Method for solving short plate effect of password device cluster

Abstract

The invention discloses a method for solving the short-board effect of a cryptographic device cluster, relates to the technical field of information security, and solves the problem of the short-board effect of cryptographic device cluster performance and key storage space. The method comprises the following steps: S1, registering information of password equipment; s2, establishing a relation lookup table of the password device ID, the password device key index, the key ID, the user key index and the user ID; s3, establishing a dynamic routing table based on the relation lookup table, calling a dynamic routing service through a network request when an application is called, and searching the password device IP and the password device key index corresponding to the request by the dynamic routing service according to the network request and the dynamic routing table, calling a corresponding secret key based on the cryptographic equipment IP and the cryptographic equipment secret key index to carry out related cryptographic operation; according to the method, all key storage spaces of the equipment can be fully utilized during cryptographic equipment clustering.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for solving the short board effect of a cryptographic device cluster. Background Art

[0002] Since the manufacturers and models of cryptographic devices may be different, the key storage space and cryptographic operation performance of the device cluster nodes may be different. The cluster needs to ensure that when a user calls any device node, any key belonging to the user can be used for cryptographic operation in the device. Therefore, when clustering, only the smallest key space among all device nodes in the cluster can be used as the overall key space of the cluster. The remaining device nodes with large key storage space may cause a large amount of capacity redundancy and fail to fully utilize all key storage space.

[0003] A cryptographic device cluster can be likened to a bucket; the size of its key storage space can be likened to how much water the bucket can hold; the cryptographic device nodes can be likened to the wooden boards that make up the bucket; the key storage space and cryptographic computing performance provided by the cryptographic device cluster are limited by the worst device node, which can be likened to how much water the bucket can hold depends on the length of its shortest wooden board; this type of problem is referred to as the short board effect. Summary of the invention

[0004] In order to solve the problems existing in the above-mentioned prior art, the present invention provides a method for solving the short board effect of a cryptographic device cluster, thereby solving the short board effect problem of the cryptographic device cluster performance and key storage space.

[0005] A method for solving the short board effect of a cryptographic device cluster, comprising:

[0006] S1: Register the information of the cryptographic device, where the information of the cryptographic device includes the cryptographic device ID and the cryptographic device key index;

[0007] S2: Determine the key storage space to be allocated according to the relationship between the cryptographic device ID and the cryptographic device key index, correspond the key data required by the user to the key storage space to be allocated, and establish a relationship lookup table of the cryptographic device ID, the cryptographic device key index, the key ID, the user key index, and the user ID;

[0008] S3: A dynamic routing table is established based on the relationship lookup table. When the application calls, the dynamic routing service is called through a network request. The dynamic routing service looks up the cryptographic device IP and cryptographic device key index corresponding to the request based on the network request and the dynamic routing table, and calls the corresponding key based on the cryptographic device IP and cryptographic device key index to perform related cryptographic operations.

[0009] Furthermore, the information of the cryptographic device in S1 includes: device type, manufacturer name, device model, key capacity, performance parameters, as well as the IP address and port of the cryptographic device management agent, and the IP address and port of the cryptographic device service agent.

[0010] Furthermore, the relationship between the cryptographic device ID and the cryptographic device key index in S2 is established by the registered cryptographic device information.

[0011] Further, S2 includes, when establishing the relationship, filtering the key ID, the user key index, and the data list with the user ID being empty as the key storage space to be allocated through the relationship between the cryptographic device ID and the cryptographic device key index;

[0012] Furthermore, S2 also includes determining whether the key storage space to be allocated meets the key data required by the user. If so, a corresponding number of key data are generated and then loaded into the corresponding index key storage space in the corresponding cryptographic device according to the cryptographic device ID and the cryptographic device key index of the key storage space to be allocated, and user key indexes are generated in sequence and allocated to the user.

[0013] Furthermore, the S3 includes S3.1: establishing a dynamic routing table based on the relationship lookup table and the user application calling key's permission identifier App_AK, the dynamic routing table including the user application calling key's permission identifier, user ID, user key index, cryptographic device ID, cryptographic device key index, and cryptographic device IP.

[0014] Furthermore, the S3 includes S3.2: when the application is called, a network request is made to a dynamic routing service, and the dynamic routing service obtains the loadable cryptographic device IP according to the permission identifier of the user application calling key in the network request and the dynamic routing table.

