A password resource scheduling method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a cryptographic resource scheduling method and device, electronic equipment and storage medium, which determine a target cryptographic machine, and obtain device information of the target cryptographic machine; based on the device information, the target cryptographic machine is connected to the proxy service; a secure channel between the proxy service is constructed, and a cryptographic resource management instruction is determined; based on the cryptographic resource management instruction, the cryptographic resource is scheduled through the secure channel. The upper cryptographic capability and the lower cryptographic resource are isolated, and the cryptographic resources of multiple manufacturers and multiple models can be applied simultaneously, thereby improving the cryptographic resource scheduling efficiency.

Description

Technical Field

[0001] This invention relates to the field of cryptographic resource scheduling technology, and in particular to a cryptographic resource scheduling method, a cryptographic resource scheduling device, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Key security is crucial for ensuring communication and data security. Currently, the application of keys and the encryption / decryption operations involved in data transmission and storage all rely on the access of cryptographic resources. Especially in cloud computing scenarios, whether public or hybrid, there are diverse needs for cryptographic machines, requiring compliance with security requirements including system data confidentiality, data integrity, and communication security. These requirements can be met through various encryption algorithms, signature algorithms, hash algorithms, and random number generation functions within cryptographic machines. However, current cloud platform use of cryptographic machines suffers from drawbacks such as diverse application integration requirements, high integration costs, the inability to fix cryptographic machine models, and vendor incompatibility issues in the dynamic expansion of cryptographic machine resource pools. Summary of the Invention

[0003] The present invention provides a cryptographic resource scheduling method, apparatus, electronic device, and computer-readable storage medium to overcome or at least partially solve the above-mentioned problems.

[0004] This invention discloses a cryptographic resource scheduling method, characterized in that the method is applied to a cryptographic resource management system, the cryptographic resource management system being configured with a proxy service for cryptographic machines, including:

[0005] Identify the target cryptographic machine and obtain its device information;

[0006] Based on the device information, the target cryptographic machine is connected to the proxy service;

[0007] Establish a secure channel with the proxy service and determine the password resource management instructions;

[0008] The cryptographic resources are scheduled through the secure channel based on the cryptographic resource management instructions.

[0009] Optionally, it also includes:

[0010] An IP polling operation is performed, and when the IP of the cryptographic machine is obtained, the cryptographic machine IP is sent to the target cryptographic machine through the secure channel; the target cryptographic machine is configured to register with the cryptographic resource management system through the cryptographic machine IP.

[0011] Optionally, the step of connecting the target cryptographic machine to the proxy service based on the device information includes:

[0012] The cryptographic machine management interface of the target cryptographic machine is determined based on the device information;

[0013] Call the cryptographic machine management interface to obtain the current status information and specific machine parameters of the target cryptographic machine;

[0014] Based on the current status information and the specific machine parameters, a registration instruction is generated for the target cryptographic machine;

[0015] The target cryptographic machine is connected to the proxy service based on the registration instruction.

[0016] Optionally, the cryptographic resource management system is configured with a registration interface and further includes:

[0017] Receive the agent registration instruction sent by the agent service;

[0018] The agent registration command is used to call the registration interface to obtain the agent resources reported by the agent service; the agent resources include agent IP information, port information and agent certificate public key information.

[0019] Optionally, the step of establishing a secure channel with the proxy service includes:

[0020] A certificate public key is generated based on the proxy IP information, the port information, and the proxy certificate public key information, and a random number is generated;

[0021] The certificate public key is encrypted based on the random number to generate an encrypted certificate public key;

[0022] The public key of the encryption certificate is sent to the proxy service; the proxy service decrypts the public key of the encryption certificate to generate an encryption channel key.

[0023] A secure channel is constructed between the encrypted channel key and the proxy service.

[0024] Optionally, the step of performing the IP polling operation includes:

[0025] Determine the IP address range and set up a polling queue for the IP address range;

[0026] Perform reachability tests on the IP addresses in the polling queue;

[0027] When the IP address passes the reachability test, the IP address is marked as a usable IP address and stored in the cryptographic machine device pool; the cryptographic machine device pool is used to obtain cryptographic machine IPs.

[0028] Optionally, after the step of sending the cryptographic machine IP to the target cryptographic machine through the secure channel, the method further includes:

[0029] The cipher machine IP address is marked as a used IP address, and the cipher machine IP address is removed from the polling queue;

[0030] Determine the number of IPs and the polling period in the polling queue, and adjust the length of the polling queue based on the number of IPs and the polling period.

[0031] This invention also discloses a cryptographic resource scheduling device, which is applied to a cryptographic resource management system. The cryptographic resource management system is configured with a proxy service for cryptographic machines, including:

[0032] The target cipher machine determination module is used to determine the target cipher machine and obtain the device information of the target cipher machine;

[0033] A proxy service access module is used to connect the target cryptographic machine to the proxy service based on the device information.

[0034] A secure channel construction module is used to construct a secure channel with the proxy service and determine password resource management instructions;

[0035] The scheduling module is used to schedule the cryptographic resources through the secure channel based on the cryptographic resource management instructions.

[0036] This invention also discloses an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0037] The memory is used to store computer programs;

[0038] When the processor executes a program stored in the memory, it implements the method described in the embodiments of the present invention.

[0039] This invention also discloses a computer-readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform the methods described in this invention.

