Encryption configuration method and system, electronic equipment and storage medium

Abstract

The invention provides an encryption configuration method and system, electronic equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: in response to an obtained encryption configuration request of a user, creating an encryption service instance, establishing a communication connection between the encryption service instance and the security management platform, and distributing the encryption service instance for the user, the encryption service instance being used for managing encryption and decryption operations of each business system, an encryption and decryption management platform is provided for each service system, unified configuration of encryption and decryption of each service system of a user is realized, and the complexity of respective configuration for each service system is avoided to a certain extent; furthermore, the virtual computing resources are allocated to the encryption service instance, so that the encryption service instance calls the virtual computing resources to perform encryption and decryption operation, and the problem that management and configuration are not concise when hardware encryption equipment is configured for each business system to provide computing resources is avoided.

Description

Technical Field

[0001] The present disclosure belongs to the field of communication technology, and particularly relates to an encryption configuration method, system, electronic device, and storage medium. Background Art

[0002] Cloud applications are software deployed on cloud servers. Terminals access the corresponding cloud applications on cloud servers through the network. Cloud applications offer a variety of business systems, each with its own unique encryption method.

[0003] In related technologies, users are usually required to manually configure encryption parameters for each business system. Since different business systems use different encryption methods and different encryption methods correspond to different hardware encryption devices, the management and configuration of hardware encryption devices are not simple. Summary of the Invention

[0004] The present disclosure provides an encryption configuration method, system, electronic device and storage medium.

[0005] A first embodiment of the present disclosure provides an encryption configuration method, which is applied to a security management platform. The method includes:

[0006] In response to receiving the user's encryption configuration request, create an encryption service instance and establish a communication connection between the encryption service instance and the security management platform, wherein the encryption service instance is used to manage encryption and decryption operations of each business system corresponding to the user;

[0007] Allocate virtual computing resources to the encryption service instance so that the encryption service instance calls the virtual computing resources to perform encryption and decryption operations.

[0008] In the embodiment of the present disclosure, the step of creating an encryption service instance and establishing a communication connection between the encryption service instance and the security management platform includes:

[0009] Calling the middleware management instance to create an encryption service instance in the isolated computing environment where the user's business system is located;

[0010] An elastic public IP is bound to the encryption service instance, and the security management platform communicates with the encryption service instance based on the elastic public IP.

[0011] In an embodiment of the present disclosure, the encryption configuration request further includes encryption configuration parameters, and the method further includes:

[0012] The encryption configuration parameters are sent to the encryption service instance via the elastic public IP, so that the encryption service instance configures the encryption and decryption operation parameters of the business system based on the encryption configuration parameters.

[0013] In an embodiment of the present disclosure, allocating virtual computing resources to the encryption service instance includes:

[0014] Based on the initial number of servers corresponding to each business system of the user, virtual computing resources corresponding to the initial number of servers are allocated to the encryption service instance.

[0015] In an embodiment of the present disclosure, the virtual computing resources include the number of virtual cryptographic machines, and the method further includes:

[0016] In response to obtaining the adjusted number of servers of the business system, determining a ratio of the adjusted number of servers to the initial number of servers;

[0017] If the ratio is greater than a preset ratio threshold, the product of the ratio and the number of virtual cipher machines is used as the number of virtual cipher machines to adjust;

[0018] If the adjustment direction is to increase, the number of virtual cipher machines corresponding to the business system is increased based on the adjusted number of virtual cipher machines; if the adjustment direction is to decrease, the number of virtual cipher machines corresponding to the business system is reduced based on the adjusted number of virtual cipher machines.

[0019] In an embodiment of the present disclosure, the method further includes:

[0020] Obtaining a request for establishing identity verification; the request for establishing identity verification includes user identity information;

[0021] Based on the identity authentication request, the user identity information is sent to a preset gateway, so that the preset gateway verifies the user's access request based on the user identity information.

[0022] In an embodiment of the present disclosure, the method further includes:

[0023] In response to obtaining the encryption configuration cancellation request, the middleware management instance is called to delete the encryption service instance created corresponding to the business system; and the virtual computing resources allocated to the encryption service instance are adjusted.

