention further provides a key configuration method, which is applied to a cloud resource management platform, and the method includes:

[0022] Acquiring resource application information of a user, wherein the resource application information includes application information for cryptographic computing resources;

[0023] Based on the resource application information, a target virtual machine for deploying the user's business system is allocated; the target virtual machine is deployed in a target host machine, and the target host machine runs based on the hardware resources of the physical node, and the hardware resources include cryptographic computing resources;

[0024] Send identification information to the cloud password management center system, where the identification information is used to indicate the target virtual machine for deploying the user's business system and / or the target host for deploying the target virtual machine; so that the cloud password management center system determines the target key corresponding to the user, and configures the target key to the physical node corresponding to the identification information; and then enables the physical node to deploy a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0025] Optionally, the resource application information further includes identity information of the user, and before the step of allocating a target virtual machine for deploying the user's business system based on the resource application information, the step further includes:

[0026] The user's identity information is determined, and when the user is a legitimate user, the step of allocating a target virtual machine for deploying the user's business system based on the resource application information is performed.

[0027] Optionally, before obtaining the user's resource application information, the process further includes:

[0028] Get the user's registration request;

[0029] When it is determined that the registration request includes cryptographic operation registration information, forwarding the registration request to the cloud cryptographic management center system, so that the cloud cryptographic management center system configures identity information for the user based on the registration request, and feeds back the identity information to the cloud resource management platform; wherein the cryptographic operation registration information is used to indicate that the user has a cryptographic operation requirement;

[0030] The identity information is obtained and recorded.

[0031] The embodiment of the present invention further provides a key configuration method, which is applied to a physical node, wherein the physical node corresponds to identification information; the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host for deploying the target virtual machine; the target host runs based on hardware resources of the physical node, wherein the hardware resources include cryptographic computing resources; the method comprises:

[0032] Obtaining a target key, where the target key corresponds to a user;

[0033] A cryptographic operation engine is deployed to call the target key; wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0034] The embodiment of the present invention further provides a cryptographic operation method, which is applied to the business system layer, and the method includes:

[0035] Obtain the user's cryptographic operation service request;

[0036] Based on the cryptographic operation service request, scheduling a service system in idle mode so that the service system calls a cryptographic operation engine, executes the cryptographic operation service request, and returns the operation result to the service system layer; the cryptographic operation engine is configured based on the key configuration method described in the embodiment of the present invention;

[0037] Obtain the operation result.

[0038] The embodiment of the present invention further provides a key configuration device, which is configured in a cloud password management center system, including:

[0039] A first information acquisition module is used to acquire identification information, where the identification information is used to indicate a target virtual machine for deploying a user's business system and / or a target host machine for deploying the target virtual machine; the target host machine runs based on hardware resources of a physical node, where the hardware resources include cryptographic computing resources;

[0040] A key determination module, used to determine a target key corresponding to the user;

[0041] The first key configuration module is used to configure the target key to the physical node corresponding to the identification information; so that the physical node deploys a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0042] The embodiment of the present invention further provides a key configuration device, which is configured on a cloud resource management platform, comprising:

[0043] A second information acquisition module is used to acquire resource application information of the user, wherein the resource application information includes application information for cryptographic computing resources;

[0044] A resource allocation module, configured to allocate a target virtual machine for deploying a user's business system based on the resource application information; the target virtual machine is deployed in a target host machine, and the target host machine runs based on hardware resources of a physical node, wherein the hardware resources include cryptographic computing resources;

[0045] An information sending module is used to send identification information to a cloud password management center system, wherein the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host for deploying the target virtual machine; so that the cloud password management center system determines a target key corresponding to the user, and configures the target key to a physical node corresponding to the identification information; and then enables the physical node to deploy a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0046] The embodiment of the present invention further provides a key configuration device, which is configured in a physical node, the physical node corresponds to identification information, the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host for deploying the target virtual machine; the target host runs based on hardware resources of the physical node, and the hardware resources include cryptographic computing resources; the key configuration device includes:

[0047] A key acquisition module, used to acquire a target key, where the target key corresponds to a user;

[0048] The second key configuration module is used to configure the target key and deploy a cryptographic operation engine for calling the target key; wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0049] The embodiment of the present invention further provides a cryptographic operation device, which is configured at the business system layer and includes:

[0050] The third information acquisition module is used to obtain the user's password operation service request;

[0051] A scheduling module, configured to schedule a service system in an idle mode based on the cryptographic operation service request, so that the service system calls a cryptographic operation engine, executes the cryptographic operation service request, and returns the operation result to the service system layer; the cryptographic operation engine is obtained by configuring the key configuration device according to the embodiment of the present invention;

[0052] The result acquisition module is used to obtain the operation result.