[0040] The embodiments of the present invention have the following advantages:

[0041] This invention involves identifying a target cryptographic machine and obtaining its device information; connecting the target cryptographic machine to a proxy service based on the device information; constructing a secure channel with the proxy service and determining cryptographic resource management instructions; and scheduling cryptographic resources through the secure channel based on the cryptographic resource management instructions. This achieves isolation between upper-layer cryptographic capabilities and lower-layer cryptographic resources, enabling the simultaneous application of cryptographic resources from multiple vendors and models. This improves the utilization rate of cryptographic resources and prevents vendor lock-in due to a single vendor. Attached Figure Description

[0042] Figure 1 This is a flowchart of the steps of a cryptographic resource scheduling method provided in an embodiment of the present invention;

[0043] Figure 2 This is a schematic diagram of the instruction structure between the cryptographic resource management system and the proxy service provided in this embodiment of the invention;

[0044] Figure 3 This is a system architecture diagram of the cryptographic resource management system and the agent provided in this embodiment of the invention;

[0045] Figure 4 This is a functional module relationship diagram between the code resource management system and the agent provided in this embodiment of the invention;

[0046] Figure 5 This is the main flowchart of the cryptographic resource expansion provided in this embodiment of the invention;

[0047] Figure 6 This is a structural block diagram of a cryptographic resource scheduling device provided in an embodiment of the present invention;

[0048] Figure 7 This is a hardware structure block diagram of an electronic device provided in an embodiment of the present invention;

[0049] Figure 8 This is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. Detailed Implementation

[0050] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0051] Key security is crucial for ensuring communication and data security. Currently, the application of keys and the encryption / decryption operations involved in data transmission and storage all rely on the access of cryptographic resources. Especially in cloud computing scenarios, whether public or hybrid, there are diverse needs for cryptographic machines, requiring compliance with security requirements including system data confidentiality, data integrity, and communication security. These requirements can be met through various encryption algorithms, signature algorithms, hash algorithms, random number generation functions, and other features within cryptographic machines.

[0052] However, the use of cipher machines on cloud platforms currently faces the following main problems:

[0053] 1) Application integration requirements are diverse.

[0054] Applications on cloud platforms have diverse requirements for confidentiality and integrity, and their key application needs also vary. For example, some projects require customized requirements such as batch encryption / decryption, envelope encryption, and certificate verification. If the product directly interfaces with cryptographic machines or other cryptographic devices, significant manpower and resources are needed for interface matching. Furthermore, in public cloud and hybrid cloud scenarios, due to bidding processes and various business requirements, it is difficult to secure services from a single vendor. The interface solutions and formats of different vendors also vary, leading to a large amount of repetitive work during the integration process.

[0055] 2) High integration costs

[0056] Current commercial cryptographic upgrades for cloud platforms involve complex scenarios, and cryptographic vendors employ diverse integration methods. This is particularly true for cryptographic machine integration, where the requirements for business function modifications are complex, and there is currently no unified integration solution among vendors. Furthermore, the programming languages ​​and system architectures used by different systems vary. Implementing commercial cryptographic upgrades by integrating different vendors' cryptographic machines for each system would incur significant manpower and time costs, making it impossible to develop a unified and universal integration solution. This would severely impact project delivery and progress.

[0057] 3) The model of the cipher machine cannot be fixed.

[0058] Whether in a public cloud or hybrid cloud environment, projects will involve private deployment and customized functionality. Depending on the specific project requirements, the cryptographic machine may be a financial cryptographic machine, a cloud cryptographic machine, or a server cryptographic machine. For the existing types and models of cryptographic machines on the market, each has different interface and usage methods, requiring customized functional integration, leading to increasingly complex and difficult-to-manage functionalities.

[0059] 4) Dynamic expansion of the cipher machine resource pool is incompatible with vendors.

[0060] Because vendors use different integration solutions and usage methods, it's impossible to achieve a universal expansion method for cryptographic machines from multiple vendors when expanding the cryptographic resource pool. However, in practical applications, to prevent being tied to a single vendor, it's usually necessary to expand the resource pool with machines from different vendors to achieve coexistence of cryptographic resources. Currently, the common approach is to deploy the corresponding cryptographic machine vendor's management system to achieve unified management and resource allocation for a single model of cryptographic machine. However, this leads to a complex system mix, making unified management difficult and increasing the complexity of unified operation and maintenance of cryptographic machine resources.

[0061] Reference Figure 1 The diagram illustrates a flowchart of a cryptographic resource scheduling method provided in an embodiment of the present invention, which may specifically include the following steps:

[0062] Step 101: Identify the target cryptographic machine and obtain the device information of the target cryptographic machine;

[0063] Step 102: Connect the target cryptographic machine to the proxy service based on the device information;

[0064] Step 103: Establish a secure channel with the proxy service and determine the password resource management instructions;

[0065] Step 104: Schedule the cryptographic resources through the secure channel based on the cryptographic resource management instructions.

[0066] In a specific implementation, the embodiments of the present invention can be applied to a cryptographic resource management system, which is configured with a proxy service for cryptographic machines. The cryptographic resource management system can be deployed in a network specifically used for scheduling cryptographic resources. In the embodiments of the present invention, cryptographic machines accessing the network can be identified as target cryptographic machines, thereby determining the specific cryptographic machines that need to be managed and scheduled.

[0067] In a specific implementation, the device information of the target cryptographic machine is obtained; for example, the device information may include, but is not limited to, manufacturer information and device model, to provide a basis for subsequent access and configuration, thereby enabling targeted management of the target cryptographic machine, avoiding misoperation, and providing necessary parameter information for subsequent configuration work.

[0068] In this embodiment of the invention, the target cryptographic machine can also be connected to the proxy service based on the device information to establish a connection between the target cryptographic machine and the proxy service. This allows the cryptographic machine to receive instructions from the proxy service and to manage different models of cryptographic machines in a unified manner through the proxy service, shielding the underlying differences. This centralizes the management of cryptographic machines on the proxy service, simplifies the management process, and allows for flexible adaptation to different models of cryptographic machines through the proxy service.

[0069] In this embodiment of the invention, a secure channel can also be constructed between the proxy service and the cryptographic resource management instructions to establish a secure communication channel, protect the security of cryptographic resources, and determine a set of instructions for managing cryptographic resources so that the proxy service can accurately understand and execute them. This achieves the protection of data transmission security through encryption and other means, and makes the management process more standardized and efficient with a unified set of instructions.