[0024] An embodiment of a second aspect of the present disclosure provides an encryption configuration system, the encryption configuration system including a business system, a management system, the management system including a security management platform, a middleware management instance, and a virtual computing resource set;

[0025] The business system is configured to, in response to obtaining an encryption configuration request from a user, send the encryption configuration request to the security management platform;

[0026] The security management platform is used to call the middleware management instance to create an encryption service instance for the user in response to obtaining the user's encryption configuration request, and establish a communication connection between the encryption service instance and the security management platform. The encryption service instance is used to manage the encryption and decryption operations of each business system corresponding to the user; virtual computing resources are allocated to the encryption service instance from the virtual computing resource set so that the encryption service instance calls the virtual computing resources to perform encryption and decryption operations.

[0027] An embodiment of a third aspect of the present disclosure provides an encryption configuration device, which is applied to a security management platform. The device includes:

[0028] An instance creation module is configured to create an encryption service instance in response to an encryption configuration request from a user, and establish a communication connection between the encryption service instance and the security management platform. The encryption service instance is used to manage encryption and decryption operations of each business system corresponding to the user;

[0029] The resource allocation module is used to allocate virtual computing resources to the encryption service instance so that the encryption service instance calls the virtual computing resources to perform encryption and decryption operations.

[0030] An embodiment of the fourth aspect of the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect or any optional embodiment of the first aspect.

[0031] An embodiment of the fifth aspect of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method described in the first aspect or any optional implementation manner of the first aspect.

[0032] The technical solutions provided in the embodiments of the present disclosure have at least the following technical effects or advantages:

[0033] In response to obtaining an encryption configuration request from a user, the disclosed embodiment creates an encryption service instance, establishes a communication connection between the encryption service instance and the security management platform, and allocates an encryption service instance to the user. The encryption service instance is used to manage the encryption and decryption operations of each business system, provides an encryption and decryption management platform for each business system, and realizes unified configuration of encryption and decryption of each business system of the user, avoiding to a certain extent the tediousness of configuring each business system separately; further, virtual computing resources are allocated to the encryption service instance so that the encryption service instance calls the virtual computing resources to perform encryption and decryption operations, avoiding the problem of configuring hardware encryption devices for each business system separately to provide unsophisticated management and configuration of computing resources.

[0034] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will become apparent from the following description or learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Various other advantages and benefits will become apparent to those skilled in the art by reading the detailed description of the preferred embodiment below. The accompanying drawings are only for the purpose of illustrating the preferred embodiment and are not to be considered as limiting the present disclosure. In addition, the same reference numerals are used throughout the accompanying drawings to represent the same components.

[0036] In the attached figure:

[0037] Figure 1 A schematic diagram of the structure of an encryption configuration system provided by an embodiment of the present disclosure is shown;

[0038] Figure 2 A flowchart of an encryption configuration method provided by an embodiment of the present disclosure is shown;

[0039] Figure 3 A schematic structural diagram of an encryption configuration device provided by another embodiment of the present disclosure is shown;

[0040] Figure 4 A schematic structural diagram of an electronic device provided by an embodiment of the present disclosure is shown;

[0041] Figure 5 A schematic diagram of a storage medium provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0042] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0043] It should be noted that, unless otherwise specified, the technical or scientific terms used in the present disclosure should have the common meanings understood by those skilled in the art to which the present disclosure belongs.

[0044] The following introduces the implementation scenarios and related technologies involved in the embodiments of the present disclosure.

[0045] With the development of computer networks, cloud applications are being used in all aspects of work and life. Cloud applications are application software deployed on cloud servers. Terminals access the corresponding cloud applications on cloud servers through the network. Cloud applications provide various business systems, each with different encryption methods.

[0046] To ensure the security of cloud applications, tenants are often required to manually configure encryption parameters for different business systems within the same tenant. This is because different business systems employ different encryption methods, and each method requires different hardware devices. Therefore, when configuring encryption and decryption for each business system, tenants must configure hardware devices and set the corresponding encryption and decryption parameters for each hardware device. If a business system with configured encryption and decryption parameters no longer requires encryption, the tenant must manually deactivate the corresponding configuration, leaving the corresponding hardware redundant and idle, resulting in a significant waste of resources.

[0047] In view of this, the embodiments of the present disclosure provide an encryption configuration method, system, electronic device, and storage medium. The technical solutions of the present disclosure are described in detail below using specific embodiments. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The embodiments of the present disclosure will be described below in conjunction with the accompanying drawings.

