A method for solving the short board effect of a cryptographic device cluster

Abstract

The application discloses a method for solving short board effect of a cryptographic device cluster, relates to the technical field of information security, and solves the short board effect problem of the performance and key storage space of the cryptographic device cluster; the method comprises the following steps: S1, registering information of the cryptographic device; S2, establishing a relationship lookup table of a cryptographic device ID, a cryptographic device key index, a key ID, a user key index and a user ID; and S3, establishing a dynamic routing table based on the relationship lookup table, and when an application is called, calling a dynamic routing service through a network request, searching for corresponding cryptographic device IP and cryptographic device key index of the request according to the network request and the dynamic routing table, and calling corresponding keys to perform relevant cryptographic operations based on the cryptographic device IP and the cryptographic device key index; in the application, all key storage spaces of the cryptographic device cluster can be fully utilized.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and specifically to a method for addressing the bottleneck effect of cryptographic device clusters. Background Technology

[0002] Due to differences in manufacturers and models, cryptographic devices may vary in key storage space and cryptographic performance across cluster nodes. The cluster must ensure that any user's key can be used for cryptographic operations on any device node. Therefore, when clustering, only the smallest key space among all device nodes within the cluster can be used as the overall key space for the cluster. Device nodes with larger key storage spaces may cause significant capacity redundancy, preventing full utilization of all key storage space.

[0003] A cryptographic device cluster can be likened to a bucket; the size of its key storage space can be likened to how much water the bucket can hold; the cryptographic device nodes can be likened to the planks that make up the bucket; the key storage space and cryptographic operation performance provided by the cryptographic device cluster are limited by the worst device node, which can be likened to how much water the bucket can hold depends on the length of its shortest plank; this type of problem is called the weakest link effect. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides a method for resolving the bottleneck effect of cryptographic device clusters, thereby solving the bottleneck effects of performance and key storage space in cryptographic device clusters.

[0005] A method for addressing the bottleneck effect of cryptographic device clusters includes:

[0006] S1: Register the information of the cryptographic device, which includes the cryptographic device ID and the cryptographic device key index;

[0007] S2: Determine the key storage space to be allocated based on the relationship between the cryptographic device ID and the cryptographic device key index, and match the key data required by the user with the key storage space to be allocated, so as to establish a lookup table of the relationship between cryptographic device ID, cryptographic device key index, key ID, user key index, and user ID.

[0008] S3: A dynamic routing table is established based on the relation lookup table. When the application makes a call, it calls the dynamic routing service through a network request. The dynamic routing service looks up the cryptographic device IP and cryptographic device key index corresponding to the request based on the network request and the dynamic routing table. Based on the cryptographic device IP and cryptographic device key index, it calls the corresponding key to perform relevant cryptographic operations.

[0009] Furthermore, the information of the cryptographic device mentioned in S1 includes: device type, manufacturer name, device model, key capacity, performance parameters, as well as the cryptographic device management proxy IP address and port, and the cryptographic device service proxy IP address and port.

[0010] Furthermore, the relationship between the cryptographic device ID and the cryptographic device key index in S2 is established by the registered cryptographic device information.

[0011] Furthermore, S2 includes filtering key IDs, user key indexes, and a list of data with empty user IDs as key storage space to be allocated when establishing a relationship, based on the relationship between the cryptographic device ID and the cryptographic device key index;

[0012] Furthermore, S2 also includes determining whether the key storage space to be allocated meets the key data required by the user. If it does, a corresponding number of key data are generated and loaded into the corresponding index key storage space in the corresponding cryptographic device according to the cryptographic device ID and cryptographic device key index of the key storage space to be allocated, and user key indexes are generated and allocated to the user in sequence.

[0013] Further, S3 includes S3.1: establishing a dynamic routing table based on the relation lookup table and the permission identifier App_AK of the user application calling key, wherein the dynamic routing table includes the permission identifier of the user application calling key, user ID, user key index, cryptographic device ID, cryptographic device key index, and cryptographic device IP.

[0014] Furthermore, S3 includes S3.2: When an application makes an invocation, it requests a dynamic routing service via the network. The dynamic routing service obtains the IP address of a cryptographic device that can be handled by the application invocation key in the network request, in conjunction with the dynamic routing table.

[0015] Furthermore, S3 includes S3.3: parsing the user key index in the request parameters, determining the cryptographic device key index that the application needs to use, and then determining the unique cryptographic device index through the loadable cryptographic device IP.

