Method for creating virtual password card, cloud equipment, password card and storage medium
By introducing password service management devices and key distribution devices into cloud devices, creating virtual password cards is solved, and the problems of poor security and complex operation of cloud password machines in the cloud computing environment are achieved, and efficient password services with simple operation, high security and no need to rely on cloud password machines are achieved.
Patent Information
- Application Number
- CN202411734991.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-03-25
AI Technical Summary
Existing cloud password machines have poor security, complex operation, dependence on cloud service providers, performance bottlenecks, limited scalability, compliance and standards issues, integration and compatibility issues, data privacy issues, and high costs issues in cloud computing environments.
By introducing a password service management device and a key distribution device in the cloud device, creating a creation instruction and creating a virtual password card on the password card, generating a card key pair, and initializing and encrypting it through the key distribution device, the creation and management of a virtual password card is realized without relying on a cloud password machine.
It realizes simple operation, high security, and no need to rely on cloud password machines. It can provide efficient and secure password services in the cloud computing environment, reduce operation and maintenance costs, and improve the scalability and reliability of the system.
Smart Images
Figure CN119696770A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of cloud computing and cryptographic service, and in particular to a method for creating a virtual cryptographic card, a cloud device, a cryptographic card and a storage medium. Background Art
[0002] With the popularization of cloud computing technology, cloud applications require technical support from underlying hardware devices. Since different users in a cloud environment share the same set of hardware resources, server-side devices must have high performance and virtualization features to support cloud environment applications. As a hardware device, password cards need to support the call of virtualized environments to meet the requirements of the development of the cloud era. Virtualizable hardware password cards are also called logical password cards, which means that based on a single physical password card hardware device, multiple "logical password cards" with the same functions are virtualized for use by multiple virtual machine terminals. Although each terminal shares the same physical password card through a virtual machine, the virtualized "logical password cards" are functionally independent, so they will not affect each other during user use.
[0003] In the related technology, a cloud cryptographic machine with integrated virtualized hardware cryptographic cards is usually deployed in a cloud computer room, and the cloud platform calls the cloud cryptographic machine through the application programming interface (API) to provide cryptographic services for cloud applications. As a solution for providing cryptographic services in a cloud computing environment, the cloud cryptographic machine is elastically scalable and easy to manage, but it is complex to operate and has poor security. Summary of the invention
[0004] The exemplary embodiments of the present application provide a method for creating a virtual password card, a cloud device, a password card, and a storage medium, which do not rely on a cloud cryptographic machine, are simple to operate, and have high security.
[0005] In a first aspect, an embodiment of the present application provides a method for creating a virtual password card, which is applied to a cloud device, and the method includes:
[0006] The cryptographic service management device in the cloud device generates a first creation instruction, and sends the first creation instruction to the cryptographic card, so that the cryptographic card creates a first number of virtual cryptographic cards according to the first creation instruction, generates a card key pair including an identity public key and an identity private key of the cryptographic card, and sends the card key pair to the cryptographic service management device; wherein the cryptographic card is a virtualizable hardware cryptographic card;
[0007] The cryptographic service management device in the cloud device sends an initialization instruction to the key distribution device;
[0008] The key distribution device in the cloud device sends an initialization instruction and an identity public key of the key distribution device to the password card, so that the password card instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device respectively;
[0009] The key distribution device in the cloud device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate a first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card, so that the password card applies the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created; wherein the first virtual key card is any one of the first number of virtual key cards.
[0010] In a second aspect, an embodiment of the present application provides a method for creating a virtual password card, which is applied to a password card. The method includes:
[0011] The password card receives a first creation instruction from the password service management device of the cloud device, creates a first number of virtual password cards according to the first creation instruction, generates a card key pair including an identity public key and an identity private key of the password card, and sends the card key pair to the password service management device; wherein the password card is a virtualizable hardware password card;
[0012] The password card receives an initialization instruction and an identity public key of the key distribution device in the cloud device, and instructs a first number of virtual password cards to send their respective identity public keys to the key distribution device in the cloud device, so that the key distribution device applies a first key encryption key of the first virtual password card, an identity private key of the key distribution device and an identity public key of the password card, generates a first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card; wherein the first virtual key card is any one of the first number of virtual key cards;
[0013] The password card uses the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created.