[0048] See also Figure 1 , Figure 1 The following is a schematic diagram of an exemplary system structure of the encryption configuration system provided by the present disclosure. The encryption configuration system provided by the present disclosure includes a server 10 and a client 11, and the server 10 and the client 11 communicate with each other through a network. The client can be hardware, such as electronic devices such as mobile phones, personal computers, tablets, wearable devices, etc.; it can also be an application (Application, APP) or software module deployed on the electronic device. The server 10 can be an independent physical server, or a server cluster composed of multiple physical servers, a distributed system or a cloud platform. The server 10 can deploy resources and computing power.

[0049] The encryption configuration system provided in the embodiment of the present disclosure is deployed on the server 10. The access system provided in the present disclosure includes at least one business system 101 and a management system 102. The management system 102 includes a security management platform 1021, a middleware management instance 1022, and a virtual computing resource set 1023.

[0050] Business system 101, in response to receiving a user's encryption configuration request, sends the encryption configuration request to security management platform 1021. After receiving the encryption configuration request, security management platform 1021 calls middleware management instance 1022 to create an encryption service instance and establishes a communication connection between the encryption service instance and security management platform 1021, allowing security management platform 1021 to subsequently communicate and manage the encryption service instance. This encryption service instance manages encryption and decryption operations for the user's business system 101. Based on this information, security management platform 1021 allocates corresponding virtual computing resources from virtual computing resource set 1023 to the encryption service instance based on information such as the scale of business system 101, allowing the encryption service instance to use the allocated virtual computing resources for encryption and decryption operations.

[0051] Based on the above content, the business system 101 can also request the security management platform 1021 to configure the access rights of the business system 101. The security management platform 1021 sends the user identity information corresponding to the business system 101 to the gateway based on the request, so that the gateway can authenticate the access request based on the user identity information, wherein the user identity information can be the client address pool, Internet Protocol (IP) access interface and other information; the gateway can be a virtual private network (VPN) gateway, which is a virtual private network product with a general cryptographic algorithm, used to ensure the security of data transmission and ensure the confidentiality, integrity and availability of communications.

[0052] It is understood that the structure of the example of the present disclosure does not constitute a specific limitation on the encryption configuration system. In other embodiments of the present disclosure, the encryption configuration system may include Figure 1 The above-mentioned algorithms and networks included in each analysis module are illustrative examples of the present disclosure and do not limit the modules in the embodiments of the present disclosure. Those skilled in the art can flexibly deploy the algorithms included in each module in the embodiments of the present disclosure according to actual circumstances. This is not a limitation here.

[0053] The following combination Figure 1 The following is an illustrative embodiment to describe an encryption configuration method proposed according to an embodiment of the present disclosure. Figure 2 As shown, the embodiments of the present disclosure provide an encryption configuration method that can be applied to a security management platform that can centrally manage and control security-related systems, and can create, configure, monitor, and maintain encryption service instances to ensure the security and reliability of the entire encryption environment. The method includes:

[0054] In step S21, in response to obtaining the user's encryption configuration request, an encryption service instance is created, and a communication connection between the encryption service instance and the security management platform is established.

[0055] Among them, the encryption service instance is used to manage the encryption and decryption operations of each business system corresponding to the user.

[0056] Exemplarily, for any tenant, the tenant may include at least one business system. For example, if a tenant is a company, the business systems are the different departments corresponding to the company, which may be the Finance Department, the Human Resources Department, etc. In the embodiments of this disclosure, a business system is used as an example for introduction. The user (tenant) may be the staff member corresponding to the tenant, who sends an encryption configuration request to the security management platform through the client. The request usually contains specific information about the user's encryption requirements for each business system, such as encryption algorithm, key length, etc.

[0057] Based on the encryption configuration request, the security management platform creates an encryption service instance and configures relevant encryption rules and parameters. The encryption service instance has independent encryption and decryption operation capabilities and is responsible for managing the encryption and decryption operations of the user's corresponding business systems, including key generation, encryption, and decryption operations.

[0058] During implementation, the security management platform can provide an interface through which users submit encryption configuration requests. This interface can be, for example, an Application Programming Interface (API). Received requests can be parsed and validated to ensure they are formatted correctly and meet security requirements. Based on the parsed encryption configuration request, an encryption service instance is generated. A unique identifier can also be assigned to the encryption service instance for subsequent management and identification.