[0016] Furthermore, S3 includes S3.4: Based on the cryptographic device index, the dynamic routing service reconstructs the parameters of the application's request, transforms the key index, and then forwards the request according to the obtained cryptographic device IP. After receiving the request, the cryptographic device or cryptographic device service proxy can call the corresponding key to perform related cryptographic operations based on the transformed key index.

[0017] The beneficial effects of this invention include:

[0018] Cryptographic devices provide cryptographic operations, and when building a cluster, they are not limited by the key capacity and performance parameters of any single node, but only by the overall computing power of the cluster.

[0019] When cryptographic devices provide keys for cryptographic operations to the outside world, they can dynamically expand horizontally (key storage space) and vertically (cryptographic operation performance). When cryptographic devices are clustered, they can fully utilize all the key storage space of the devices. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating a method for addressing the bottleneck effect in cryptographic device clusters, as described in an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0022] Basic principle:

[0023] The cryptographic device as a whole is considered as the computational layer, in which the key is stateless for the cryptographic device.

[0024] The cryptographic device management agent and cryptographic device service agent serve as an adaptation layer, with unified key management (management layer) handled by the key management system and unified cryptographic device scheduling (load layer) handled by the dynamic routing service.

[0025] A method to address the bottleneck effect of cryptographic device clusters, such as Figure 1 As shown, it includes:

[0026] S1: Register the information of the cryptographic device, which includes the cryptographic device ID and the cryptographic device key index;

[0027] S2: Determine the key storage space to be allocated based on the relationship between the cryptographic device ID and the cryptographic device key index, and match the key data required by the user with the key storage space to be allocated, so as to establish a lookup table of the relationship between cryptographic device ID, cryptographic device key index, key ID, user key index, and user ID.

[0028] S3: A dynamic routing table is established based on the relation lookup table. When the application makes a call, it calls the dynamic routing service through a network request. The dynamic routing service looks up the cryptographic device IP and cryptographic device key index corresponding to the request based on the network request and the dynamic routing table. Based on the cryptographic device IP and cryptographic device key index, it calls the corresponding key to perform relevant cryptographic operations.

[0029] In another embodiment, the information of the cryptographic device in S1 includes: device type, manufacturer name, device model, key capacity, performance parameters, and the cryptographic device management proxy IP address and port, and the cryptographic device service proxy IP address and port.

[0030] In another embodiment, the relationship between the cryptographic device ID and the cryptographic device key index in S2 is established by the registered cryptographic device information.

[0031] In another embodiment, S2 includes, when establishing a relationship, filtering key IDs, user key indexes, and a list of data with empty user IDs as key storage space to be allocated based on the relationship between the cryptographic device ID and the cryptographic device key index;

[0032] In another embodiment, S2 further includes determining whether the key storage space to be allocated meets the key data required by the user. If it does, a corresponding number of key data are generated and loaded into the corresponding index key storage space in the corresponding cryptographic device according to the cryptographic device ID and cryptographic device key index of the key storage space to be allocated, and user key indexes are generated and allocated to the user in sequence.

[0033] In another embodiment, S3 includes S3.1: establishing a dynamic routing table based on the relation lookup table and the permission identifier App_AK of the user application calling key, wherein the dynamic routing table includes the permission identifier of the user application calling key, user ID, user key index, cryptographic device ID, cryptographic device key index, and cryptographic device IP.

[0034] In another embodiment, S3 includes S3.2: When an application makes an invocation, it requests a dynamic routing service via the network. The dynamic routing service obtains the IP address of a cryptographic device that can be handled by the application invocation key in the network request, in conjunction with the dynamic routing table.

[0035] In another embodiment, S3 includes S3.3: parsing the user key index in the request parameters, determining the cryptographic device key index that the application needs to use, and then determining the unique cryptographic device index through the loadable cryptographic device IP.

[0036] In another embodiment, S3 includes S3.4: Based on the cryptographic device index, the dynamic routing service reconstructs the parameters of the application's request, transforms the key index, and then forwards the request according to the obtained cryptographic device IP. After receiving the request, the cryptographic device or cryptographic device service proxy can call the corresponding key to perform related cryptographic operations based on the transformed key index.

[0037] Specifically, the implementation process is as follows:

[0038] S1. Register the cryptographic device information (including: device type, manufacturer name, device model, key capacity, performance parameters, as well as the cryptographic device management proxy IP address and port, and the cryptographic device service proxy IP address and port).