[0014] In a third aspect, an embodiment of the present application provides a device for creating a virtual password card, which is applied to a cloud device, and the device includes:
[0015] The first processing unit is used to: the cryptographic service management device in the cloud device generates a first creation instruction, and sends the first creation instruction to the cryptographic card, so that the cryptographic card creates a first number of virtual cryptographic cards according to the first creation instruction, and generates a card key pair including an identity public key and an identity private key of the cryptographic card, and sends the card key pair to the cryptographic service management device; wherein the cryptographic card is a virtualizable hardware cryptographic card;
[0016] The first transmission unit is used for: the cryptographic service management device in the cloud device sends an initialization instruction to the key distribution device;
[0017] The first transmission unit is further used for: the key distribution device in the cloud device sends an initialization instruction and an identity public key of the key distribution device to the password card, so that the password card instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device respectively;
[0018] The first processing unit is further used for: the key distribution device in the cloud device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate a first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card, so that the password card applies the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created; wherein the first virtual key card is any one of the first number of virtual key cards.
[0019] In a fourth aspect, an embodiment of the present application provides a device for creating a virtual password card, which is applied to a password card, and the device includes:
[0020] The second processing unit is used for: the password card receives a first creation instruction from the password service management device of the cloud device, creates a first number of virtual password cards according to the first creation instruction, generates a card key pair including an identity public key and an identity private key of the password card, and sends the card key pair to the password service management device; wherein the password card is a virtualizable hardware password card;
[0021] The second transmission unit is used for: the password card receives the initialization instruction and the identity public key of the key distribution device from the cloud device, instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device in the cloud device, so that the key distribution device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate a first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card; wherein the first virtual key card is any one of the first number of virtual key cards;
[0022] The second processing unit is further used for: the password card uses the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created.
[0023] In a fifth aspect, an embodiment of the present application provides a cloud device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the methods of the first aspect when executing the computer program.
[0024] In a sixth aspect, an embodiment of the present application provides a password card, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the methods of the second aspect when executing the computer program.
[0025] In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, which implement the steps of any of the above methods when executed by a processor.
[0026] In the embodiment of the present application, the cloud device includes a password service management function and a password distribution function. Among them, the password service management function is implemented by a password service management software module (referred to as a password service management device), and the password distribution function is implemented by a password distribution software module (referred to as a password distribution device). The password service management device generates a first creation instruction and sends the first creation instruction to the password card; the password card creates a first number of virtual password cards according to the first creation instruction, and generates a card key pair including an identity public key and an identity private key of the password card, and sends the card key pair to the password service management device; the password service management device sends an initialization instruction to the key distribution device; the key distribution device sends an initialization instruction and an identity public key of the key distribution device to the password card; the password card instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device respectively; the key distribution device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate the first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card; the password card applies the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created. This process does not require reliance on a cloud cryptographic machine and is simple to operate with high security. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0028] Figure 1 A flowchart of a method for creating a virtual password card provided by an embodiment of the present application is exemplified;
[0029] Figure 2 A flowchart of a method for processing a password card abnormality provided by an embodiment of the present application is exemplified;
[0030] Figure 3 A schematic diagram exemplarily shows a process of creating a virtual password card provided by an embodiment of the present application;
[0031] Figure 4 The schematic diagram of a password card provided by an embodiment of the present application when abnormal is shown as an example;
[0032] Figure 5 The following is a schematic diagram showing a structure of a device for creating a virtual password card provided in an embodiment of the present application;
[0033] Figure 6 The schematic diagram of the structure of another device for creating a virtual password card provided in an embodiment of the present application is exemplarily shown;
[0034] Figure 7 A schematic diagram of the structure of a cloud device provided in an embodiment of the present application is exemplified. DETAILED DESCRIPTION
[0035] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.
[0036] For ease of understanding, the terms involved in the embodiments of the present application are explained below:
[0037] (1) Cloud device, which can be a cloud host or a cloud server.
[0038] Cloud hosting is a virtualized service that provides computing, storage and network resources. It is based on cloud computing technology and uses a virtualization platform to segment, schedule and allocate physical server resources to provide users with an independent and scalable computing environment. Cloud hosting can be used on demand and charged on a per-use basis, just like using water and electricity, without the need to purchase and maintain physical servers.
[0039] A cloud server is a cluster-based virtualized server that integrates multiple physical server resources through virtualization technology to form a resource pool. Users can customize the configuration and use of these resources, such as computing, storage, and network, according to their needs. Cloud servers are mainly used to provide shared computing, storage, and network resources, supporting a variety of application scenarios.
[0040] (2) A password card is a security device used in the field of information security and located in the hardware encryption layer of the network security platform. It implements the functions of a traditional hardware virtualized hardware password card in software through virtualization technology. Users can flexibly select cryptographic algorithms as needed to provide cryptographic computing services for upper-layer application systems. Password cards include virtualized hardware password cards with virtual functions and non-virtualized hardware password cards. The password card in the embodiment of the present application refers to a virtualized hardware password card.