[0053] An embodiment of the present invention further provides a computer program, comprising one or more computer executable instructions, which, when executed, implement the key configuration method described in the embodiment of the present invention, or implement the cryptographic operation method described in the embodiment of the present invention.

[0054] It can be seen that an embodiment of the present invention provides a key configuration method, a cryptographic operation method and related equipment, wherein the key configuration method includes: obtaining identification information, wherein the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host for deploying the target virtual machine; the target host runs based on hardware resources of a physical node, and the hardware resources include cryptographic operation resources; determining a target key corresponding to the user; configuring the target key to a physical node corresponding to the identification information; so that the physical node deploys a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0055] It can be seen that the embodiment of the present invention is based on the proposed key configuration scheme, and configures the target key corresponding to the user in the physical node that provides hardware resources for the target virtual machine, so that the physical node deploys a cryptographic operation engine for calling the target key, so that the cryptographic operation engine performs cryptographic operations based on the target key and the cryptographic operation resources in the physical node, and realizes the use of physical nodes in the server to provide cryptographic services for the business system, so as to avoid the consumption of network bandwidth resources by cryptographic services, reduce the resource consumption of the cloud platform, and improve the data processing efficiency of the cloud platform.

[0056] Furthermore, in scenarios with a large number of cryptographic service demands, the corresponding cryptographic services will not be limited by the performance of network services, thereby improving the efficiency of cryptographic services. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0058] Figure 1 This is an optional architecture diagram for a cloud platform;

[0059] Figure 2 An optional architecture diagram of a cloud platform provided for an embodiment of the present invention;

[0060] Figure 3 An optional flow chart of a key configuration method provided by an embodiment of the present invention;

[0061] Figure 4 Another optional flow chart of the key configuration method provided by an embodiment of the present invention;

[0062] Figure 5 An optional flow chart of a cryptographic operation method provided by an embodiment of the present invention;

[0063] Figure 6 A schematic diagram of the structure of a key configuration device provided by an embodiment of the present invention;

[0064] Figure 7 A schematic diagram of the structure of another key configuration device provided by an embodiment of the present invention;

[0065] Figure 8 A schematic diagram of the structure of another key configuration device provided by an embodiment of the present invention;

[0066] Fig. 9 A schematic diagram of the structure of a cryptographic operation device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0067] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] Thanks to the maturity and popularity of cloud computing technology, cloud computing users are free from the tedious maintenance and upgrade of computer rooms or servers. Figure 1 An optional architecture diagram of a cloud platform is shown, in which cloud computing provides services to customers in the form of virtual machines. The user's business system is deployed on the virtual machine of the cloud platform, and the virtual machine provides the hardware resources required for the operation of the business system based on the host machine where it is located. Among them, the hardware resources can be understood as the hardware resources of the server of the cloud platform. In an optional implementation, the server can be a distributed system, including multiple physical nodes, and the business system can be deployed on the virtual machine running on the physical node. It can be understood that in a cloud computing environment, the user's business system is deployed on the cloud platform, and accordingly, the user's business data is also stored on the cloud platform.

[0069] Continue to refer Figure 1 In an optional example, to ensure the user's data security, the cloud platform can configure a dedicated cloud cryptographic resource pool to provide cryptographic services for the business system. At the same time, the cloud platform can also configure a cloud key management system for key management and a cloud cryptographic resource pool management platform for key scheduling and monitoring to provide key management and scheduling services for the business system.

[0070] Among them, the cloud cryptographic resource pool acts as an independent cryptographic service provider. When the business system calls the cryptographic service, it needs to perform data interaction based on the network within the cloud platform.

[0071] Specifically, when the business system calls the cryptographic service, it needs to transfer the business data that needs to be encrypted and decrypted from the server where its host machine is located to the cloud cryptographic resource pool, and call the corresponding cryptographic service in the cloud cryptographic resource pool to perform the corresponding encryption and decryption tasks; after the corresponding encryption and decryption tasks are completed, the corresponding result data needs to be transmitted back to the server where the host machine of the business system is located.

[0072] The inventors believe that cryptographic operations usually involve a large amount of data copying and migration, which causes this type of cryptographic service to occupy a large amount of network bandwidth resources and have a significant impact on network services. In scenarios with a large number of cryptographic service demands, the efficiency of cryptographic services may be affected due to performance limitations of network services.

