Cryptographic operation device control method and electronic equipment

Abstract

The invention discloses a password operation device control method and electronic equipment, and relates to the technical field of passwords. When a password operation device is accessed, password operation device registration information created for the password operation device at least comprises calling parameters of a password service dynamic library, key type mapping information and key mechanism mapping information; the key type mapping information is mapping information between a general key type identifier and a private key type identifier of the cryptographic operation device, and the key mechanism mapping information is used for recording a conversion relationship between a general key mechanism and a private key mechanism of the cryptographic operation device; according to the method, the unified cryptographic operation device calling interface and the universal calling parameter are provided for the upper-layer application program, the difference of different cryptographic operation devices is shielded, the upper-layer application only needs to call the cryptographic operation device calling interface to transmit the universal first task parameter, and calling of the different cryptographic operation devices can be achieved; and the difficulty of using different cryptographic operation devices by the equipment is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cryptography, in particular to a cryptographic operation device control method and an electronic device. BACKGROUND

[0002] With the development of cryptography, different keys or even different types of keys are often required when performing tasks such as encryption and decryption, signature and signature verification, and many cryptographic operation devices for performing cryptographic operations have emerged in the field. In order to use different types of keys, different cryptographic operation devices need to be installed on the device, and different cryptographic operation device manufacturers have also developed expansion functions of cryptographic operation devices, resulting in great development and adaptation difficulty when a new cryptographic operation device is connected.

[0003] How to reduce the adaptation difficulty when the device connects to the cryptographic operation device, and further reduce the difficulty of using different cryptographic operation devices by the device, is a technical problem to be solved by those skilled in the art. SUMMARY

[0004] The present application provides a cryptographic operation device control method and an electronic device to at least solve the problem of complex adaptation work when the device connects to the cryptographic operation device in the related art, resulting in difficulty in using different cryptographic operation devices by the device.

[0005] The present application provides a cryptographic operation device control method, comprising: In response to a key calling command, a first task parameter input based on a cryptographic operation device calling interface is identified; A first cryptographic operation device to be called is determined; According to the cryptographic operation device registration information of the first cryptographic operation device, the first task parameter is converted into a second task parameter corresponding to the first cryptographic operation device; The second task parameter is used to call the first cryptographic operation device to perform a cryptographic operation task; The cryptographic operation device registration information at least includes calling parameters of a cryptographic service dynamic library, key type mapping information and key mechanism mapping information; the key type mapping information is mapping information between a general key type identifier and a private key type identifier of a cryptographic operation device; the key mechanism mapping information is used to record the conversion relationship between a general key mechanism and a private key mechanism of a cryptographic operation device.

[0006] The present application also provides an electronic device, comprising: a memory for storing a computer program; a processor for executing the computer program to implement the steps of any of the above cryptographic operation device control methods.

[0007] By the present application, since the password operation device registration information created when accessing the password operation device includes at least the calling parameter of the password service dynamic library, the key type mapping information and the key mechanism mapping information, the key type mapping information is the mapping information between the general key type identifier and the private key type identifier of the password operation device, and the key mechanism mapping information is used to record the conversion relationship between the general key mechanism and the private key mechanism of the password operation device, a unified password operation device calling interface and the general calling parameters such as the general key type identifier and the general key mechanism are provided for the upper application program, the difference between different password operation device manufacturers is shielded for the upper application, so that the differentiated content of different password operation device manufacturers need not to be adapted in the development of the upper application, and the calling of the general first task parameter into the password operation device calling interface can realize the calling of different password operation devices, thereby significantly reducing the difficulty of using different password operation devices. BRIEF DESCRIPTION OF DRAWINGS

[0008] In order to more clearly illustrate the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0009] Figure 1 A flow chart of a password operation device control method provided for the embodiments of the present application; Figure 2 An architecture diagram of a password operation system provided for the embodiments of the present application; Figure 3 A flow chart of an encryption initialization stage of an encryption operation process provided for the embodiments of the present application; Figure 4 A flow chart of an encryption update stage of an encryption operation process provided for the embodiments of the present application; Figure 5 A flow chart of an encryption completion stage of an encryption operation process provided for the embodiments of the present application; Figure 6 A flow chart of a decryption initialization stage of a decryption operation process provided for the embodiments of the present application; Figure 7 A flow chart of a decryption update stage of a decryption operation process provided for the embodiments of the present application; Figure 8 A flow chart of a decryption completion stage of a decryption operation process provided for the embodiments of the present application; Figure 9 A flow chart of a key generation and synchronization process provided for the embodiments of the present application. DETAILED DESCRIPTION