[0041] (3) A virtualized computing host refers to a server that can be divided into multiple virtual machines using virtualization technology. This technology allows multiple operating systems and applications to run independently on the same physical hardware. Each virtual machine has its own operating system and application, but shares the underlying hardware resources.
[0042] In the related technology, a cloud cryptographic machine with integrated virtualized hardware cryptographic cards is usually deployed in the cloud computer room, and the cloud platform calls the cloud cryptographic machine through an API interface to provide cryptographic services for cloud applications. As a solution for providing cryptographic services in a cloud computing environment, the cloud cryptographic machine is elastically scalable and easy to manage, but it also has the following problems:
[0043] ① Security issues: Cloud cryptographic machines need to process sensitive keys and cryptographic operations. If security measures are not in place, there may be a risk of key leakage.
[0044] ② Dependence on cloud service providers: The operation of cloud cryptographic machines depends on the infrastructure and network of cloud service providers. If the cloud service provider fails or a security incident occurs, the normal operation of the cloud cryptographic machine may be affected.
[0045] ③Performance bottleneck: As the number of cloud service users increases, cloud cryptographic machines may face performance bottlenecks, especially in high-concurrency scenarios, and may not be able to meet the needs of all users.
[0046] ④ Scalability limitations: Although cloud services generally have good scalability, the expansion of cloud cryptographic machines may be limited by physical hardware resources. Especially in the practice of cryptographic devices that support virtualization, scalability may be limited by the resources of the physical cryptographic machines themselves.
[0047] ⑤ Compliance and standards issues: With the development and application of cryptographic technology, relevant standards and specifications are also constantly updated. Cloud cryptographic machines need to constantly adapt to these changes to meet compliance requirements.
[0048] ⑥ Integration and compatibility issues: Cloud cryptographic machines need to be integrated with existing systems and applications, and may encounter compatibility issues, especially in different cloud platforms and environments.
[0049] ⑦Data privacy issues: In some scenarios, users may have concerns about outsourcing sensitive data encryption tasks to cloud service providers, worrying about data privacy and confidentiality.
[0050] ⑧Cost issue: Although cloud services can generally help enterprises reduce costs, the deployment and operation of cloud cryptographic machines may also incur additional costs, especially when advanced security features and customized services are required.
[0051] ⑨Technology dependence: Enterprises may over-rely on the technology of cloud cryptographic machines. Once there is a problem with the technology of the cloud service provider, it may affect the operation of the enterprise.
[0052] ⑩Isolation issues in multi-tenant environments: In a multi-tenant cloud environment, ensuring the isolation of keys and data between different users is a challenge, which requires advanced security isolation technology to ensure.
[0053] To this end, an embodiment of the present application provides a method for creating a virtual password card, in which the cloud device includes a password service management function and a password distribution function. The password service management function is implemented by a password service management software module (referred to as a password service management device), and the password distribution function is implemented by a password distribution software module (referred to as a password distribution device). The password service management device generates a creation instruction, and the password card creates a certain number of virtual password cards. Then, the password service management device and the key distribution device cooperate to implement the initialization process of each virtual password card, and then the password card verifies it. When the verification is successful, it is determined that the virtual password card has been successfully created. In this process, there is no need to rely on a cloud cryptographic machine, the operation is simple, and the security is strong.
[0054] The method in the embodiment of this application can be applied to promote the application of domestic commercial encryption, build a password protection system in a cloud computing environment, and other scenarios, and is suitable for the construction and operation of password resource pools on private clouds, hybrid clouds, and public clouds. It can also be applied to the transformation of domestic encryption for key information infrastructure in the communications industry, and complete the security assessment of commercial encryption applications.
[0055] The method in the embodiments of the present application can also comprehensively promote the deep integration of cryptographic technology in various fields, ensure network and information security, and promote the high-quality development of the digital economy; promote the innovative application of cryptographic technology in cloud-native environments, and effectively improve the network information security protection capabilities in cloud environments; provide safe and efficient cryptographic solutions and operating methods to assist in the digital transformation of cloud government systems; improve technical advantages in the construction of government cloud cryptography, and promote the core role in the construction of government cloud cryptography; build a unified standard system, reach industry consensus, promote industrial collaboration, and ensure the standardized application and innovative development of cryptographic technology; reduce the cost of using cryptographic resources and increase the scale of cryptographic service operating revenue.
[0056] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided in the embodiment of the present application.