[0059] In an embodiment of the present disclosure, in step S21, an encryption service instance is created, and a communication connection is established between the encryption service instance and the security management platform. This can be achieved in the following ways: calling a middleware management instance to create an encryption service instance in an isolated computing environment where the user's business system is located; binding an elastic public IP to the encryption service instance, and the security management platform communicates with the encryption service instance based on the elastic public IP.

[0060] For example, a middleware management instance is a software component used to manage and coordinate various middleware services. It typically runs in an independent environment and is responsible for creating, configuring, and managing other service instances. In the disclosed embodiments, it is used to configure and manage encryption service instances. The middleware management instance can deploy and start service instances in a specified environment (e.g., an isolated computing environment). The isolated computing environment is the computing environment deployed by the business system, and the corresponding encryption service instance can be deployed in the computing environment corresponding to the business system.

[0061] The security management platform sends a request to the middleware management instance, specifying a request to create an encryption service instance in an isolated computing environment. After receiving the request, the middleware management instance parses the parameters in the request (such as encryption algorithm, key configuration, business system identifier, etc.).

[0062] Based on the parsed parameters, the middleware management instance initiates the creation of an encryption service instance in the isolated computing environment. It configures the resources of the isolated computing environment, which can include CPU, memory, storage, and other resources, and installs and starts the encryption service software. The encryption service instance runs in the isolated computing environment, ensuring that its communication with the outside world is restricted and that it communicates only with the security management platform through the elastic public network. The middleware management instance assigns an elastic public IP address to the encryption service instance or configures a network connection to enable it to communicate with the external network. This ensures that only the security management platform can communicate with the encryption service instance through the elastic public network, and that other unauthorized access is blocked. The encryption service instance establishes a secure communication channel with the security management platform through the elastic public network.

[0063] The encryption configuration request may also include encryption configuration parameters, where the encryption configuration parameters may be information such as the encryption algorithm type, key length, key generation method (automatically generated or user-specified), business system identifier, etc. The encryption algorithm type may be Advanced Encryption Standard (AES) and RSA (Rivest Shamir Adleman) public key cryptography system.

[0064] Therefore, after creating the encryption service instance, the encryption configuration parameters are sent to the encryption service instance through the elastic public network, so that the encryption service instance configures the encryption and decryption operation parameters of the business system based on the encryption configuration parameters.

[0065] For example, the security management platform sends encryption configuration parameters to the encryption service instance via the elastic public network. The encryption service instance can parse and verify the received configuration parameters to ensure that the parameters are formatted correctly and meet security requirements. For example, it checks whether the key length meets the algorithm requirements and whether the encryption mode is supported.

[0066] The cryptographic service instance initializes the parameters required for encryption and decryption operations based on the parsed encryption configuration parameters. For example, if the configuration specifies automatic key generation, the cryptographic service instance generates a key and stores it securely. Alternatively, if a user provides a key, the service instance can verify the key (such as checking its length and format) and store it, then load the specified encryption algorithm based on the encryption configuration parameters.

[0067] In step S22, virtual computing resources are allocated to the encryption service instance so that the encryption service instance calls the virtual computing resources to perform encryption and decryption operations.

[0068] For example, after creating a cryptographic service instance, it is used to perform encryption and decryption operations for the encryption and decryption algorithms corresponding to the business system. These operations require computing resources. If these operations utilize the computing resources corresponding to the business system, they will compete with the business system's own operations, leading to resource constraints. Furthermore, the computing resources corresponding to the business system may not be able to support specific encryption and decryption operations.

[0069] Therefore, in the embodiment of the present disclosure, the above problem is solved by allocating virtual computing resources to the encryption service instance in step S22. Different types of business systems correspond to different encryption and decryption operations, so when allocating virtual computing resources, it can be allocated according to the scale of the business system.

[0070] Correspondingly, the scale of the business system can be the number of servers in the corresponding service end. In some embodiments, virtual computing resources are allocated to the encryption service instance, including: based on the initial number of servers corresponding to each user's business system, virtual computing resources corresponding to the initial number of servers are allocated to the encryption service instance.

[0071] For example, the initial number of servers required by each business system can be obtained from the configuration information of the user or the business system. This information can be obtained through user input, configuration files, or automated tools.