[0010] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0011] It should be noted that, in the description of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment. The terms "first", "second" and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0012] In order for those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0013] The embodiments of the present application provide a cryptographic operation device control method, and the method will be described in detail below in combination with the execution flow of the cryptographic operation device control method.

[0014] Figure 1 A flowchart of the cryptographic operation device control method provided by the embodiments of the present application.

[0015] As shown in Figure 1 The cryptographic operation device control method provided by the embodiments of the present application can include: S101: in response to a key calling command, identifying a first task parameter input based on a cryptographic operation device calling interface.

[0016] S102: determining a first cryptographic operation device to be called.

[0017] S103: converting the first task parameter into a second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device.

[0018] S104: calling the first cryptographic operation device to execute a cryptographic operation task by using the second task parameter.

[0019] The password operation device registration information at least includes a calling parameter of a password service dynamic library, key type mapping information, and key mechanism mapping information; the key type mapping information is mapping information between a general key type identifier and a private key type identifier of the password operation device; and the key mechanism mapping information is used for recording a conversion relationship between a general key mechanism and a private key mechanism of the password operation device.

[0020] The password operation device control method provided by the embodiment of the application is applied to an electronic device provided with a password operation device, and the electronic device is provided with a password operation program for calling the password operation device to perform a password operation task.

[0021] In the embodiment of the application, the password operation program can be a standard password operation program, such as a PKCS#11 application program. The PKCS#11 is a part of the Public-Key Cryptography Standards, and the core thereof is to map the password operation device to a logical view of a device as a “password token”, and to provide a unified Cryptoki interface to operate the password device to perform encryption, decryption, digital signature, key management, and other cryptographic operations. With the continuous enrichment of key types, password operation device manufacturers have added related functions of various key types on the PKCS#11 implementation library to reuse the PKCS#11 interface. On the other hand, in order to use multiple types of keys and actively disperse risks, electronic devices also actively use the strategy of coexisting multiple password operation devices of different manufacturers, aiming to build a more resilient and secure cryptographic infrastructure. However, the application program of the traditional PKCS#11 library interacts with a specific password operation device through the PKCS#11 interface of the password service dynamic library (Provider) of a single manufacturer's password operation device to complete the password operation, but the PKCS#11 standard interface lacks native support for many key types, resulting in incompatible expansion functions of different manufacturers for these key types, and the need to redevelop and adapt when replacing password operation devices of different manufacturers, causing resource waste.

[0022] To this end, the password operation device control method provided by the embodiment of the application aims to shield the differences in the password operation functions of different key types realized by the standard password operation program of different manufacturers, and to reduce the development complexity when the electronic device is provided with multiple password operation devices.

[0023] The password operation device control method of the embodiment of the application can be implemented based on an adapter core layer arranged between the password operation program and the calling interfaces of the password operation devices.

[0024] Figure 2 An architecture diagram of a password operation system provided by the embodiment of the application.

[0025] AsFigure 2 As shown, the adapter core layer provided by the embodiments of the present application can include a device management submodule, a key management submodule, and an adaptation submodule.

[0026] The device management submodule is configured to manage the cryptographic operation devices and can include registration of the cryptographic operation devices, dynamic library loading, initialization, unloading, and scheduling of standard cryptographic operation programs, etc. Through the cryptographic operation device registration service, when cryptographic operation devices of a new vendor are accessed, only the relevant configuration items need to be added, without the need to modify the code.

[0027] The cryptographic operation device registration service can be automatically executed when the adapter core layer is loaded in the application layer, and the initialization process thereof can include: (1) reading and parsing the local configuration file and the key index file to obtain the detailed information of the accessed cryptographic operation devices; (2) dynamically loading the cryptographic service dynamic library (Provider) provided by each vendor; and (3) constructing the relevant mapping information, which can include device mapping information, key type mapping information, and key mechanism mapping information.