[0057] Reference below Figure 1 A flowchart of a method for creating a virtual password card is shown to illustrate the technical solution provided by an embodiment of the present application.
[0058] S101: The cryptographic service management apparatus in the cloud device generates a first creation instruction.
[0059] S102: The cryptographic service management device in the cloud device sends a first creation instruction to the cryptographic card.
[0060] S103: The password card creates a first number of virtual password cards according to the first creation instruction, and generates a card key pair including an identity public key and an identity private key of the password card.
[0061] S104: The cryptographic card sends a card key pair to the cryptographic service management device.
[0062] S105: The cryptographic service management device in the cloud device sends an initialization instruction to the key distribution device;
[0063] S106: The key distribution device in the cloud device sends an initialization instruction and the identity public key of the key distribution device to the password card.
[0064] S107: The password card instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device.
[0065] S108: The key distribution device in the cloud device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate a first target ciphertext of the first virtual password card.
[0066] S109: The key distribution device in the cloud device sends the first target ciphertext to the password card.
[0067] S110: The password card uses the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created.
[0068] In the embodiment of the present application, the cloud device includes a password service management function and a password distribution function. Among them, the password service management function is implemented by a password service management software module (referred to as a password service management device), and the password distribution function is implemented by a password distribution software module (referred to as a password distribution device). The password service management device generates a first creation instruction and sends the first creation instruction to the password card; the password card creates a first number of virtual password cards according to the first creation instruction, and generates a card key pair including an identity public key and an identity private key of the password card, and sends the card key pair to the password service management device; the password service management device sends an initialization instruction to the key distribution device; the key distribution device sends an initialization instruction and an identity public key of the key distribution device to the password card; the password card instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device respectively; the key distribution device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate the first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card; the password card applies the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created. This process does not require reliance on a cloud cryptographic machine and is simple to operate with high security.
[0069] In S101 and S102, the password service management device initiates a first creation process, and then generates a first creation instruction, which is used for the password card to create a virtual password card. Optionally, the first creation instruction can carry information such as the number of virtual password cards to be created and the storage space occupied by each virtual password card in the password card. The password service management device sends the first creation instruction to the password card.
[0070] In S103 and S104, after receiving the first creation instruction, the password card creates a first number of virtual password cards according to the carried information. In a specific example, the first number may be 5, and the created virtual password cards are respectively called virtual password card 1, virtual password card 2, virtual password card 3, virtual password card 4, and virtual password card 5.
[0071] The password card generates a card key pair, which includes the public key and private key of the password card. In addition, the password card sends the card key pair and the message of successful creation to the password service management device, and can also send the IP address, identity information and other specified information of the password card.
[0072] In S105, the cryptographic service management device initiates an initialization process of the cryptographic card to the key distribution device, that is, sends an initialization instruction to the key distribution device.
[0073] In S106, the key distribution device sends an initialization instruction and the identity public key of the key distribution device, that is, the key management service (KMS) public key, to the password card.
[0074] In S107, after receiving the initialization instruction and the KMS public key, the password card instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device. Exemplarily, the key distribution device receives 5 identity public keys corresponding to 5 virtual password cards.
[0075] Involving S108 and S109, one of the virtual password cards (the first virtual password card) is used as an example for explanation. The key distribution device uses the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate a first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card.
[0076] Optionally, the process of the key distribution device generating the first target ciphertext of the first password card can refer to the following steps:
[0077] A1: Based on the set encryption algorithm, generate a first key encryption key of the first virtual password card.
[0078] The set encryption algorithm may be an encryption algorithm in the related art, which is not limited here. In the embodiment of the present application, the key distribution device generates a first key encryption key (KeyEncryption Key, KEK) of the first virtual password card based on the set encryption algorithm.
[0079] A2: Use the identity private key of the key distribution device to sign the first key encryption key to obtain a first ciphertext.
[0080] Among them, the key distribution device uses the KMS identity private key to sign the first key encryption key KEK to implement integrity protection and obtain the first ciphertext.
[0081] A3: Use the public key of the password card to encrypt the first ciphertext to obtain the first target ciphertext.
[0082] The key distribution device uses the identity public key of the password card to encrypt the first ciphertext to achieve confidentiality protection and obtain the first target ciphertext.
[0083] A4: Send the first target ciphertext to the password card
[0084] Among them, the key distribution device sends the first target ciphertext to the password card.
[0085] The above embodiment is a process of generating target ciphertext of a virtual password card. The process of generating target ciphertext of other virtual password cards can refer to steps A1-A4, which will not be described in detail here.
[0086] In S110, the password card uses the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created.