[0072] Calculate the total amount of virtual computing resources required based on the initial number of servers. Use virtualization management tools (such as VMware vSphere and OpenStack) to allocate virtual computing resources to the encryption service instances.

[0073] During the operation of a cryptographic service instance, virtual computing resources are dynamically adjusted based on the actual load of the business system. For example, if the number of servers corresponding to a business system increases, the number of virtual computing resources, that is, the number of virtual cryptographic machines, can be increased to support the encryption and decryption operations of the business system. If the number of servers corresponding to a business system decreases, excess resources can be dynamically released to optimize resource utilization.

[0074] In some further embodiments, the virtual computing resources include the number of virtual cipher machines, and the method further includes: in response to obtaining the adjusted number of servers of the business system, determining the ratio of the adjusted number of servers to the initial number of servers; if the ratio is greater than a preset ratio threshold, multiplying the ratio by the number of virtual cipher machines as the adjusted number of virtual cipher machines; if the adjusted number of servers is to increase the number of servers, then based on the adjusted number of virtual cipher machines, the number of virtual cipher machines corresponding to the business system is increased; if the adjusted number of servers is to reduce the number of servers, then based on the adjusted number of virtual cipher machines, the number of virtual cipher machines corresponding to the business system is reduced.

[0075] For example, adjusting the number of servers in a business system refers to increasing or decreasing the number of servers based on actual demand during the operation of the business system. For example, a business system may need to add servers due to an increase in load, or reduce servers due to a decrease in load. The adjusted number of servers is calculated based on the number of servers at the time of initial deployment of the business system, or based on the number of servers before the adjustment, that is, the number of servers completed in the last adjustment. The ratio refers to the ratio of the adjusted number of servers to the initial number of servers, which is used to measure the degree of change in the number of servers.

[0076] Obtain information about changes in the current number of servers through the business system's monitoring tools or management interface, or through information about changes in the number of servers sent by users. For example, the business system may report its current number of servers to the management platform through an API.

[0077] Calculate the adjusted number of servers, that is, the difference between the current number of servers and the initial number of servers. Calculate the ratio of the adjusted number of servers to the initial number of servers. Compare the calculated ratio with a preset ratio threshold. If the ratio is greater than the preset ratio threshold, the adjustment of the number of virtual cipher machines is triggered. If the ratio is greater than the preset ratio threshold, the adjusted number of virtual cipher machines is calculated as the ratio multiplied by the current number of virtual cipher machines, that is, the number of virtual cipher machines allocated to the user is adjusted, and the specific adjustment number is the ratio multiplied by the current number of virtual cipher machines. The virtual cipher machine can be a physical cipher machine that uses virtualization technology to virtualize computing resources into multiple virtual cipher machines for allocating virtual resources to the user's corresponding business system.

[0078] Depending on whether the adjustment direction is to increase or decrease, the following operations are performed respectively: If the number of servers is adjusted to increase, the number of virtual cipher machines corresponding to the business system is increased according to the adjustment of the number of virtual cipher machines. If the number of servers is adjusted to decrease, the number of virtual cipher machines corresponding to the business system is reduced according to the adjustment of the number of virtual cipher machines. Use virtualization management tools (such as VMware vSphere, OpenStack, etc.) to dynamically adjust the number of virtual cipher machines. For example, the number adjustment is achieved by creating a new virtual cipher machine instance or deleting an existing virtual cipher machine instance. Through the above embodiment, the number of virtual cipher machines can be dynamically adjusted to adapt to changes in the number of business system servers, ensuring a balance between system performance and resource utilization.

[0079] Based on the above embodiments, the embodiments of the present disclosure may also include: obtaining an identity authentication request; establishing an identity authentication request including user identity information; based on the identity authentication request, sending the user identity information to a preset gateway, so that the preset gateway verifies the user's access request based on the user identity information.

[0080] For example, an authentication request is initiated by a user through a client to verify their identity. User identity information may include username, password, fingerprint, facial recognition data, and digital certificate. In the disclosed embodiment, the pre-set gateway may be a national security VPN gateway. An access request is a user's attempt to access a business system. The legitimacy of the access request must be verified through authentication by the pre-set gateway.