[0073] In view of this, the embodiments of the present invention propose a key configuration method, a cryptographic operation method and related equipment, and use the server running the business system to provide cryptographic services for the business system, so as to avoid the consumption of network bandwidth resources by the cryptographic service, reduce the resource consumption of the cloud platform, and improve the data processing efficiency of the cloud platform.

[0074] Furthermore, in scenarios with a large number of cryptographic service demands, the corresponding cryptographic services will not be limited by the performance of network services, thereby improving the efficiency of cryptographic services.

[0075] As an optional example of the disclosure of the embodiments of the present invention, Figure 2 An optional architecture diagram of a cloud platform is shown exemplarily. It should be noted that the architecture diagram is shown to facilitate understanding of the disclosed content of the embodiment of the present invention, and the embodiment of the present invention is not limited to Figure 2 The architecture shown.

[0076] refer to Figure 2 ,The cloud platform architecture may include: a server, multiple virtual machines deployed on the server, and ,a business system deployed on the virtual machines.

[0077] The server may be composed of multiple physical nodes, and accordingly, the virtual machine is deployed on one or more physical nodes. Among them, the host machine (not shown in the figure) running in the physical node can configure and manage hardware resources for the virtual machine.

[0078] It should be noted that, in the embodiment of the present invention, the physical node is also configured with cryptographic computing resources, so as to provide hardware resources for the physical node to provide cryptographic services to users. Accordingly, the physical node is also configured with a cryptographic computing management module, which is used to enable the business system to perform cryptographic computing based on the cryptographic computing resources in the physical node, so as to achieve the management and configuration of the cryptographic computing resources of the physical node.

[0079] The business system can be understood as a system for users to manage various business activities. Multiple business systems constitute the business system layer, which is used to provide support for the business application layer; the business application layer is oriented towards user needs and is used to provide users with the required application software and services.

[0080] In the specific implementation, the cloud platform architecture further includes a cloud resource management platform (Cloud Management Platform, CMP) and a cloud key management center system (Cloud Key Management Center, CKMC), wherein the cloud resource management platform is used to integrate, manage and monitor cloud computing resources, and the cloud key management center system is used to configure and manage cryptographic computing resources in physical nodes.

[0081] It can be understood that the cloud platform architecture provided by the embodiment of the present invention realizes the function of the cryptographic machine by running the server itself of the business system, so that the cryptographic operations corresponding to the business system can be run on a distributed node (that is, a physical node) of the server, and cryptographic-related applications no longer need to specifically access the cryptographic resource pool, but are directly processed by the cryptographic operation management module built into the server, thereby avoiding the consumption of network bandwidth resources by cryptographic services, reducing the resource consumption of the cloud platform, and improving the data processing efficiency of the cloud platform.

[0082] As an optional implementation of the disclosed content of the embodiment of the present invention, the embodiment of the present invention provides a key configuration method, which is used to determine a key corresponding to a user and configure the key to a corresponding physical node, so that the user can directly call the cryptographic operation resource on the physical node based on the corresponding configuration, such as Figure 3 As shown, Figure 3 An optional flow chart of a key configuration method provided in an embodiment of the present invention, the key configuration method can be based on Figure 2 The secure virtual architecture is executed as shown, specifically, the method includes:

[0083] Step S100: The cloud resource management platform obtains the user's resource application information, wherein the resource application information includes demand information for cryptographic computing resources;

[0084] The cloud resource management platform is used to manage the cloud computing resources of the cloud platform, including the allocation of cloud resources, etc. The cloud computing resources may include software resources, hardware resources, etc. of the cloud platform. In virtualization technology, the cloud computing resources may also include virtual resources, such as virtual machines, etc. In the embodiment of the present invention, based on the configuration of cryptographic computing resources in the server, the cloud computing resources may further include the cryptographic computing resources.

[0085] The user's resource application information may include application information for cryptographic computing resources, so that corresponding cryptographic services can be provided to the user based on the resource application information. It is understandable that the resource application information may further include application information for other cloud computing resources, such as application information for virtual machines, so that corresponding virtual machines can be allocated to the user based on the resource application information.

[0086] In a specific example, the resource application information may also include user identity information, so that the user can apply for cloud computing resources based on the user identity information, such as a user identification (user ID).