[0070] In this embodiment of the invention, the cryptographic resources can also be scheduled through the secure channel based on the cryptographic resource management instructions to realize various operations on the cryptographic resources, such as key generation, encryption, and decryption.

[0071] For example, after the proxy service starts, it automatically submits registration information to the cryptographic resource management system to complete proxy registration. After registration, the proxy service establishes a secure channel with the cryptographic resource management system using the submitted certificate to complete encrypted data interaction. Both parties agree on cryptographic resource management instructions, implementing an instruction interaction protocol based on the secure encrypted channel to achieve cryptographic resource management capabilities based on management instructions. The initial secure channel encryption key negotiation process is completed based on the certificate. Cryptographic resource device management is implemented based on the SNMP protocol to complete the acquisition of cryptographic resource information. The proxy service is selected and the calling method is adapted based on device model matching. For the IP address configuration of cryptographic machines, the cryptographic resource management system can use an IP polling mechanism to proactively discover cryptographic resources and achieve automatic registration capabilities, including automatic expansion and dynamic updating of the polling IP range. Based on the instruction protocol of the secure channel with the proxy service, unified scheduling of cryptographic resources is achieved, thereby providing users with unified interface calling capabilities.

[0072] This invention involves identifying a target cryptographic machine and obtaining its device information; connecting the target cryptographic machine to a proxy service based on the device information; constructing a secure channel with the proxy service and determining cryptographic resource management instructions; and scheduling cryptographic resources through the secure channel based on the cryptographic resource management instructions. This achieves isolation between upper-layer cryptographic capabilities and lower-layer cryptographic resources, enabling the simultaneous application of cryptographic resources from multiple vendors and models. This improves the utilization rate of cryptographic resources and prevents vendor lock-in due to a single vendor.

[0073] Based on the above embodiments, modified embodiments of the above embodiments are proposed. It should be noted that, in order to keep the description brief, only the differences from the above embodiments are described in the modified embodiments.

[0074] In an optional embodiment of the invention, it further includes:

[0075] An IP polling operation is performed, and when the IP of the cryptographic machine is obtained, the cryptographic machine IP is sent to the target cryptographic machine through the secure channel; the target cryptographic machine is configured to register with the cryptographic resource management system through the cryptographic machine IP.

[0076] 1. IP polling operation:

[0077] Objective: To discover available cryptographic devices on the network.

[0078] process:

[0079] The password resource management system sends ICMP echo requests (i.e., pings) one by one according to the preset IP address range.

[0080] If an IP address responds, it is assumed that the IP address corresponds to an online device.

[0081] Record the IP address of the response as a potential cryptographic device.

[0082] 2. Secure channel communication:

[0083] Objective: To establish a secure and reliable communication link between the cryptographic resource management system and the target cryptographic machine.

[0084] Way:

[0085] TLS / SSL: The TLS / SSL protocol is used to encrypt communication data, ensuring data confidentiality, integrity, and authentication.

[0086] Key exchange: The session key is negotiated through a key exchange protocol (such as RSA or Diffie-Hellman) to encrypt communication data.

[0087] Digital certificates: Digital certificates are used to authenticate the identities of both parties in a communication.

[0088] 3. Send the cipher machine IP address:

[0089] Objective: To notify the target cryptographic machine of the IP address assigned by the cryptographic resource management system.

[0090] Way:

[0091] Encapsulation into instructions: The IP address of the cryptographic machine is encapsulated into a specific instruction and sent to the target cryptographic machine through a secure channel.

[0092] Command format: The command format should be clearly defined, including information such as command type, target device, and IP address.

[0093] 4. Target cipher machine registration:

[0094] Purpose: To register one's own information in the password resource management system for subsequent management and scheduling.

[0095] process:

[0096] Receiving instructions: After receiving the instructions sent by the cryptographic resource management system, the target cryptographic machine parses the instruction content.

[0097] Configure IP address: Configure your network interface according to the IP address in the command.

[0098] Send registration information: Send registration information to the password resource management system, including device model, serial number, supported algorithms, etc.

[0099] Configuration: The target cryptographic machine configures its own network interface based on the received IP address, enabling it to communicate with the cryptographic resource management system through that IP address.

[0100] By performing an IP polling operation, and when the IP address of the cryptographic machine is obtained, sending the cryptographic machine IP address to the target cryptographic machine through the secure channel; the target cryptographic machine is configured to register with the cryptographic resource management system via the cryptographic machine IP address, which can achieve the following beneficial effects:

[0101] Automated discovery: Cryptographic devices in the network can be automatically discovered through IP polling without manual intervention.

[0102] Secure communication: Secure channels ensure the confidentiality and integrity of communication data.

[0103] Unified Management: All cryptographic devices are registered and brought under unified management, facilitating centralized control and scheduling.

[0104] Flexible configuration: IP addresses can be dynamically assigned to cryptographic machines, improving system flexibility.

[0105] In an optional embodiment of the present invention, the step of connecting the target cryptographic machine to the proxy service based on the device information includes:

[0106] The cryptographic machine management interface of the target cryptographic machine is determined based on the device information;

[0107] Call the cryptographic machine management interface to obtain the current status information and specific machine parameters of the target cryptographic machine;

[0108] Based on the current status information and the specific machine parameters, a registration instruction is generated for the target cryptographic machine;

[0109] The target cryptographic machine is connected to the proxy service based on the registration instruction.

[0110] Determine the cryptographic machine management interface based on device information:

[0111] Device information acquisition: Device model, manufacturer, and other information obtained via the SNMP protocol can be used as keywords for database queries.

[0112] Database Query: The password resource management system maintains a device information database, which stores management interface information for different models of cryptographic machines, including IP address, port, protocol (HTTP, HTTPS, SNMP, etc.), authentication method, etc.

[0113] Interface matching: Search the database for the corresponding management interface information based on the device information.