[0015] Furthermore, the S3 includes S3.3: parsing the user key index in the request parameter, determining the cryptographic device key index that the application needs to use, and then determining the unique cryptographic device index through the loadable cryptographic device IP.

[0016] Furthermore, S3 includes S3.4: according to the cryptographic device index, the dynamic routing service reconstructs the parameters of the application request to convert the key index, and then forwards the request according to the obtained cryptographic device IP. After receiving the request, the cryptographic device or the cryptographic device service agent can call the corresponding key according to the converted key index to perform related cryptographic operations.

[0017] The beneficial effects of the present invention include:

[0018] Cryptographic devices provide cryptographic operations. When building a cluster, they are not limited by the key capacity and performance parameters of any node, but are only related to the overall computing power of the cluster.

[0019] When cryptographic devices provide external cryptographic operations for keys, they can dynamically expand horizontally (key storage space) and vertically (cryptographic operation performance). When cryptographic devices are clustered, they can fully utilize all the key storage space of the devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a flow chart of a method for solving the short board effect of a cryptographic device cluster involved in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0022] Basic principle:

[0023] The cryptographic device as a whole serves as an operation layer, wherein the key is stateless for the cryptographic device.

[0024] The cryptographic device management agent and the cryptographic device service agent serve as the adaptation layer, and the key management system performs unified key management (management layer); the dynamic routing service performs unified cryptographic device scheduling (load layer).

[0025] A method to solve the short board effect of cryptographic equipment cluster, such as Figure 1 As shown, including:

[0026] S1: Register the information of the cryptographic device, where the information of the cryptographic device includes the cryptographic device ID and the cryptographic device key index;

[0027] S2: Determine the key storage space to be allocated according to the relationship between the cryptographic device ID and the cryptographic device key index, correspond the key data required by the user to the key storage space to be allocated, and establish a relationship lookup table of the cryptographic device ID, the cryptographic device key index, the key ID, the user key index, and the user ID;

[0028] S3: A dynamic routing table is established based on the relationship lookup table. When the application calls, the dynamic routing service is called through a network request. The dynamic routing service looks up the cryptographic device IP and cryptographic device key index corresponding to the request based on the network request and the dynamic routing table, and calls the corresponding key based on the cryptographic device IP and cryptographic device key index to perform related cryptographic operations.

[0029] In another embodiment, the information of the cryptographic device in S1 includes: device type, manufacturer name, device model, key capacity, performance parameters, and the IP address and port of the cryptographic device management agent, and the IP address and port of the cryptographic device service agent.

[0030] In another embodiment, the relationship between the cryptographic device ID and the cryptographic device key index in S2 is established by the registered cryptographic device information.

[0031] In another embodiment, S2 includes, when establishing the relationship, filtering the key ID, the user key index, and the data list with the user ID being empty as the key storage space to be allocated according to the relationship between the cryptographic device ID and the cryptographic device key index;

[0032] In another embodiment, S2 also includes determining whether the key storage space to be allocated meets the key data required by the user. If so, a corresponding number of key data are generated and then loaded into the corresponding index key storage space in the corresponding cryptographic device according to the cryptographic device ID and the cryptographic device key index of the key storage space to be allocated, and user key indexes are generated in sequence and allocated to the user.

[0033] In another embodiment, the S3 includes S3.1: establishing a dynamic routing table based on the relationship lookup table and the permission identifier App_AK of the user application calling the key, and the dynamic routing table includes the permission identifier of the user application calling the key, user ID, user key index, cryptographic device ID, cryptographic device key index, and cryptographic device IP.

[0034] In another embodiment, S3 includes S3.2: when the application calls, a network request is made to a dynamic routing service, and the dynamic routing service obtains the loadable cryptographic device IP according to the permission identifier of the user application calling key in the network request combined with the dynamic routing table.

[0035] In another embodiment, the S3 includes S3.3: parsing the user key index in the request parameter, determining the cryptographic device key index that the application needs to use, and then determining the unique cryptographic device index through the loadable cryptographic device IP.

[0036] In another embodiment, S3 includes S3.4: according to the cryptographic device index, the dynamic routing service reconstructs the parameters of the application request to convert the key index, and then forwards the request according to the obtained cryptographic device IP. After receiving the request, the cryptographic device or the cryptographic device service agent can call the corresponding key according to the converted key index to perform related cryptographic operations.