[0087] Step S110: the cloud resource management platform allocates a target virtual machine for deploying the user's business system based on the resource application information;

[0088] After obtaining the resource application information, corresponding resource allocation can be performed based on the resource application information. In virtualization technology, corresponding virtual resources can be allocated to users in the form of virtual machines to deploy the user's business system to the corresponding virtual machine. In an embodiment of the present invention, the virtual machine allocated for deploying the user's business system is the target virtual machine. It can be understood that the resource configuration of the target virtual machine is adapted to the user's resource application information, so that the corresponding cloud computing resources are provided to the user based on the resource configuration of the target virtual machine.

[0089] The number of the target virtual machines can be one or more (i.e., two or more). The specific number can be determined based on the resource allocation plan in the cloud platform and the needs of the user's business system. For example, in the cloud platform, the cloud computing resources that can be configured for a virtual machine are limited. When the cloud computing resources requested by the user exceed the carrying capacity of a virtual machine, multiple virtual machines can be allocated as target virtual machines to meet the user's demand for cloud computing resources.

[0090] It should be noted that, in a specific architecture, the target virtual machine is deployed in a target host machine, and the target host machine is used to indicate the host machine where the target virtual machine is deployed. It can be understood that multiple virtual machines can be deployed in a host machine, and accordingly, in an embodiment of the present invention, a target host machine can deploy multiple target virtual machines, or can deploy at least one target virtual machine and at least one virtual machine for deploying other user business systems, and the present invention does not make specific limitations here.

[0091] It is understandable that, on the server side, the host machine runs based on the hardware resources of the physical node configured in the server, wherein, in the embodiment of the present invention, the physical node is configured with cryptographic computing resources, and accordingly, the host machine configured in the physical node can allocate and manage the corresponding cryptographic computing resources. The target host machine corresponding to the deployment target virtual machine can also run based on the hardware resources of the physical node, and the hardware resources may include cryptographic computing resources.

[0092] The host machine, as a management system for hardware resources in the server, can be configured on one physical node or multiple physical nodes, which is not specifically limited in the present invention. Correspondingly, the target host machine can be configured on one physical node or multiple physical nodes.

[0093] After determining that the resource application information includes application information for cryptographic computing resources, the cloud resource management platform can execute this step to configure the target key and cryptographic computing engine, thereby utilizing the target virtual machine and the physical node on which the target virtual machine is deployed to perform corresponding cryptographic operations.

[0094] It should be noted that when the resource application information includes the user's identity information, the cloud resource management platform may also perform this step after determining the user's identity information and determining that the user is a legitimate user.

[0095] In a further example, after allocating a target virtual machine for deploying the user's business system in step S110, the cloud resource management platform of the embodiment of the present invention may further synchronously start the target virtual machine for deployment and use by the corresponding business system.

[0096] It is understandable that a user may have multiple business systems, and different business systems are deployed on different target virtual machines. Correspondingly, multiple distributed business systems may constitute a business system layer to implement management and scheduling of the business system based on the business system layer.

[0097] Step S120: The cloud resource management platform sends the identification information to the cloud password management center system;

[0098] The identification information is used to indicate the target virtual machine for deploying the user's business system, and / or the target host for deploying the target virtual machine. The identification information may indicate the target virtual machine, or the target host, or may indicate both the target virtual machine and the target host at the same time. The identification information may be, for example, IP information, and accordingly, when indicating a virtual machine, it corresponds to the virtual machine IP, and when indicating a host, it corresponds to the host IP.

[0099] By sending the identification information to indicate the configuration location of the corresponding user's target key, the user's target key is configured to the physical node running the user's business system. When providing encryption services to users, there is no need for network-level data transmission. Instead, the cryptographic computing resources of the physical node running the user's business system can be directly used to perform corresponding key operations, thereby avoiding the consumption of network bandwidth resources by cryptographic services and reducing resource consumption on the cloud platform.

[0100] Correspondingly, the cloud password management center system can obtain the identification information.

[0101] Step S130: The cloud password management center system determines the target key corresponding to the user;

[0102] The target key is the key of the corresponding user. The target key can be the key assigned to the user by the cloud password management center system, or it can be the key generated by the cloud password management center system based on user information.

[0103] Specifically, the key assigned to the user may be, for example, a key corresponding to the target virtual machine or target host machine. For example, in an optional scenario, a corresponding key may be assigned to the virtual machine or host machine in advance, so that when determining the target key corresponding to the user, the key corresponding to the target virtual machine or target host machine is used as the target key corresponding to the user.

[0104] Accordingly, when a key is generated based on user information, the user information may be the user's identity information and / or user-defined information provided by the user. For example, in an optional scenario, the resource application information obtained by the cloud resource management platform may carry the user information, and the user information may be sent to the cloud password management center system as part of the identification information, and then the target key may be generated based on the user information.