[0087] Optionally, the successful creation of the first virtual password card can be determined in the following manner: the password card uses the identity private key of the password card to decrypt the first target ciphertext to obtain the first encrypted ciphertext, and uses the identity public key of the key distribution device to perform signature verification on the first encrypted ciphertext. If the verification is successful, it is determined that the initialization process is completed, that is, it is determined that the first virtual password card is successfully created.
[0088] Optionally, whether the verification is successful can be determined in the following manner: if the key encryption key obtained after applying the identity public key of the key distribution device to sign and verify the first encrypted ciphertext is the same as the first key encryption key, then the verification is determined to be successful.
[0089] It should be noted that the verification process for other virtual password cards is the same as the verification process for the first virtual password card, and will not be described in detail here.
[0090] The embodiment of the present application, by constructing a mode of stacking password resource pools instead of current password hardware devices with password software, is simple to operate and highly secure. It is in line with the development direction of the cloud computing industry, realizes the rapid registration and launch of virtualized hardware password cards, reduces the difficulty of cloud operators to connect to cloud password machines, creates a new mode of cloud password construction and operation, provides safe and efficient password solutions and operation methods, and helps the digital transformation of cloud government systems. With the increase in the number of cloud service users, cloud password machines may face performance bottlenecks, especially in high-concurrency scenarios, and may not be able to meet the needs of all users. After applying the method in the embodiment of the present application, when the performance is insufficient, it is only necessary to insert multiple virtualized hardware password cards and horizontally expand the password computing power through the password service management device to break through the performance bottleneck. Because the cost of password cards is much lower than that of cloud password machines, cost reduction and efficiency improvement can be achieved in the process of cloud environment password construction.
[0091] In the above embodiment, after the first number of virtual password cards are successfully created, each virtual password card can be called by a corresponding application in the cloud host to implement different functions. The password service management device can monitor the operation status of the password card in real time, and when it is detected that the password card is operating abnormally, the drift process of the password card can be started.
[0092] Specifically, the cloud device can detect which virtual password card is abnormal, and then create another virtual password card to replace the abnormal virtual password card, so that it can be called by the application of the abnormal virtual password card to realize the function of the abnormal virtual password card. Figure 2 A flowchart of a method for processing a password card abnormality provided in an embodiment of the present application, Figure 2 At least the following steps are included:
[0093] S201: The cryptographic service management device detects an abnormal virtual cryptographic card and generates a second creation instruction.
[0094] The abnormal virtual password may be one or more. If there are more than one abnormal virtual password cards, the generated second creation instruction indicates to generate new virtual password cards that are the same as the number of abnormal virtual password cards; if there is only one abnormal virtual password card, the generated second creation instruction indicates to generate a new virtual password card.
[0095] In the embodiment of the present application, an abnormal virtual password card is taken as an example, for example, the abnormal virtual password card is virtual password card 1.
[0096] S202: The password service management device sends a second creation instruction to the password card.
[0097] S203: The password card creates a second virtual password card according to the second creation instruction.
[0098] Optionally, the password card creates a second virtual password card according to the second creation instruction. For example, the second virtual password card is virtual password card 6. That is, the function of virtual password card 1 is realized by virtual password card 6. In addition, the password card sends a message of successful creation to the cloud device.
[0099] S204: The password card sends a message of successful creation to the password service management device.
[0100] S205: The cryptographic service management device sends a key recovery instruction to the key distribution device.
[0101] The key recovery instruction may carry the identifier of the abnormal virtual password card and the identifier of the second virtual password card, and the password service management device sends the key recovery instruction to the key distribution device.
[0102] S206: The key distribution device sends a key recovery instruction and the identity public key of the key distribution device to the password card.
[0103] S207: The password card instructs the second virtual password card to send its own identity public key to the key distribution device.
[0104] S208: The key distribution device searches for the target ciphertext of the corresponding abnormal virtual password card according to the identifier of the second virtual password card, and decrypts the target ciphertext to obtain the target key encryption key of the abnormal virtual password card.
[0105] S209: The key distribution device sends the target key encryption key to the password card.
[0106] Among them, the key distribution device can find the target ciphertext of the abnormal virtual password card according to the identifier of the second virtual password card, and apply the method of the above embodiment to decrypt it to obtain the target key encryption key of the abnormal virtual password card. The target key encryption key is the key encryption key of virtual password card 1. Since virtual password card 1 is abnormal, the target encryption key of virtual password card 1 can be obtained in this way. The key distribution device sends the target encryption key to the password card.