[0037] Specifically, the implementation process is as follows:

[0038] S1. The cryptographic device registers information (including: device type, manufacturer name, device model, key capacity, performance parameters, as well as the cryptographic device management agent IP address and port, the cryptographic device service agent IP address and port).

[0039] S2. Establish a relationship lookup table of cryptographic device ID, cryptographic device key index, key ID, user key index, and user ID, as shown in Table 1.

[0040] Table 1 Relationship lookup table

[0041]

[0042] 1) The data in the third column (cryptographic device ID) and the fourth column (index of the cryptographic device internal storage key) of the table can be determined and generated according to the registration information when accessing in step S1.

[0043] 2) When the complete relationship is established, the data list in 1) is filtered to obtain the row data list whose first, second and fifth columns are empty. The filtered data list represents the allocatable key storage space.

[0044] 3) According to the number of keys required by the user, determine whether the data list in 2) meets the quantity requirement. If not, reject the user's request; if yes, generate the corresponding number of key data, and then load it into the corresponding index key storage space in the corresponding cryptographic device according to the data list in 2) (establish the third, fourth, and fifth columns of data), and generate the user key index in sequence and assign it to the user (the first and second columns of data).

[0045] Specifically, when the relationship is established in step S2, multiple physical nodes can be dynamically spliced ​​into a single logical cluster node according to the user's key capacity requirements. Assume that the number of keys required by the user is 2, and the key capacity of each device is 1. Then, the two cryptographic device physical nodes with DEV_ID "7d9c1424-c491-4d11-8a61-e194a28ffb6d" and "636c1424-c491-4d11-8a61-e194a28ffb6d" shown in Table 2 are spliced ​​into a logical cluster node with a key capacity of 2. For the user, there are two keys with IDs of "d5b620b7-595e-4cb3-b909-01c7452b9dad" and "69254cd8-6f2a-4703-8692-f7e242cadcac", which are continuous and unique, and the indexes are "1" and "2" respectively.

[0046] Table 2 Single logical cluster points of dynamic splicing

[0047]

[0048] Assuming that the key storage space of the cryptographic device is 1, the two devices can be combined into a logical node with a key storage space of 2 through the above method. In the same way, the logical node can be continuously replicated to form a logical cluster A, as shown in Table 3 (including logical node 1 and node 2).

[0049] Table 3 Logical cluster A containing multiple logical nodes

[0050]

[0051]

[0052] Through the above method, the dynamic expansion of the key space and cryptographic operation performance of a single node can be achieved without being limited by the physical factors of a single cryptographic device node.

[0053] S3.1 implements dynamic routing service and establishes a dynamic routing table, as shown in Table 4.

[0054] Specifically, it is assumed by default that the cryptographic device can be called through the network (DEV_IP is the cryptographic device IP). If only local calls are supported, the cryptographic device service agent is used to make network calls. In this case, DEV_IP is the cryptographic device service agent IP.

[0055] Table 4 Dynamic routing table

[0056]

[0057] The second, third, fourth and fifth columns of data in this table are generated by steps S1 and S2. The first column of data APP_AK is used as the permission identifier of the user application calling the key.

[0058] Generated by the user after assigning which applications use which keys.

[0059] S3.2. When the application is called, a network request is made to the dynamic routing service. The dynamic routing service obtains the list of DEV_IPs that can be loaded according to the APP_AK parameter in the request. Take the APP_AK "345cdc79-d461-4b45-8618-1496e66d568b" in Table 4 as an example, as shown in Table 5:

[0060] Table 5 APP_AK parameters and loadable DEV_IP correspondence table

[0061] App_AK DEV_IP 345cdc79-d461-4b45-8618-1496e66d568b 192.168.0.2 345cdc79-d461-4b45-8618-1496e66d568b 192.168.0.3

[0062] From the table above, we can see that the request of this application can be loaded to "192.168.0.2" and "192.168.0.3". Through common load balancing rules, such as polling, random, weight, etc., we can get the IP that should be loaded. Assumption: Through the load rule, we can get the cryptographic device or cryptographic device service agent that should load this request to "192.168.0.2".