[0114] Call the cryptographic machine management interface to obtain status information:

[0115] Interface call: Use the corresponding protocol (HTTP, HTTPS, SNMP, etc.) to send a request to the cryptographic machine to obtain its current status information.

[0116] Status information includes the operating status of the cryptographic machine, hardware information, software version, key usage, etc.

[0117] Parameter Acquisition: Simultaneously acquire some specific parameters of the cryptographic machine, such as supported algorithms, key length, maximum number of concurrent connections, etc.

[0118] Generate registration instructions for the target cipher machine:

[0119] Command format: Based on the command format of the proxy service, construct a command containing the following information:

[0120] Command type: Registration command

[0121] Target device: IP address of the target cipher machine

[0122] Device information: Information such as model, version, and serial number obtained from the cipher machine.

[0123] Management interface information: Management interface information obtained from the database.

[0124] Other parameters: such as key, certificate, etc.

[0125] Command content: The command content should be clear and unambiguous to ensure that the proxy service can correctly parse and execute it.

[0126] Connect the target cryptographic machine to the proxy service based on the registration command:

[0127] Send Instruction: Send the generated registration instruction to the agent service through a secure channel.

[0128] Proxy processing: After receiving the instruction, the proxy service parses the instruction content and performs the following operations:

[0129] Verify command validity: Check if the command format is correct and the signature is valid.

[0130] Connect to the cipher machine: Connect to the target cipher machine according to the management interface information in the instructions.

[0131] Perform the registration operation: Send a registration request to the cryptographic machine to bring it under management.

[0132] Update Database: Update the database of the password resource management system to record the registration information of the password machine.

[0133] The process involves determining the target cryptographic machine's management interface based on the device information; invoking the management interface to obtain the target cryptographic machine's current status information and specific machine parameters; generating a registration instruction for the target cryptographic machine based on the current status information and specific machine parameters; and connecting the target cryptographic machine to the proxy service based on the registration instruction. Newly discovered cryptographic machines can be integrated into the proxy service for unified management. The entire process involves multiple stages, including device discovery, information acquisition, instruction generation, and secure communication.

[0134] In an optional embodiment of the present invention, the cryptographic resource management system is configured with a registration interface and further includes:

[0135] Receive the agent registration instruction sent by the agent service;

[0136] The agent registration command is used to call the registration interface to obtain the agent resources reported by the agent service; the agent resources include agent IP information, port information and agent certificate public key information.

[0137] In practical applications, the registration interface of a cryptographic resource management system can be specifically used to receive registration requests sent by proxy services.

[0138] For example, when a new proxy service starts up and connects to the cryptographic resource management system, it sends a registration instruction to the system, which contains relevant information about the proxy service. The cryptographic resource management system parses this instruction and incorporates the proxy service and its resources into its management system.

[0139] The agent registration instruction contains the necessary information that the agent service reports to the cryptographic resource management system, mainly including:

[0140] Proxy IP Information: The IP address where the proxy service is located, used for communication between the password resource management system and the proxy service.

[0141] Port information: The port number that the proxy service listens on, used to establish connections.

[0142] Proxy Certificate Public Key Information: The digital certificate public key of the proxy service is used to verify the identity of the proxy service and establish a secure communication channel.

[0143] Registration interface processing flow:

[0144] Receiving instructions: The password resource management system listens for registration instructions via the registration interface. Once it receives a registration instruction from the proxy service, it will trigger the corresponding processing logic.

[0145] Command parsing: The system will parse the received commands and extract information such as the proxy IP, port, and certificate public key.

[0146] Data verification: The system verifies the received data to ensure its integrity and legitimacy. For example, it verifies whether the certificate public key format is correct and conforms to predefined rules.

[0147] Information Storage: If verification is successful, the system will store the proxy service information in the database. This information includes the proxy's IP address, port, public key, and other relevant metadata, such as registration time and status.

[0148] Response Generation: The system will send a response to the proxy service, indicating whether the registration was successful. If successful, the response may contain additional information, such as the public key of the password resource management system certificate.

[0149] The significance of reporting agency resources is:

[0150] Unified Management: All agent service information is centrally stored in the cryptographic resource management system for convenient unified management and scheduling.

[0151] Secure communication: The public key information of the proxy certificate is the foundation for establishing a secure communication channel, which can ensure the security of data transmission.

[0152] Dynamic expansion: When a new proxy service is added, dynamic expansion can be achieved through the registration interface.

[0153] The registration interface of the cryptographic resource management system is crucial for enabling dynamic system expansion and centralized management. Through this interface, the cryptographic resource management system can obtain information about proxy services, establish secure communication channels, and achieve unified management of proxy services.

[0154] In an optional embodiment of the present invention, the step of establishing a secure channel with the proxy service includes:

[0155] A certificate public key is generated based on the proxy IP information, the port information, and the proxy certificate public key information, and a random number is generated;

[0156] The certificate public key is encrypted based on the random number to generate an encrypted certificate public key;

[0157] The public key of the encryption certificate is sent to the proxy service; the proxy service decrypts the public key of the encryption certificate to generate an encryption channel key.

[0158] A secure channel is constructed between the encrypted channel key and the proxy service.

[0159] A secure channel is established between the cryptographic resource management system and the proxy service by combining asymmetric and symmetric encryption. The entire process can be divided into the following steps:

[0160] Generate random numbers and encryption certificate public key:

[0161] The cryptographic resource management system can generate a certificate public key and a random number after receiving the proxy IP information, port information and proxy certificate public key information. This random number will be used as the basis for generating the symmetric key.

[0162] Meanwhile, the cryptographic resource management system uses the certificate public key provided by the proxy service to encrypt the generated random number, thus obtaining an encrypted certificate public key.

[0163] Send the public key of the encryption certificate:

[0164] Send the encrypted certificate public key to the proxy service.