[0107] S210: The password card uses the target key encryption key as the key encryption key of the second virtual password card.
[0108] Optionally, the password card uses the target key encryption key as the key encryption key of the second virtual password card, so that the second virtual password card can be called by the application of the virtual password card 1 in the cloud device to implement the corresponding functions of the virtual password card 1.
[0109] In the embodiment of the present application, the cryptographic service management device can monitor the operating status of the cryptographic card in real time. When it is detected that a cryptographic card is operating abnormally, the cryptographic card drift service is started. After the cryptographic card drift is completed, the way in which the cryptographic service calls the cryptographic card remains unchanged, which is transparent to the cryptographic service. Therefore, the cryptographic service can be provided sustainably in the cloud computing environment, which solves the mutual dependence between cryptographic equipment vendors and cloud service providers, prevents the cloud service provider from having failures or security incidents that may affect the normal operation of the cloud cryptographic machine, and prevents the cloud service provider from being unable to use the cryptographic service normally after the cloud cryptographic machine fails. The present invention only needs to schedule and manage the cryptographic card through the cloud native service management platform, which reduces the fault nodes and operation difficulty, and effectively improves the efficiency of the cryptographic service. The key synchronization problem stored in the cryptographic hardware during fault drift in the virtual security mode is solved.
[0110] Figure 3 A schematic diagram of a process of creating a virtual password card provided in an embodiment of the present application, Figure 4 A schematic diagram of a password card abnormality provided in an embodiment of the present application, through Figure 3 and Figure 4 It can be seen that the cryptographic service management device, the key distribution device and the cryptographic card cooperate to realize the cryptographic cloud native service scheduling based on the key distribution mechanism.
[0111] In the embodiment of the present application, only the relevant virtualization-supporting password card needs to be inserted into the cloud host to provide services such as initialization registration service, password service activation, and password card drift of the virtualized password card, thereby eliminating the cloud service provider's dependence on the cloud cryptographic machine manufacturer. Through early adaptation, the adaptation work of multiple virtualization-supporting password cards is completed, reducing the cloud service provider's multiple adaptation work on the cloud cryptographic machine after the service goes online, and the operation is simple.
[0112] In addition, the current cryptographic resource pool construction still uses the cryptographic hardware device stacking method, which is contrary to the cloud computing network technology architecture. Although there are studies based on computer chips to provide cryptographic computing power, the key synchronization problem after a host failure is still a research difficulty. In the embodiment of the present application, based on an external key distribution device, the device master key is distributed to the cryptographic card when the cryptographic card is initialized and the host fails. During key distribution, the public key infrastructure (PKI) technology is used to realize the encrypted transmission of the key. In order to adapt to the cloud computing network technology architecture, cloud-based cryptographic services are provided through on-demand automatic orchestration of cryptographic software image files based on cloud computing Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) models.
[0113] Therefore, at present, the form of domestic cryptographic products is mainly hardware. When the performance improvement of cryptographic products is approaching the limit, this invention promotes the development of domestic cryptographic products from hardware to "combination of hardware and software, with software as the main focus", providing cryptographic services in the form of software, providing a horizontal extension of distributed computing power for cryptographic operations, and reducing the dependence of cloud environment cryptographic service business scenarios on cryptographic hardware devices; realizing the mechanism of automatic activation of cryptographic services, reducing the operation and maintenance of cloud environment cryptographic resources, and reducing the difficulty of service activation; realizing the automatic drift of cryptographic services as faults drift in the virtual security mode, improving the reliability of cryptographic service operation; realizing the simultaneous acceptance of cryptographic services and businesses in the virtual security mode on the same platform and management interface, ensuring the consistency of business acceptance data, and reducing the difficulty of business acceptance; adding cryptographic services on the cloud does not affect the existing cloud computing environment network structure; solving the problems of imbalance in the supply structure of the cryptographic industry and weak product versatility, which is conducive to enriching the form of cryptographic products and opening up new ideas for cryptographic technology innovation.
[0114] like Figure 5 As shown, based on the same inventive concept, an embodiment of the present application provides a device for creating a virtual password card, which is applied to a cloud device, and the device includes:
[0115] The first processing unit 51 is used for: the cryptographic service management device in the cloud device generates a first creation instruction, and sends the first creation instruction to the cryptographic card, so that the cryptographic card creates a first number of virtual cryptographic cards according to the first creation instruction, and generates a card key pair including an identity public key and an identity private key of the cryptographic card, and sends the card key pair to the cryptographic service management device; wherein the cryptographic card is a virtualizable hardware cryptographic card;
[0116] The first transmission unit 52 is used for: the cryptographic service management device in the cloud device sends an initialization instruction to the key distribution device;
[0117] The first transmission unit 52 is further used for: the key distribution device in the cloud device sends an initialization instruction and an identity public key of the key distribution device to the password card, so that the password card instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device;
[0118] The first processing unit 51 is further configured to: the key distribution device in the cloud device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate a first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card, so that the password card applies the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created; wherein the first virtual key card is any one of the first number of virtual key cards.