[0063] S3.3. Parse the User_Index (user key index) in the request parameter, assuming it is "1". Determine the key index that the application needs to use, and then use the IP (192.168.0.2) determined by S4 to determine the following unique row data, as shown in Table 6;

[0064] Table 6 Unique key information determined by network request

[0065] App_AK User_Index DEV_IP Dev_Index 345cdc79-d461-4b45-8618-1496e66d568b 1 192.168.0.2 11

[0066] S3.4. Through this line of data, it can be known that the key is stored in the cryptographic device corresponding to 192.168.0.2 at index position 11. Therefore, the dynamic routing service reconstructs the parameters of the application request and converts the key index parameter from "1" to "11", and then forwards the request according to "192.168.0.2" obtained in S4. After receiving the request, the cryptographic device or the cryptographic device service agent can call the corresponding key according to the index "11" to perform related cryptographic operations.

[0067] The above-mentioned embodiments only express the specific implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the protection scope of the present application. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the technical solution concept of the present application, and these all belong to the protection scope of the present application.

Claims

1. A method for solving the short board effect of cryptographic device cluster, characterized in that: include: S1: Register the information of the cryptographic device, where the information of the cryptographic device includes the cryptographic device ID and the cryptographic device key index; S2: Determine the key storage space to be allocated according to the relationship between the cryptographic device ID and the cryptographic device key index, correspond the key data required by the user to the key storage space to be allocated, and establish a relationship lookup table of the cryptographic device ID, the cryptographic device key index, the key ID, the user key index, and the user ID; S3: A dynamic routing table is established based on the relationship lookup table. When the application calls, the dynamic routing service is called through a network request. The dynamic routing service looks up the cryptographic device IP and cryptographic device key index corresponding to the request based on the network request and the dynamic routing table, and calls the corresponding key based on the cryptographic device IP and cryptographic device key index to perform related cryptographic operations.

2. A method for solving the short board effect of a cryptographic device cluster according to claim 1, characterized in that: The information of the cryptographic device described in S1 also includes: device type, manufacturer name, device model, key capacity, performance parameters, and the IP address and port of the cryptographic device management agent.

3. A method for solving the short board effect of a cryptographic device cluster according to claim 1, characterized in that: The relationship between the cryptographic device ID and the cryptographic device key index in S2 is established by the registered cryptographic device information.

4. A method for solving the short board effect of a cryptographic device cluster according to claim 1, characterized in that: S2 includes: When establishing the relationship, the key ID, user key index, and user ID are empty data lists that are selected as the key storage space to be allocated through the relationship between the cryptographic device ID and the cryptographic device key index.

5. The method for solving the short board effect of cryptographic device cluster according to claim 1, characterized in that: S2 also includes determining whether the key storage space to be allocated meets the key data required by the user. If so, a corresponding amount of key data is generated and then loaded into the corresponding index key storage space in the corresponding cryptographic device according to the cryptographic device ID and cryptographic device key index of the key storage space to be allocated, and user key indexes are generated in sequence and allocated to the user.

6. A method for solving the short board effect of a cryptographic device cluster according to any one of claims 1 to 5, characterized in that: The S3 includes S3.1: establishing a dynamic routing table based on the relationship lookup table and the permission identifier of the user application calling the key, and the dynamic routing table includes the permission identifier of the user application calling the key, the user ID, the user key index, the cryptographic device ID, the cryptographic device key index, and the cryptographic device IP.

7. A method for solving the short board effect of a cryptographic device cluster according to any one of claims 1 to 5, characterized in that: The S3 includes S3.2: when the application calls, a network request is made to a dynamic routing service, and the dynamic routing service obtains the loadable cryptographic device IP according to the permission identifier of the user application calling key in the network request and the dynamic routing table.

8. A method for solving the short board effect of a cryptographic device cluster according to any one of claims 1 to 5, characterized in that: The S3 includes S3.3: parsing the user key index in the request parameter, determining the cryptographic device key index that the application needs to use, and then determining the unique cryptographic device index through the loadable cryptographic device IP.

9. A method for solving the short board effect of a cryptographic device cluster according to any one of claims 1 to 5, characterized in that: The S3 includes S3.4: according to the cryptographic device index, the dynamic routing service reconstructs the parameters of the application request to convert the key index, and then forwards the request according to the obtained cryptographic device IP. After receiving the request, the cryptographic device or the cryptographic device service agent can call the corresponding key according to the converted key index to perform related cryptographic operations.

Images