[0165] The proxy service decrypts and generates a symmetric key:

[0166] The proxy service uses its private key to decrypt the received encryption certificate's public key, obtaining a random number generated by the cryptographic resource management system.

[0167] The proxy service also generates a random number locally, and performs an XOR operation on the two random numbers to obtain a symmetric key.

[0168] The proxy service encrypts and sends the data back:

[0169] The proxy service uses the public key of the cryptographic resource management system to encrypt locally generated random numbers and sends the encryption result back to the cryptographic resource management system.

[0170] The cryptographic resource management system generates symmetric keys:

[0171] The cryptographic resource management system uses its private key to decrypt the received encrypted data and obtain a random number generated by the proxy service.

[0172] The cryptographic resource management system performs an XOR operation between its own generated random number and the random number generated by the proxy service to obtain the same symmetric key as the proxy service.

[0173] Establish a secure passage:

[0174] Both parties possess the same symmetric key, and subsequent communication data will be encrypted and decrypted using this symmetric key, thereby establishing a secure communication channel.

[0175] Advantages of safety passages:

[0176] Key negotiation: By exchanging and encrypting random numbers, both parties jointly generate a symmetric key, which increases the security of the key.

[0177] Asymmetric encryption ensures identity authentication: By using the public and private keys of certificates to encrypt and decrypt data, the authenticity of the identities of both parties in communication can be ensured.

[0178] Symmetric encryption guarantees efficiency: Symmetric encryption algorithms are more efficient than asymmetric encryption algorithms and are suitable for encrypting large amounts of data.

[0179] In an optional embodiment of the present invention, the step of performing the IP polling operation includes:

[0180] Determine the IP address range and set up a polling queue for the IP address range;

[0181] Perform reachability tests on the IP addresses in the polling queue;

[0182] When the IP address passes the reachability test, the IP address is marked as a usable IP address and stored in the cryptographic machine device pool; the cryptographic machine device pool is used to obtain cryptographic machine IPs.

[0183] Optionally, after the step of sending the cryptographic machine IP to the target cryptographic machine through the secure channel, the method further includes:

[0184] The cipher machine IP address is marked as a used IP address, and the cipher machine IP address is removed from the polling queue;

[0185] Determine the number of IPs and the polling period in the polling queue, and adjust the length of the polling queue based on the number of IPs and the polling period.

[0186] IP polling can be performed in the following ways:

[0187] 1. Determine the IP address range and set up the polling queue:

[0188] Determine the IP range: Based on the actual configuration of the password resource pool, determine the range of IP addresses that need to be polled.

[0189] Set up the polling queue:

[0190] Queue length L: The maximum length L of the polling queue is calculated and set based on factors such as single query time t, polling period T, and number of available IPs N.

[0191] Initial queue filling: Randomly select L IP addresses from the IP address range and fill them into the polling queue.

[0192] 2. Perform reachability testing:

[0193] Test one by one: Take an IP address from the head of the polling queue and perform a ping test or other reachability test.

[0194] Tagging results:

[0195] Reachable: If the test passes, mark the IP address as available and add it to the cryptographic machine device pool.

[0196] Unreachable: If the test fails, remove the IP address from the queue.

[0197] 3. Update the polling queue:

[0198] Dynamic adjustment:

[0199] Queue reduction: When the number of available IPs m approaches 80% of the total number of IP address ranges N, reduce the length of the polling queue to reduce the consumption of network resources.

[0200] Queue expansion: When the number of IPs in the polling queue is less than 20%, increase the length of the polling queue to increase the probability of finding available IPs.

[0201] 4. Handling of the cipher machine's IP address:

[0202] Marked as Used: When a cipher machine is discovered and connected to the system, its corresponding IP address is marked as used.

[0203] Remove from queue: Remove the IP address from the polling queue to avoid repeated testing.

[0204] Add to device pool: Add this IP address to the cryptographic machine device pool for subsequent management and scheduling.

[0205] 5. Security Channels and Command Structure:

[0206] Safety passage:

[0207] Establishment: As mentioned above, a secure communication channel is established between the cryptographic resource management system and the agent to ensure the security of command transmission.

[0208] Command transmission: Through this channel, the cryptographic resource management system sends commands to the agent, which executes the commands and returns the results.

[0209] Instruction structure:

[0210] Standardization: Define a unified instruction format, including instruction type, target device, operation parameters, etc.

[0211] Encrypted transmission: All commands are encrypted using a symmetric key to ensure security during transmission.

[0212] This invention embodiment determines an IP address range and sets up a polling queue for that IP address range;

[0213] Perform reachability tests on the IP addresses in the polling queue;

[0214] When the IP address passes the reachability test, the IP address is marked as a usable IP address and stored in the cryptographic machine device pool; the cryptographic machine device pool is used to obtain cryptographic machine IPs.

[0215] Optionally, after the step of sending the cryptographic machine IP to the target cryptographic machine through the secure channel, the method further includes:

[0216] The cipher machine IP address is marked as a used IP address, and the cipher machine IP address is removed from the polling queue;

[0217] Determining the number of IPs and the polling period in the polling queue, and adjusting the length of the polling queue based on the number of IPs and the polling period, achieves the following beneficial effects:

[0218] Testing methods: More complex network testing methods, such as TCP connection testing and port scanning, can be used to improve the accuracy of the test.

[0219] Polling strategy: The polling frequency can be dynamically adjusted according to the network load to avoid excessive impact on the network.

[0220] IP address allocation: IP address pools can be used to manage and allocate IP addresses in a unified manner.

[0221] Troubleshooting: When network or equipment failures are detected, appropriate handling mechanisms are needed to ensure system stability.

[0222] Through the IP polling method, the password resource management system can dynamically discover available IP addresses and add them to the password machine device pool. Combining the secure channel and standardized instruction structure, the unified management and scheduling of the password machine are achieved.