[0081] The user initiates an authentication request through a client device (such as a browser, mobile app, or dedicated client software). The client device encapsulates this identity information into an authentication request and sends it to the security management platform. The security management platform sends the user's identity information to the pre-set gateway. Upon receiving the authentication request, the pre-set gateway parses the user's identity information. The pre-set gateway sets the relevant user's identity information based on the configured authentication policy (such as username and password verification, digital certificate verification, multi-factor authentication, etc.). This information is then used to verify the user's identity when the user attempts to access the system again.

[0082] In actual application, if the subsequent related encrypted business system does not need encryption, then in response to obtaining a request to cancel the encryption configuration, the middleware management instance can be called to delete the encryption service instance corresponding to the business system; and adjust the virtual computing resources allocated to the encryption service instance.

[0083] Exemplarily, a request to cancel an encryption configuration refers to a request initiated by a user through a client to cancel the corresponding encryption configuration. This encryption configuration may include the encryption configuration of one of the multiple business systems corresponding to the user, or the overall encryption configuration corresponding to the user. Typically, a user corresponds to an encryption service instance, which manages multiple business systems. If the encryption configuration of one of the business systems is to be canceled, the request to cancel the encryption configuration may typically include the identification information of the business system, allowing the security management platform to determine which business system's encryption configuration needs to be canceled and to adjust the number of virtual computing resources based on the size of the resources occupied by the business system. If the overall encryption configuration corresponding to the user is to be canceled, the encryption service instance may be deleted, and the virtual computing resources corresponding to the encryption service instance may be deleted.

[0084] The middleware management instance is called to request the deletion of the encryption service instance corresponding to the business system. After receiving the request, the middleware management instance searches for the encryption service instance associated with the business system. After finding the encryption service instance associated with the business system, the middleware management instance performs the deletion operation. For example, the configuration information of the encryption service instance can be deleted to release the resources occupied by the encryption service instance (such as ports and network connections). The security management platform searches for the virtual computing resources allocated to the business system and releases these virtual computing resources, including virtual CPU, memory, and storage.

[0085] In summary, the embodiment of the present disclosure creates an encryption service instance in response to obtaining the user's encryption configuration request, establishes a communication connection between the encryption service instance and the security management platform, and allocates an encryption service instance to the user. The encryption service instance is used to manage the encryption and decryption operations of each business system, provides an encryption and decryption management platform for each business system, and realizes the unified configuration of encryption and decryption of each business system of the user, which to a certain extent avoids the tediousness of configuring each business system separately; further, virtual computing resources are allocated to the encryption service instance so that the encryption service instance calls the virtual computing resources for encryption and decryption operations, avoiding the problem of configuring hardware encryption devices for each business system to provide unsophisticated management and configuration of computing resources.

[0086] correspond Figure 3 The embodiment of the present disclosure also provides an encryption configuration device, which can be deployed in Figure 1 The security management platform 1021 is used to perform operations of the encryption configuration method, such as Figure 3 As shown, the device includes:

[0087] An instance creation module 301 is configured to create an encryption service instance in response to an encryption configuration request from a user, and establish a communication connection between the encryption service instance and the security management platform. The encryption service instance is used to manage encryption and decryption operations of each business system corresponding to the user.

[0088] The resource allocation module 302 is configured to allocate virtual computing resources to the encryption service instance so that the encryption service instance calls the virtual computing resources to perform encryption and decryption operations.

[0089] The encryption configuration device provided in the above-mentioned embodiment of the present disclosure and the encryption configuration method provided in the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0090] The present disclosure also provides an electronic device to perform the above encryption configuration method. Figure 4 , which shows a schematic diagram of an electronic device provided by some embodiments of the present disclosure. Figure 4 As shown, the electronic device 4 includes: a processor 400, a memory 401, a bus 402 and a communication interface 403, and the processor 400, the communication interface 403 and the memory 401 are connected via the bus 402; the memory 401 stores a computer program that can be run on the processor 400, and when the processor 400 runs the computer program, it executes the encryption configuration method provided by any of the aforementioned embodiments of the present disclosure.

[0091] The memory 401 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage. Communication between the virtual devices of the system is achieved through at least one communication interface 403 (which may be wired or wireless), and may use the Internet, a wide area network, a local area network, a metropolitan area network, etc.

[0092] Bus 402 may be an ISA bus, a PCI bus, or an EISA bus. The bus may be divided into an address bus, a data bus, a control bus, etc. Memory 401 is used to store programs, and processor 400 executes the programs upon receiving execution instructions. The encryption configuration method disclosed in any of the aforementioned embodiments of the present disclosure may be applied to processor 400 or implemented by processor 400.