[0105] Step S140: The cloud password management center system configures the target key to the physical node corresponding to the identification information;

[0106] After determining the target key, the target key can be configured to the corresponding physical node to provide cryptographic services to the user directly on the server side based on the corresponding physical node.

[0107] Wherein, the identification information indicates the target virtual machine and / or the target host machine, so that the target key can be configured to the physical node corresponding to the identification information based on the identification information, such as the physical node where the target virtual machine is located, or the physical node where the target host machine is located, etc. It should be noted that the target virtual machine and the target host machine are not one-to-one corresponding, and the target host machine and the physical node are not one-to-one corresponding, that is, there is a target virtual machine on the target host machine, but there may be virtual machines of other users at the same time, and corresponding to the physical node, the physical node corresponding to the target virtual machine must be used to deploy the target host machine and the corresponding target virtual machine, and the physical node corresponding to the target host machine may not necessarily be deployed with the target virtual machine, but the physical node corresponding to the target host machine must cover the physical node corresponding to the target virtual machine, therefore, the embodiment of the present invention can confirm the physical node based on the identification information of the target virtual machine, and can also confirm the physical node based on the target host machine.

[0108] Specifically, the cloud password management center system can distribute the target key to the physical node corresponding to the identification information. In a specific example, it can be distributed to the cryptographic operation management module of the corresponding physical node. Correspondingly, the cryptographic operation management module of the physical node can obtain the target key.

[0109] Step S150: The physical node deploys a cryptographic operation engine for invoking the target key;

[0110] It is understandable that the physical node is a hardware device on the server side running the target virtual machine, and the physical node can obtain the target key, configure the target key, and deploy a cryptographic operation engine for calling the target key. In a specific example, the target key can be configured to the cryptographic operation management module of the physical node.

[0111] The cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources. That is, when the business system receives a business request for cryptographic operations (also called a cryptographic operation business request), the physical node running the target virtual machine can be used to call the target key configured to the physical node based on the cryptographic operation engine, and the cryptographic operation resources in the physical node can be used to perform the corresponding cryptographic operations, thereby directly performing cryptographic operations on the physical node.

[0112] In a specific example, the cryptographic operation engine can be deployed in a target virtual machine, so that the business system deployed in the target virtual machine can use the cryptographic operation engine to call related functions.

[0113] In a further example, in the embodiment of the present invention, the identity information of the corresponding user can also be pre-configured on the cloud platform based on the user registration process. Figure 4 Another optional flow chart of the key configuration method provided by an embodiment of the present invention is shown. In the key configuration method, before executing step S100, the method further includes:

[0114] Step S200: The cloud resource management platform obtains a user's registration request;

[0115] The registration request may include cryptographic operation registration information, and the cryptographic operation registration information is used to indicate that the user has a cryptographic operation requirement.

[0116] In a specific example, the registration request may be a request for registering a cloud password account, wherein the cloud password account may be understood as an account for configuring cryptographic computing resources.

[0117] Step S210: When the cloud resource management platform determines that the registration request includes cryptographic operation registration information, the cloud resource management platform forwards the registration request to the cloud cryptographic management center system;

[0118] Among them, by forwarding the registration request to the cloud password management center system, the identity information is configured for the user based on the cloud password management center system.

[0119] Step S220: The cloud password management center system configures identity information for the user based on the registration request, and feeds the identity information back to the cloud resource management platform;

[0120] After obtaining the registration request, the cloud password management center system can configure identity information for the user and configure specific account information for the user.

[0121] In a specific example, when it is determined that the user meets the use conditions, identity information may be configured for the user, and the identity information may be, for example, a user identifier (user ID). It is understandable that after the identity information is configured, the identity information may also be recorded as user information.

[0122] In an optional implementation, the registration request obtained by the cloud resource management platform may further include user-defined information provided by the user for generating the target key. Accordingly, the cloud password management center system may simultaneously record the user-defined information and the identity information as user information.

[0123] Step S230: the cloud resource management platform obtains and records the identity information;

[0124] The identity information is obtained and recorded so as to confirm the corresponding identity information in the subsequent key configuration process.

[0125] After obtaining the identity information, the cloud resource management platform may also present or feed back the identity information to the user.

[0126] In a further example, the embodiment of the present invention further provides a cryptographic operation method, which is applied to the cloud platform provided by the embodiment of the present invention, referring to Figure 5 An optional flow chart of a cryptographic operation method provided by an embodiment of the present invention is shown, the method comprising:

[0127] Step S300: The business system layer obtains the user's cryptographic operation business request;

[0128] The business system layer can be understood as a management platform for managing and scheduling business systems distributed in multiple virtual machines. The business system layer can allocate corresponding business systems based on the acquired business requests so that the corresponding business systems execute the corresponding business requests.