[0223] To enable those skilled in the art to better understand the embodiments of the present invention, the following uses an example to illustrate the embodiments of the present invention.

[0224] The automatic expansion of password resources can be achieved through the following method:

[0225] Step 1: Deploy the password resource management system.

[0226] Deploy a unified password resource management platform, including the database of the management platform, the nginx proxy, and the front-end user interaction interface UI.

[0227] Step 1.1: Open the proxy service registration monitoring port;

[0228] Open the proxy registration port monitoring and accept the proxy service registration application. The proxy service registration is implemented in the form of instruction interaction. For the instruction details, see 2.1 Proxy Service Deployment.

[0229] Step 1.2: Open the password machine IP monitoring;

[0230] Configure the available network address segment based on the network IP address segment allocated by the actual password resource pool. After configuration, the password resource management system will start the IP polling call method to perform the IP address reachability test. Since the number of IPs in the IP address segment may be large, full polling may consume a large amount of network resources and does not conform to the actual application situation. Therefore, based on the actual situation, the polling method is implemented in the form of dynamic expansion;

[0231] Suppose there are a total of N IP addresses in the IP address segment, the number of used IP addresses is m, the single query time is t, the upper limit of the number of IP addresses in the polling queue is L, the current number of IPs in the polling queue is l, and the polling period is T. To ensure that there are enough available IPs and the polling period is within a certain range, it is necessary to satisfy: L < T÷t. When l < 0.2L, the number of IPs needs to be expanded to L. When m > 0.8N, a warning of insufficient IP quantity needs to be issued to reserve enough time for expanding available IP addresses;

[0232] When the password resource management system discovers a password machine device newly connected to the network, it will mark the IP address as a used address and remove it from the polling queue; and obtain the machine name of the device through the snmp protocol, query the instruction channel of the proxy service corresponding to this model of machine based on the name, and send instructions to the corresponding proxy machine to notify it to perform status acquisition and registration operations on this device;

[0233] Step 1.3: Negotiate the secure channel between the cryptographic resource management system and the proxy service, as well as the instruction structure of cryptographic resource management commands;

[0234] The cryptographic resource management system and its agents use a secure channel to distribute and receive cryptographic resource management instructions.

[0235] Step 2: Deploy the password resource management system agent.

[0236] Deploy a proxy service for the cryptographic resource management system on the cryptographic machine side. The proxy service adapts its functions based on the cryptographic machine manufacturer and model, and encapsulates the corresponding instruction functions based on the required cryptographic machine capabilities.

[0237] Step 2.1: Agent Deployment;

[0238] The deployment vendor provides a corresponding adapter. Upon startup, the adapter automatically sends an adapter registration command to the password resource management system. The command structure is as follows: Figure 2 As shown, Figure 2 This is a schematic diagram of the instruction structure between the cryptographic resource management system and the proxy service provided in this embodiment of the invention.

[0239] Step 2.2: Report the proxy public key;

[0240] When the proxy service starts, it needs to configure the certificate and the IP address of the password resource management system. When the proxy service starts, it automatically calls the registration interface of the password resource management system to report proxy resources. The reported information mainly includes proxy IP, port, proxy certificate public key and other proxy-related information. The registration interface returns the certificate public key of the password resource management system.

[0241] Step 2.3: Establishment of the command security channel

[0242] After completing the agent registration, the cryptographic resource management system will proactively establish a secure channel with the agent. The channel establishment process is as follows:

[0243] 1. The password resource management system generates random numbers, encrypts the random numbers using the proxy certificate's public key, and transmits them to the proxy server via the UDP protocol;

[0244] 2. The agent obtains the random number by decrypting using the local certificate's private key;

[0245] 3. After generating a random number locally, the agent performs an XOR operation with the random number generated by the cryptographic resource management system to obtain the encryption channel key.

[0246] 4. The agent uses the certificate public key of the cryptographic resource management system to encrypt locally generated random numbers and returns the encryption result to the cryptographic resource management system;

[0247] 5. The cryptographic resource management system uses the local certificate public key to decrypt random numbers, and then XORs the random number with the local random number to generate the encryption channel key;

[0248] 6. The cryptographic resource management system stores the mapping relationship between secure channels, communication keys, and agent IDs in a cache;

[0249] 7. Both parties use a communication key to encrypt instructions and exchange data.

[0250] Step 3: Connect the cryptographic machine to the agent.

[0251] When it is necessary to expand the capacity of cryptographic machines, the IP addresses of the cryptographic machines need to be configured according to the polling IP address range configured in the cryptographic resource management system.

[0252] Step 3.1: Register the cipher machine information

[0253] When the cryptographic resource management system polls IPs and discovers a new access device, it obtains the machine model through the SNMP protocol, confirms the manufacturer and model of the cryptographic machine by matching, queries the message channel of the corresponding manufacturer's agent service, and issues the new cryptographic machine IP address.

[0254] Step 3.2: Reporting Cipher Machine Information

[0255] Based on the cryptographic machine model obtained from the cryptographic machine agent, the corresponding manufacturer's cryptographic machine management interface is confirmed, and the current status and specific machine parameters of the cryptographic machine are obtained. A new cryptographic machine registration instruction is generated and reported to the cryptographic resource management system. The cryptographic machine data storage is uniformly managed by the cryptographic resource management system.

[0256] Step 4: The cryptographic resource management system enables unified application of cryptographic resources.

[0257] The cryptographic resource management system provides a unified interface capability to the outside world. Based on a secure channel with the agent, it enables command issuance and data collection, thereby achieving unified control over the agent. For the upper-layer system, it only needs to call the unified interface of the cryptographic service platform and view the system's visual interface to operate and access cryptographic resources from various manufacturers and models.