[0039] S2. Establish a lookup table for the relationships between cryptographic device ID, cryptographic device key index, key ID, user key index, and user ID, as shown in Table 1.

[0040] Table 1 Relationship Lookup Table

[0041]

[0042] 1) The data in the third column (cryptographic device ID) and the fourth column (index of the key stored internally in the cryptographic device) of this table can be determined and generated based on the registration information during the access process in step S1.

[0043] 2) When establishing a complete relationship, filter the data list from 1) to obtain a list of rows where the first, second, and fifth columns are empty. The resulting filtered data list represents the allocable key storage space.

[0044] 3) Based on the number of keys required by the user, determine whether the data list in 2) meets the requirement. If not, reject the user's request; if so, generate the corresponding number of key data, load it into the corresponding index key storage space in the corresponding cryptographic device according to the data list in 2) (create the third, fourth, and fifth columns of data), and generate the user key index in sequence and allocate it to the user (the first and second columns of data).

[0045] Specifically, during the relationship establishment process in step S2, multiple physical nodes can be dynamically combined into a single logical cluster node based on the user's key capacity requirements. Assuming the user requires 2 keys and each device has a key capacity of 1, the two cryptographic device physical nodes with DEV_IDs "7d9c1424-c491-4d11-8a61-e194a28ffb6d" and "636c1424-c491-4d11-8a61-e194a28ffb6d" shown in Table 2 will be combined into a logical cluster node with a key capacity of 2. For the user, this means having two keys with IDs "d5b620b7-595e-4cb3-b909-01c7452b9dad" and "69254cd8-6f2a-4703-8692-f7e242cadcac," which are consecutive and unique, with indices "1" and "2" respectively.

[0046] Table 2. Dynamically assembled single logical cluster points

[0047]

[0048] Assuming the key storage space of the cryptographic device is 1, the two devices can be combined into a logical node with a key storage space of 2 in the above way. The logical node can be continuously replicated in the same way to form a logical cluster A, as shown in Table 3 (including logical node 1 and node 2).

[0049] Table 3 contains logical cluster A with multiple logical nodes.

[0050]

[0051]

[0052] The above method enables dynamic expansion of key space and cryptographic operation performance on a single node, without being limited by the physical factors of a single cryptographic device node.

[0053] S3.1 Implement dynamic routing service and establish a dynamic routing table, as shown in Table 4.

[0054] Specifically, it is assumed by default that cryptographic devices can be called via the network (DEV_IP is the cryptographic device IP). If only local calls are supported, a cryptographic device service proxy is implemented to make network calls, in which case DEV_IP is the cryptographic device service proxy IP.

[0055] Table 4 Dynamic Routing Table

[0056]

[0057] The second, third, fourth, and fifth columns of this table are generated by steps S1 and S2. The first column, APP_AK, serves as the permission identifier for the user application's access key.

[0058] It is generated after the user assigns which applications use which keys.

[0059] S3.2. When the application makes a call, it requests the dynamic routing service via the network. The dynamic routing service obtains the list of loadable DEV_IPs based on the APP_AK parameter in the request. Taking the APP_AK "345cdc79-d461-4b45-8618-1496e66d568b" in Table 4 as an example, as shown in Table 5:

[0060] Table 5. Correspondence between APP_AK parameters and loadable DEV_IPs

[0061] App_AK DEV_IP 345cdc79-d461-4b45-8618-1496e66d568b 192.168.0.2 345cdc79-d461-4b45-8618-1496e66d568b 192.168.0.3

[0062] As shown in the table above, the application's requests can be load-balanced to "192.168.0.2" and "192.168.0.3". Common load balancing rules, such as round-robin, random, and weighted, will determine the appropriate IP address for this request. For example, the load balancing rules might determine that the request should be routed to the cryptographic device or cryptographic device service proxy on "192.168.0.2".

[0063] S3.3. Parse the User_Index (user key index) in the request parameters, assuming it is "1". Determine the key index that the application needs to use, and then, using the IP address (192.168.0.2) determined in S4, identify the following unique row of data, as shown in Table 6;

[0064] Table 6 Unique key information determined through network request.