[0129] The cryptographic operation service request is a service request for requesting to perform a cryptographic operation. In a specific example, a user may issue the cryptographic operation service request based on the service application layer, so that the service system layer obtains the cryptographic operation service request and allocates a corresponding service system based on the cryptographic operation service request.

[0130] Step S310: The business system layer schedules the business system in idle mode based on the cryptographic operation business request;

[0131] By scheduling the business system in idle mode, the business operation efficiency is improved. It should be noted that the scheduled business system is a business system deployed to the target virtual machine, which performs the corresponding cryptographic operation based on the target key configured based on the above method.

[0132] Step S320: the business system calls the cryptographic operation engine to execute the cryptographic operation business request;

[0133] It can be understood that, based on the aforementioned key configuration method, the business system in this step can directly call the target key and cryptographic operation resources configured in the physical node based on the target virtual machine where it is located to implement the corresponding cryptographic operation.

[0134] Wherein, the cryptographic operation engine is configured based on the aforementioned key configuration method to call the target key corresponding to the user.

[0135] Step S330: The business system returns the calculation result to the business system layer.

[0136] After the cryptographic operation is completed, the corresponding operation result can be returned to the business system layer, so that the business system layer obtains the operation result, forwards the operation result to the business application layer, and further presents the result to the user based on the business application layer.

[0137] The embodiment of the present invention also provides a key configuration device, such as Figure 6 As shown, Figure 6 A schematic diagram of the structure of a key configuration device provided in an embodiment of the present invention, wherein the key configuration device is configured in a cloud password management center system, including:

[0138] The first information acquisition module 400 is used to acquire identification information, where the identification information is used to indicate a target virtual machine for deploying a user's business system and / or a target host for deploying the target virtual machine; the target host runs based on hardware resources of a physical node, where the hardware resources include cryptographic computing resources;

[0139] A key determination module 410, configured to determine a target key corresponding to the user;

[0140] The first key configuration module 420 is used to configure the target key to the physical node corresponding to the identification information; so that the physical node deploys a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0141] Optionally, the key determination module 410 is used to determine a target key corresponding to the user, including:

[0142] Allocate a key corresponding to a target virtual machine or a target host machine as a target key for the user;

[0143] or,

[0144] Based on the user information, a corresponding target key is generated; the user information is the user's identity information or the custom information provided by the user.

[0145] Optionally, the first key configuration module 420 is used to configure the target key to a physical node corresponding to the identification information, specifically:

[0146] Distribute the target key to the physical node corresponding to the identification information.

[0147] Optionally, the first information acquisition module 400 is further used to:

[0148] Obtaining a registration request from a user, the registration request including cryptographic operation registration information, the cryptographic operation registration information being used to indicate that the user has a cryptographic operation requirement;

[0149] Based on the registration request, identity information is configured for the user, and the identity information is fed back to the cloud resource management platform.

[0150] Optionally, the registration request further includes user-defined information provided by the user for generating a target key, and the first information acquisition module 400 is further used to:

[0151] The custom information and the identity information are recorded as user information.

[0152] The embodiment of the present invention also provides a key configuration device, such as Figure 7 As shown, Figure 7 A schematic diagram of the structure of another key configuration device provided by an embodiment of the present invention, wherein the key configuration device is configured on a cloud resource management platform, including:

[0153] The second information acquisition module 500 is used to acquire the user's resource application information, wherein the resource application information includes application information for cryptographic computing resources;

[0154] The resource allocation module 510 is used to allocate a target virtual machine for deploying the user's business system based on the resource application information; the target virtual machine is deployed in a target host machine, and the target host machine runs based on the hardware resources of the physical node, and the hardware resources include cryptographic computing resources;

[0155] The information sending module 520 is used to send identification information to the cloud password management center system, wherein the identification information is used to indicate the target virtual machine for deploying the user's business system, and / or the target host for deploying the target virtual machine; so that the cloud password management center system determines the target key corresponding to the user, and configures the target key to the physical node corresponding to the identification information; and then enables the physical node to deploy a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0156] Optionally, the resource application information also includes user identity information, and the resource allocation module is further used to:

[0157] The user's identity information is determined, and when the user is a legitimate user, the step of allocating a target virtual machine for deploying the user's business system based on the resource application information is performed.