[0258] Step 5: New vendor cryptographic machine integration and adaptation

[0259] The proxy uniformly defines the cryptographic resource capabilities that need to be invoked for each cryptographic resource, and implements function invocation through commands. When a new cryptographic machine needs to be connected, it only needs to encapsulate the functions based on the cryptographic capability invocation package provided by the manufacturer and its invocation methods to quickly achieve cryptographic machine manufacturer integration and function adaptation. Because the cryptographic resource capabilities are generally universal, only the invocation methods vary greatly. This approach can achieve rapid integration for various scenarios and needs without changing the overall technical architecture and existing functional code.

[0260] Description of the password resource management system and proxy services.

[0261] The cryptographic resource management system includes the following modules:

[0262] The unified interface module is used to provide a unified cryptographic capability call interface to the outside world.

[0263] The cryptographic resource registration module is used to actively discover cryptographic machines and collect their initial information.

[0264] The cryptographic resource management module is used to generate cryptographic resource management instructions.

[0265] The agent control module is used to establish a secure channel with the agent, negotiate the communication key, and complete the agent selection and control command issuance.

[0266] The agency service includes the following modules:

[0267] The automatic registration module is responsible for proactively reporting agent information to the password resource management system to establish a secure channel.

[0268] The instruction receiving module is responsible for monitoring the secure channel, managing the secure channel key, and parsing the cryptographic resource management instructions received by the secure channel.

[0269] The cryptographic resource control module is responsible for invoking the corresponding capabilities of cryptographic resources based on the received instructions, and constructing return information to return to the cryptographic resource management system.

[0270] refer to Figure 2 , Figure 2 This is a schematic diagram of the instruction structure between the cryptographic resource management system and the proxy service provided in this embodiment of the invention;

[0271] The overall structure of secure channel transmission instructions between cryptographic resource management systems is divided into sections, which describes the main instruction structures for agent registration, cryptographic machine registration, and cryptographic machine capability invocation, and illustrates the overall instruction structure. Instruction transmission between the cryptographic resource management system and the agent is achieved through the establishment of a secure channel. This instruction-based approach enables the cryptographic resource management system to manage and control the agent, thereby achieving stateless management of the cryptographic machine.

[0272] refer to Figure 3 , Figure 3 This is a system architecture diagram of the cryptographic resource management system and the agent provided in this embodiment of the invention;

[0273] Figure 3 This document explains the relationship between the modules in the cryptographic resource management system and the agent, as well as their main capabilities. It also illustrates how the agent manages and adapts to cryptographic resources from different models and manufacturers. Through a layered, distributed management approach, unified management and unified capability invocation of cryptographic resources are achieved.

[0274] refer to Figure 4 , Figure 4 This is a functional module relationship diagram between the code resource management system and the agent provided in this embodiment of the invention;

[0275] The main modules of the system and the function calls between modules are as follows: Figure 4 As shown, the main functional modules of the password resource management system and the proxy service are illustrated, and the calling relationships between the main modules are simply marked.

[0276] refer to Figure 5 , Figure 5 This is the main flowchart of the cryptographic resource expansion provided in this embodiment of the invention;

[0277] The system achieves rapid and dynamic expansion of cryptographic resources by implementing automatic discovery and registration of these resources. Automatic discovery is achieved by configuring the IP addresses of cryptographic resources and leveraging the polling capability of the cryptographic resource management system. The flowchart for automatic discovery and active registration during cryptographic resource expansion is as follows: Figure 5 As shown.

[0278] This document describes the implementation of a password resource management system using Java. During initialization, the proxy registers via the REST interface provided by the password resource management system. After registration, a secure command channel is established between the proxy and the system. The system utilizes the ServerSocket object to implement port monitoring capabilities, providing the proxy with the ability to establish a secure channel. The proxy establishes the secure channel using the locally stored password resource management system certificate. Java's Cipher package is used to implement random number generation, asymmetric encryption, and symmetric encryption, thus facilitating the establishment of the secure channel. The automatic discovery and registration steps for password resources are as follows:

[0279] Step 1: The password resource management system configures the range of IP addresses to be polled and the number of already used IP addresses in the database. It stores the IP addresses to be polled in the cache and starts IP address polling. By introducing the InetAddress library, it implements IP address reachability testing; if it fails, it tries the next one. Assuming the timeout for each IP address is set to 3 seconds and the expected password resource access delay is 5 minutes, the maximum number of IP addresses that can be polled at one time is 100. When an IP address is already in use, it is automatically removed from the polling range. If, during the polling process, the number of currently polled addresses is less than 20, it automatically selects enough IP addresses from the available address range in the database to supplement the polling queue until it reaches 100.

[0280] Step 2: The password resource management system incorporates the SNMP4J library. When an IP address in a polling queue becomes reachable, it attempts to connect using the `connect` method and retrieves information such as the target machine model and name using the `get` method. Through model resolution and by querying the corresponding agent information stored in the database, it sends the corresponding password machine IP address and other information through a secure channel.

[0281] Step 3: The agent uses the password resource information issued by the password resource management system to establish a secure channel through the password resource management interface provided by the manufacturer via UDP / TCP protocol, or to implement device management through SNMP protocol, or to query device information of resources through HTTPS. The specific method needs to be implemented through an adapter layer.

[0282] Step 4: Based on the acquired cryptographic resource status information, the agent generates a cryptographic machine registration command and reports it to the cryptographic resource management system through a secure channel. The cryptographic resource management system parses the data and stores it in its database.

[0283] Step 5: For registered password resources, the password service management system provides a unified REST interface for other platforms to call, offering unified password capabilities. The interface includes password resource encoding retrieval, password capability invocation, and corresponding password capability parameters. By parsing the parameters in the interface call, based on database information, corresponding instructions are generated and sent to the corresponding proxy service provider. A unified return result is obtained through a secure channel and provided to the user.

[0284] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0285] Reference Figure 6 The diagram illustrates a structural block diagram of a cryptographic resource scheduling device provided in an embodiment of the present invention, which may specifically include the following modules:

[0286] The target cipher machine determination module 601 is used to determine the target cipher machine and obtain the device information of the target cipher machine;

[0287] The proxy service access module 602 is used to connect the target cryptographic machine to the proxy service based on the device information.