[0065] App_AK User_Index DEV_IP Dev_Index 345cdc79-d461-4b45-8618-1496e66d568b 1 192.168.0.2 11

[0066] S3.4. Based on this data, the key is stored at index 11 in the cryptographic device corresponding to 192.168.0.2. Therefore, the dynamic routing service reconstructs the application's request parameters, changing the key index parameter from "1" to "11", and then forwards the request according to "192.168.0.2" obtained in S4. After receiving the request, the cryptographic device or cryptographic device service agent can use the corresponding key to perform relevant cryptographic operations based on index "11".

[0067] The embodiments described above merely illustrate specific implementation methods of this application, and while the descriptions are detailed and specific, they should not be construed as limiting the scope of protection of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the technical solution of this application, and these modifications and improvements all fall within the scope of protection of this application.

Claims

1. A method for addressing the bottleneck effect in cryptographic device clusters, characterized in that, include: S1: Register the information of the cryptographic device, which includes the cryptographic device ID and the cryptographic device key index; S2: Determine the key storage space to be allocated based on the relationship between the cryptographic device ID and the cryptographic device key index, and match the key data required by the user with the key storage space to be allocated, so as to establish a lookup table of the relationship between cryptographic device ID, cryptographic device key index, key ID, user key index, and user ID. S3: A dynamic routing table is established based on the relation lookup table. When the application calls the dynamic routing service through a network request, the dynamic routing service looks up the corresponding cryptographic device IP and cryptographic device key index based on the network request and the dynamic routing table, and calls the corresponding key to perform relevant cryptographic operations based on the cryptographic device IP and cryptographic device key index. S3 includes S3.1: establishing a dynamic routing table based on the relation lookup table and the permission identifier of the user application calling key, wherein the dynamic routing table includes the permission identifier of the user application calling key, user ID, user key index, cryptographic device ID, cryptographic device key index, and cryptographic device IP; S2 includes: when establishing a relationship, filtering the key ID, user key index, and data list of empty user IDs as key storage space to be allocated by the relationship between the cryptographic device ID and the cryptographic device key index; S2 also includes determining whether the key storage space to be allocated meets the key data required by the user. If it does, a corresponding number of key data are generated and loaded into the corresponding index key storage space in the corresponding cryptographic device according to the cryptographic device ID and cryptographic device key index of the key storage space to be allocated, and user key indexes are generated and allocated to the user in sequence.

2. The method for solving the bottleneck effect of cryptographic device clusters according to claim 1, characterized in that, The information about the cryptographic device described in S1 also includes: device type, manufacturer name, device model, key capacity, performance parameters, and the IP address and port of the cryptographic device management agent.

3. The method for solving the bottleneck effect of cryptographic device clusters according to claim 1, characterized in that, The relationship between the cryptographic device ID and the cryptographic device key index in S2 is established by the registered cryptographic device information.

4. The method for solving the bottleneck effect of cryptographic device clusters according to claim 1, characterized in that, S2 includes: When establishing a relationship, the key ID, user key index, and a list of data with an empty user ID are filtered by the relationship between the cryptographic device ID and the cryptographic device key index as the key storage space to be allocated.

5. The method for solving the bottleneck effect of cryptographic device clusters according to claim 1, characterized in that, S2 also includes determining whether the key storage space to be allocated meets the key data required by the user. If it does, a corresponding number of key data are generated and loaded into the corresponding index key storage space in the corresponding cryptographic device according to the cryptographic device ID and cryptographic device key index of the key storage space to be allocated, and user key indexes are generated and allocated to the user in sequence.

6. A method for solving the bottleneck effect of cryptographic device clusters according to any one of claims 1-5, characterized in that, S3 includes S3.2: When an application makes a call, it requests a dynamic routing service through the network. The dynamic routing service obtains the IP address of a cryptographic device that can be handled by the network by combining the permission identifier of the user's application call key in the network request with the dynamic routing table.

7. A method for solving the bottleneck effect of cryptographic device clusters according to any one of claims 1-5, characterized in that, S3 includes S3.3: parsing the user key index in the request parameters, determining the cryptographic device key index that the application needs to use, and then determining the unique cryptographic device index through the loadable cryptographic device IP.

8. A method for solving the bottleneck effect of cryptographic device clusters according to any one of claims 1-5, characterized in that, S3 includes S3.4: Based on the cryptographic device index, the dynamic routing service reconstructs the parameters of the application's request, transforms the key index, and then forwards the request according to the obtained cryptographic device IP. After receiving the request, the cryptographic device or cryptographic device service proxy can call the corresponding key to perform related cryptographic operations based on the transformed key index.

Images