[0119] In an optional implementation manner, the first processing unit 51 is specifically configured to:
[0120] The key distribution device in the cloud device generates a first key encryption key for the first virtual password card based on a set encryption algorithm;
[0121] The key distribution device in the cloud device uses the identity private key of the key distribution device to sign the first key encryption key to obtain a first ciphertext;
[0122] The key distribution device in the cloud device uses the identity public key of the password card to encrypt the first ciphertext to obtain a first target ciphertext;
[0123] The key distribution device in the cloud device sends the first target ciphertext to the password card.
[0124] In an optional implementation, the first processing unit 51 is further configured to:
[0125] If the password service management device in the cloud device detects an abnormal virtual password card, it instructs the password card to create a second virtual password card; wherein the abnormal virtual password card is any one of the first number of virtual password cards;
[0126] The cloud device receives a message from the password card indicating successful creation;
[0127] The cryptographic service management device in the cloud device sends a key recovery instruction to the key distribution device;
[0128] The key distribution device in the cloud device sends a key recovery instruction and the identity public key of the key distribution device to the password card, so that the password card instructs the second virtual password card to send its own identity public key to the key distribution device;
[0129] The key distribution device in the cloud device searches for the target ciphertext of the corresponding abnormal virtual password card according to the identifier of the second virtual password card, decrypts the target ciphertext, obtains the target key encryption key of the abnormal virtual password card, and sends the target key encryption key to the password card, so that the password card uses the target key encryption key as the key encryption key of the second virtual password card.
[0130] In an optional implementation manner, the first processing unit 51 is specifically configured to:
[0131] If the password service management device in the cloud device detects an abnormal virtual password card, a second creation instruction is generated and sent to the password card, so that the password card creates a second virtual password card according to the second creation instruction.
[0132] like Figure 6 As shown, based on the same inventive concept, an embodiment of the present application provides a device for creating a virtual password card, which is applied to a password card, and the device includes:
[0133] The second processing unit 61 is used for: the password card receives a first creation instruction from the password service management device of the cloud device, creates a first number of virtual password cards according to the first creation instruction, generates a card key pair including an identity public key and an identity private key of the password card, and sends the card key pair to the password service management device; wherein the password card is a virtualizable hardware password card;
[0134] The second transmission unit 62 is used for: the password card receives the initialization instruction and the identity public key of the key distribution device in the cloud device, instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device in the cloud device, so that the key distribution device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate the first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card; wherein the first virtual key card is any one of the first number of virtual key cards;
[0135] The second processing unit 61 is further configured to: the password card uses the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, determine that the first virtual password card is successfully created.
[0136] In an optional implementation manner, the second processing unit 61 is specifically configured to:
[0137] The password card uses the password card's identity private key to decrypt the first target ciphertext to obtain the first encrypted ciphertext, and uses the key distribution device's identity public key to perform signature verification on the first encrypted ciphertext. If the verification passes, it is determined that the first virtual password card is successfully created.
[0138] In an optional implementation, the second processing unit 61 is further configured to:
[0139] If the key encryption key obtained after applying the identity public key of the key distribution device to perform signature verification on the first encrypted ciphertext is the same as the first key encryption key, it is determined that the verification is successful.
[0140] The device for creating a virtual password card provided in the embodiment of the present application adopts the same inventive concept as the method for creating a virtual password card described above, and can achieve the same beneficial effects, which will not be described in detail herein.
[0141] Based on the same inventive concept as the above-mentioned method for creating a virtual password card, the embodiment of the present application also provides an electronic device, which can be a cloud device or a password card. Figure 7 As shown, the electronic device may include a processor 71 and a memory 72 .
[0142] The processor 71 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and may implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.
[0143] The memory 72 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, disk, optical disk, etc. The memory is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 72 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.
[0144] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; the above computer storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to: mobile storage devices, random access memory (RAM, Random Access Memory), magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO)), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)) and other media that can store program codes.
[0145] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: a mobile storage device, a random access memory (RAM, Random Access Memory), a magnetic storage device (such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc.), an optical storage device (such as CD, DVD, BD, HVD, etc.), and a semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), a solid-state drive (SSD)) and other various media that can store program codes.