[0288] The secure channel construction module 603 is used to construct a secure channel with the proxy service and determine the password resource management instructions;

[0289] The scheduling module 604 is used to schedule the cryptographic resources through the secure channel based on the cryptographic resource management instructions.

[0290] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0291] In addition, embodiments of the present invention also provide an electronic device, such as... Figure 7 As shown, it includes a processor 701, a communication interface 702, a memory 703, and a communication bus 704, wherein the processor 701, the communication interface 702, and the memory 703 communicate with each other through the communication bus 704.

[0292] Memory 703 is used to store computer programs;

[0293] When the processor 701 executes the program stored in the memory 703, it implements any of the cryptographic resource scheduling methods described in the above embodiments:

[0294] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0295] The communication interface is used for communication between the aforementioned terminal and other devices.

[0296] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0297] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0298] like Figure 8 As shown, in another embodiment of the present invention, a computer-readable storage medium 801 is also provided, which stores instructions that, when executed on a computer, cause the computer to perform the cryptographic resource scheduling method described in the above embodiment.

[0299] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

[0300] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0301] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0302] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0303] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0304] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0305] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0306] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for scheduling cryptographic resources, characterized in that, The method is applied to a cryptographic resource management system, which is configured with a proxy service for cryptographic machines, including: Identify the target cryptographic machine and obtain its device information; the device information includes at least the manufacturer information and model number of the target cryptographic machine. Based on the device information, the target cryptographic machine is connected to the proxy service; A secure channel is established between the proxy service and the proxy service, and password resource management instructions are determined. The cryptographic resources are scheduled through the secure channel based on the cryptographic resource management instructions. The step of connecting the target cryptographic machine to the proxy service based on the device information includes: The cryptographic machine management interface of the target cryptographic machine is determined based on the device information; Call the cryptographic machine management interface to obtain the current status information and specific machine parameters of the target cryptographic machine; Based on the current status information and the specific machine parameters, a registration instruction is generated for the target cryptographic machine; The target cryptographic machine is connected to the proxy service based on the registration instruction; The proxy service is used to parse the instruction content and perform the following operations: Check if the instruction format is correct and the signature is valid; Connect to the target cryptographic machine according to the management interface information in the instruction; Send a registration request to the target cryptographic machine to bring the target cryptographic machine under management; Update the database of the cryptographic resource management system to record the registration information of the cryptographic machine.

2. The method according to claim 1, characterized in that, Also includes: Perform IP polling, and when the IP of the cryptographic machine is obtained, send the cryptographic machine IP to the target cryptographic machine through the secure channel; The target cryptographic machine is configured to register with the cryptographic resource management system via the cryptographic machine's IP address.

3. The method according to claim 1 or 2, characterized in that, The cryptographic resource management system is configured with a registration interface and also includes: Receive the agent registration instruction sent by the agent service; The agent registration command is used to call the registration interface to obtain the agent resources reported by the agent service; the agent resources include agent IP information, port information and agent certificate public key information.

4. The method according to claim 3, characterized in that, The steps of establishing a secure channel with the proxy service include: A certificate public key is generated based on the proxy IP information, the port information, and the proxy certificate public key information, and a random number is generated; The certificate public key is encrypted based on the random number to generate an encrypted certificate public key; The public key of the encryption certificate is sent to the proxy service; the proxy service decrypts the public key of the encryption certificate to generate an encryption channel key. A secure channel is constructed between the encrypted channel key and the proxy service.

5. The method according to claim 2, characterized in that, The steps for performing the IP polling operation include: Determine the IP address range and set up a polling queue for the IP address range; Perform reachability tests on the IP addresses in the polling queue; When the IP address passes the reachability test, the IP address is marked as a usable IP address and stored in the cryptographic machine device pool; the cryptographic machine device pool is used to obtain cryptographic machine IPs.

6. The method according to claim 5, characterized in that, After the step of sending the cipher machine IP address to the target cipher machine through the secure channel, the method further includes: The cipher machine IP address is marked as a used IP address, and the cipher machine IP address is removed from the polling queue; Determine the number of IPs and the polling period in the polling queue, and adjust the length of the polling queue based on the number of IPs and the polling period.

7. A cryptographic resource scheduling device, characterized in that, The device is applied to a cryptographic resource management system, which is configured with a proxy service for cryptographic machines, including: A target cryptographic machine determination module is used to determine a target cryptographic machine and obtain the device information of the target cryptographic machine; the device information includes at least the manufacturer information and device model of the target cryptographic machine. A proxy service access module is used to connect the target cryptographic machine to the proxy service based on the device information. A secure channel construction module is used to construct a secure channel with the proxy service through the proxy service and to determine the password resource management instructions; The scheduling module is used to schedule the cryptographic resources through the secure channel based on the cryptographic resource management instructions; The secure channel construction module is also used to determine the cryptographic machine management interface of the target cryptographic machine based on the device information; Call the cryptographic machine management interface to obtain the current status information and specific machine parameters of the target cryptographic machine; Based on the current status information and the specific machine parameters, a registration instruction is generated for the target cryptographic machine; The target cryptographic machine is connected to the proxy service based on the registration instruction; The proxy service is used to parse the instruction content and perform the following operations: Check if the instruction format is correct and the signature is valid; Connect to the target cryptographic machine according to the management interface information in the instructions; Send a registration request to the target cryptographic machine to bring the target cryptographic machine under management; Update the database of the cryptographic resource management system to record the registration information of the cryptographic machine.

8. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; The memory is used to store computer programs; When the processor executes a program stored in the memory, it implements the method as described in any one of claims 1-6.

9. A computer-readable storage medium having instructions stored thereon that, when executed by one or more processors, cause the processors to perform the method as described in any one of claims 1-6.

Images