[0093] The processor 400 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method may be completed by hardware integrated logic circuits or software instructions in the processor 400. The processor 400 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It may implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present disclosure may be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory 401 , and the processor 400 reads the content in the memory 401 and completes the steps of the above method in combination with its hardware.

[0094] The electronic device provided by the embodiment of the present disclosure and the encryption configuration method provided by the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented by them.

[0095] The present disclosure also provides a computer-readable storage medium corresponding to the encryption configuration method provided in the above embodiment. Figure 5 The computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a microprocessor, it executes the encryption configuration method provided by any of the aforementioned embodiments.

[0096] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0097] The computer-readable storage medium provided by the above-mentioned embodiment of the present disclosure and the encryption configuration method provided by the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0098] Although the optional embodiments of the present disclosure have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiment and all changes and modifications that fall within the scope of the present disclosure.

[0099] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present disclosure in detail. It should be understood that the above description is only a specific implementation method of the present disclosure and is not intended to limit the scope of protection of the present disclosure. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the present disclosure should be included in the scope of protection of the present invention.

Claims

1. An encryption configuration method, characterized in that: Applied to a security management platform, the method includes: In response to receiving the user's encryption configuration request, create an encryption service instance and establish a communication connection between the encryption service instance and the security management platform, wherein the encryption service instance is used to manage encryption and decryption operations of each business system corresponding to the user; Allocate virtual computing resources to the encryption service instance so that the encryption service instance calls the virtual computing resources to perform encryption and decryption operations.

2. The method according to claim 1, characterized in that The step of creating an encryption service instance and establishing a communication connection between the encryption service instance and the security management platform includes: Calling the middleware management instance to create an encryption service instance in the isolated computing environment where the user's business system is located; An elastic public IP is bound to the encryption service instance, and the security management platform communicates with the encryption service instance based on the elastic public IP.

3. The method according to claim 2, characterized in that The encryption configuration request further includes encryption configuration parameters, and the method further includes: The encryption configuration parameters are sent to the encryption service instance through the elastic public IP, so that the encryption service instance configures the encryption and decryption operation parameters of the business system based on the encryption configuration parameters.

4. The method according to claim 1, wherein The allocating virtual computing resources to the encryption service instance includes: Based on the initial number of servers corresponding to each business system of the user, virtual computing resources corresponding to the initial number of servers are allocated to the encryption service instance.

5. The method according to claim 4, characterized in that The virtual computing resources include the number of virtual cryptographic machines, and the method further includes: In response to obtaining the adjusted number of servers of the business system, determining a ratio of the adjusted number of servers to the initial number of servers; If the ratio is greater than a preset ratio threshold, the product of the ratio and the number of virtual cipher machines is used as the number of virtual cipher machines to adjust; If the adjustment direction is to increase, the number of virtual cipher machines corresponding to the business system is increased based on the adjusted number of virtual cipher machines; if the adjustment direction is to decrease, the number of virtual cipher machines corresponding to the business system is reduced based on the adjusted number of virtual cipher machines.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Obtaining a request for establishing identity verification; the request for establishing identity verification includes user identity information; Based on the identity authentication request, the user identity information is sent to a preset gateway, so that the preset gateway verifies the user's access request based on the user identity information.

7. The method according to any one of claims 1 to 5, characterized in that The method further comprises: In response to obtaining the encryption configuration cancellation request, the middleware management instance is called to delete the encryption service instance created corresponding to the business system; and the virtual computing resources allocated to the encryption service instance are adjusted.

8. An encryption configuration system, characterized in that: The encryption configuration system includes a business system, a management system, and the management system includes a security management platform, a middleware management instance, and a virtual computing resource set; The business system is configured to, in response to obtaining an encryption configuration request from a user, send the encryption configuration request to the security management platform; The security management platform is used to call the middleware management instance to create an encryption service instance for the user in response to obtaining the user's encryption configuration request, and establish a communication connection between the encryption service instance and the security management platform. The encryption service instance is used to manage the encryption and decryption operations of each business system corresponding to the user; virtual computing resources are allocated to the encryption service instance from the virtual computing resource set so that the encryption service instance calls the virtual computing resources to perform encryption and decryption operations.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images