[0158] Optionally, the second information acquisition module 500 is further used to:

[0159] Get the user's registration request;

[0160] When it is determined that the registration request includes cryptographic operation registration information, forwarding the registration request to the cloud cryptographic management center system, so that the cloud cryptographic management center system configures identity information for the user based on the registration request, and feeds back the identity information to the cloud resource management platform; wherein the cryptographic operation registration information is used to indicate that the user has a cryptographic operation requirement;

[0161] The identity information is obtained and recorded.

[0162] The embodiment of the present invention also provides a key configuration device, such as Figure 8 As shown, Figure 8 A schematic diagram of the structure of another key configuration device provided in an embodiment of the present invention, wherein the key configuration device is configured in a physical node, wherein the physical node corresponds to identification information, wherein the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host for deploying the target virtual machine; the target host runs based on hardware resources of the physical node, wherein the hardware resources include cryptographic computing resources; and comprises:

[0163] A key acquisition module 600 is used to acquire a target key, where the target key corresponds to a user;

[0164] The second key configuration module 610 is used to configure the target key and deploy a cryptographic operation engine for calling the target key; wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

[0165] The embodiment of the present invention also provides a cryptographic operation device, such as Fig. 9 As shown, Fig. 9 A schematic diagram of the structure of a cryptographic operation device provided in an embodiment of the present invention, wherein the cryptographic operation device is configured at a business system layer and includes:

[0166] The third information acquisition module 700 is used to obtain the user's cryptographic operation service request;

[0167] The scheduling module 710 is used to schedule the service system in idle mode based on the cryptographic operation service request, so that the service system calls the cryptographic operation engine, executes the cryptographic operation service request, and returns the operation result to the service system layer; the cryptographic operation engine is obtained after being configured based on the key configuration device according to the embodiment of the present invention;

[0168] The result acquisition module 720 is used to acquire the operation result.

[0169] An embodiment of the present invention also provides a computer program, including one or more computer executable instructions, which, when executed, implement the key configuration method provided in any of the above embodiments, or implement the cryptographic operation method provided in the above embodiments.

[0170] The key configuration method, cryptographic operation method and related equipment provided in the embodiments of the present invention utilize a server to provide cryptographic services for a business system, thereby avoiding the consumption of network bandwidth resources by cryptographic services, reducing the resource consumption of a cloud platform, and improving the data processing efficiency of the cloud platform.

[0171] Furthermore, in scenarios with a large number of cryptographic service demands, the corresponding cryptographic services will not be limited by the performance of network services, thereby improving the efficiency of cryptographic services.

[0172] The above describes multiple implementation schemes provided by the embodiments of the present invention. The various optional methods introduced in the implementation schemes can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible implementation schemes, which can all be considered as implementation schemes disclosed and open in the embodiments of the present invention.

[0173] Although the embodiments of the present invention are disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the scope defined by the claims.

Claims

1. A key configuration method, characterized in that: Applied to a cloud password management center system, the method includes: Acquire identification information, where the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host machine for deploying the target virtual machine; the target host machine runs based on hardware resources of a physical node, where the hardware resources include cryptographic computing resources; determining a target key corresponding to the user; The target key is configured to a physical node corresponding to the identification information; so that the physical node deploys a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

2. The key configuration method according to claim 1, characterized in that: The determining a target key corresponding to the user includes: Allocate a key corresponding to a target virtual machine or a target host machine as a target key for the user; or, Based on the user information, a corresponding target key is generated; the user information is the user's identity information and / or the user-defined information provided by the user.

3. The key configuration method according to claim 1, characterized in that: The configuring the target key to the physical node corresponding to the identification information is specifically: Distribute the target key to the physical node corresponding to the identification information.

4. The key configuration method according to claim 1, characterized in that: Before obtaining the identification information, the method further includes: Obtaining a registration request from a user, the registration request including cryptographic operation registration information, the cryptographic operation registration information being used to indicate that the user has a cryptographic operation requirement; Based on the registration request, identity information is configured for the user, and the identity information is fed back to the cloud resource management platform.

5. The key configuration method according to claim 4, characterized in that: The registration request also includes user-defined information provided by the user for generating a target key. After configuring identity information for the user based on the registration request, the method further includes: The custom information and the identity information are recorded as user information.