[0146] The above embodiments are only used to introduce the technical solutions of the present application in detail, but the description of the above embodiments is only used to help understand the methods of the embodiments of the present application and should not be understood as limiting the embodiments of the present application. Any changes or substitutions that can be easily thought of by technicians in this technical field should be included in the protection scope of the embodiments of the present application.
Claims
1. A method for creating a virtual password card, characterized in that: Applied to a cloud device, the method comprises: The cryptographic service management device in the cloud device generates a first creation instruction, and sends the first creation instruction to the cryptographic card, so that the cryptographic card creates a first number of virtual cryptographic cards according to the first creation instruction, generates a card key pair including an identity public key and an identity private key of the cryptographic card, and sends the card key pair to the cryptographic service management device; wherein the cryptographic card is a virtualizable hardware cryptographic card; The cryptographic service management device in the cloud device sends an initialization instruction to the key distribution device; The key distribution device in the cloud device sends the initialization instruction and the identity public key of the key distribution device to the password card, so that the password card instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device respectively; The key distribution device in the cloud device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate a first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card, so that the password card applies the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created; wherein, the first virtual key card is any one of the first number of virtual key cards.
2. The method according to claim 1, characterized in that The key distribution device in the cloud device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate a first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card, including: The key distribution device in the cloud device generates a first key encryption key for the first virtual password card based on a set encryption algorithm; The key distribution device in the cloud device uses the identity private key of the key distribution device to sign the first key encryption key to obtain a first ciphertext; The key distribution device in the cloud device uses the identity public key of the password card to encrypt the first ciphertext to obtain a first target ciphertext; The key distribution device in the cloud device sends the first target ciphertext to the password card.
3. The method according to claim 1 or 2, characterized in that: The method further comprises: If the password service management device in the cloud device detects an abnormal virtual password card, it instructs the password card to create a second virtual password card; wherein the abnormal virtual password card is any one of the first number of virtual password cards; The cloud device receives the creation success message from the password card; The cryptographic service management device in the cloud device sends a key recovery instruction to the key distribution device; The key distribution device in the cloud device sends the key recovery instruction and the identity public key of the key distribution device to the password card, so that the password card instructs the second virtual password card to send its own identity public key to the key distribution device; The key distribution device in the cloud device searches for the target ciphertext of the corresponding abnormal virtual password card according to the identifier of the second virtual password card, decrypts the target ciphertext, obtains the target key encryption key of the abnormal virtual password card, and sends the target key encryption key to the password card, so that the password card uses the target key encryption key as the key encryption key of the second virtual password card.
4. The method according to claim 3, characterized in that If the password service management device in the cloud device detects an abnormal virtual password card, instructing the password card to create a second virtual password card includes: If the password service management device in the cloud device detects an abnormal virtual password card, a second creation instruction is generated, and the second creation instruction is sent to the password card, so that the password card creates the second virtual password card according to the second creation instruction.
5. A method for creating a virtual password card, characterized in that: Applied to a password card, the method comprises: The password card receives a first creation instruction from a password service management device of a cloud device, creates a first number of virtual password cards according to the first creation instruction, generates a card key pair including an identity public key and an identity private key of the password card, and sends the card key pair to the password service management device; wherein the password card is a virtualizable hardware password card; The password card receives an initialization instruction and an identity public key of the key distribution device in the cloud device, and instructs the first number of virtual password cards to send their respective identity public keys to the key distribution device in the cloud device, so that the key distribution device applies the first key encryption key of the first virtual password card, the identity private key of the key distribution device and the identity public key of the password card to generate a first target ciphertext of the first virtual password card, and sends the first target ciphertext to the password card; wherein the first virtual key card is any one of the first number of virtual key cards; The password card uses the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created.
6. The method according to claim 5, characterized in that The password card uses the identity private key of the password card and the identity public key of the password distribution device to decrypt the first target ciphertext, and when the decryption is successful, it is determined that the first virtual password card is successfully created, including: The password card uses the identity private key of the password card to decrypt the first target ciphertext to obtain the first encrypted ciphertext, and uses the identity public key of the key distribution device to perform signature verification on the first encrypted ciphertext. If the verification passes, it is determined that the first virtual password card is successfully created.
7. The method according to claim 6, characterized in that The method further comprises: If the key encryption key obtained after applying the identity public key of the key distribution device to perform signature verification on the first encrypted ciphertext is the same as the first key encryption key, it is determined that the verification is successful.
8. A cloud device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.
9. A password card, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 5 to 7 are implemented.
10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.