6. A key configuration method, characterized in that: Applied to a cloud resource management platform, the method includes: Acquiring resource application information of a user, wherein the resource application information includes application information for cryptographic computing resources; Based on the resource application information, a target virtual machine for deploying the user's business system is allocated; the target virtual machine is deployed in a target host machine, and the target host machine runs based on the hardware resources of the physical node, and the hardware resources include cryptographic computing resources; Send identification information to the cloud password management center system, where the identification information is used to indicate the target virtual machine for deploying the user's business system and / or the target host for deploying the target virtual machine; so that the cloud password management center system determines the target key corresponding to the user, and configures the target key to the physical node corresponding to the identification information; and then enables the physical node to deploy a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

7. The key configuration method according to claim 6, characterized in that: The resource application information also includes the identity information of the user. Before the step of allocating a target virtual machine for deploying the user's business system based on the resource application information, the method further includes: The user's identity information is determined, and when the user is a legitimate user, the step of allocating a target virtual machine for deploying the user's business system based on the resource application information is performed.

8. The key configuration method according to claim 6, characterized in that: Before obtaining the user's resource application information, the method further includes: Get the user's registration request; When it is determined that the registration request includes cryptographic operation registration information, forwarding the registration request to the cloud cryptographic management center system, so that the cloud cryptographic management center system configures identity information for the user based on the registration request, and feeds back the identity information to the cloud resource management platform; wherein the cryptographic operation registration information is used to indicate that the user has a cryptographic operation requirement; The identity information is obtained and recorded.

9. A key configuration method, characterized in that: Applied to a physical node, the physical node corresponds to identification information; the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host machine for deploying the target virtual machine; The target host machine runs based on hardware resources of a physical node, and the hardware resources include cryptographic computing resources; the method includes: Obtaining a target key, where the target key corresponds to a user; A cryptographic operation engine is deployed to call the target key; wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

10. A cryptographic operation method, characterized in that: Applied to the business system layer, the method includes: Obtain the user's cryptographic operation service request; Based on the cryptographic operation service request, scheduling a business system in idle mode so that the business system calls a cryptographic operation engine, executes the cryptographic operation service request, and returns the operation result to the business system layer; the cryptographic operation engine is configured based on the key configuration method according to any one of claims 1 to 9; Obtain the operation result.

11. A key configuration device, characterized in that: Configured in the cloud password management center system, including: A first information acquisition module is used to acquire identification information, where the identification information is used to indicate a target virtual machine for deploying a user's business system and / or a target host machine for deploying the target virtual machine; the target host machine runs based on hardware resources of a physical node, where the hardware resources include cryptographic computing resources; A key determination module, used to determine a target key corresponding to the user; The first key configuration module is used to configure the target key to the physical node corresponding to the identification information; so that the physical node deploys a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

12. A key configuration device, characterized in that: Configured on the cloud resource management platform, including: A second information acquisition module is used to acquire resource application information of the user, wherein the resource application information includes application information for cryptographic computing resources; A resource allocation module, configured to allocate a target virtual machine for deploying a user's business system based on the resource application information; the target virtual machine is deployed in a target host machine, and the target host machine runs based on hardware resources of a physical node, wherein the hardware resources include cryptographic computing resources; An information sending module is used to send identification information to a cloud password management center system, wherein the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host for deploying the target virtual machine; so that the cloud password management center system determines a target key corresponding to the user, and configures the target key to a physical node corresponding to the identification information; and then enables the physical node to deploy a cryptographic operation engine for calling the target key, wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

13. A key configuration device, characterized in that: Configured on a physical node, the physical node corresponds to identification information, the identification information is used to indicate a target virtual machine for deploying a user's business system, and / or a target host machine for deploying the target virtual machine; The target host machine runs based on the hardware resources of the physical node, and the hardware resources include cryptographic computing resources; the key configuration device includes: A key acquisition module, used to acquire a target key, where the target key corresponds to a user; The second key configuration module is used to configure the target key and deploy a cryptographic operation engine for calling the target key; wherein the cryptographic operation engine is used to perform cryptographic operations based on the target key and the cryptographic operation resources.

14. A cryptographic computing device, characterized in that: Configured at the business system layer, including: The third information acquisition module is used to obtain the user's password operation service request; A scheduling module, configured to schedule a business system in idle mode based on the cryptographic operation business request, so that the business system calls a cryptographic operation engine, executes the cryptographic operation business request, and returns the operation result to the business system layer; the cryptographic operation engine is obtained by configuring the key configuration device according to any one of claims 11 to 13; The result acquisition module is used to obtain the operation result.

15. A computer program, characterized in that The method comprises one or more computer executable instructions, wherein when the one or more computer executable instructions are executed, the key configuration method according to any one of claims 1 to 9 is implemented, or the cryptographic operation method according to claim 10 is implemented.

Images