[0028] The device mapping information can be in the form of a device mapping table and can be used to record the correspondence between the vendor ID and the path of the cryptographic service dynamic library (Provider).

[0029] The key type mapping information can be in the form of a key type mapping table and can be used to implement the conversion from the standard key type (such as CKK_Proxy_SM4) to the vendor private key type (such as CKK_VENDOR_SM4).

[0030] The key mechanism mapping information can be in the form of a key mechanism mapping table and can be used to implement the conversion from the key mechanism defined by the adapter core layer (such as CKM_Proxy_SM4_CBC) to the key mechanism extended by the vendor (such as CKM_VENDOR_SM4_CBC).

[0031] The cryptographic operation device scheduling service is used when the application layer calls the key to perform the cryptographic operation task and other critical operations such as key generation. Through the cryptographic operation device scheduling service, the cryptographic operation device that meets the requirements is scheduled to perform the cryptographic operation task input by the application layer.

[0032] The cryptographic operation device unloading service is used after the completion of the cryptographic operation task. Through the cryptographic operation device unloading service, the resources are safely cleaned up, the loaded cryptographic service dynamic library is sequentially unloaded (for example, in the reverse order of the loading time), and the various mapping tables and statistical information established in the cryptographic operation device registration stage are emptied, so as to ensure that there is no resource residue.

[0033] The key management submodule is responsible for managing the keys in the electronic device and can include key generation, update, destruction, and key identification management, etc.

[0034] The adapter sub-module is a bridge between the application layer of the standard cryptographic operation program and the device layer of the cryptographic operation device, is responsible for the interface compatible with the standard cryptographic operation program, does not convert the key type originally provided by the standard cryptographic operation program, and performs bidirectional conversion between the task parameters of the cryptographic operation task transmitted by the application layer and the task parameters of the cryptographic operation device of each manufacturer in the adapter sub-module, so as to shield the difference of the bottom cryptographic operation device for the application layer and solve the compatibility problem.

[0035] The driver layer is a cryptographic service dynamic library (Provider) provided by each cryptographic operation device manufacturer, which interacts with the adapter core layer through an application programming interface (API) provided by each cryptographic operation device manufacturer.

[0036] The device layer is a cryptographic operation device provided by each cryptographic operation device manufacturer supporting the standard cryptographic operation program protocol, which can be a heterogeneous device or a homogeneous device.

[0037] In the embodiment of the application, the type of the cryptographic operation device can include but is not limited to a hardware security module (HSM), an encryption token, an encryption smart card, a hardware cryptographic operation device installed with a software cryptographic module, etc.

[0038] In the embodiment of the application, the type of the cryptographic operation task can include but is not limited to an encryption task, a decryption task, a signature task, a signature verification task, etc.

[0039] In the embodiment of the application, when a new cryptographic operation device is registered, each type of cryptographic operation device registration information is registered for the cryptographic operation device.

[0040] For S101, the adapter core layer identifies the first task parameter input based on the cryptographic operation device calling interface in response to the key calling command of the upper application.

[0041] For S102, the first cryptographic operation device to be called can be determined according to the first task parameter.

[0042] In some other optional embodiments of the application, the plurality of cryptographic operation devices on the device can be scheduled.

[0043] The determination of the first cryptographic operation device to be called in S102 can also include: determining a first candidate cryptographic operation device having the target key according to the identification of the target key included in the first task parameter; and determining the first cryptographic operation device according to the running state parameter of the first candidate cryptographic operation device.

[0044] In the embodiment of the present application, the running state parameter of the cryptographic operation device can be time consumption information of the cryptographic operation device in performing a cryptographic operation task. The recording step of the time consumption information of the cryptographic operation device in performing the cryptographic operation task can include: starting timing when the cryptographic operation device is called to perform the cryptographic operation task, and ending timing when the cryptographic operation device finishes performing the cryptographic operation task, to obtain time consumption information of the cryptographic operation device in performing the cryptographic operation task once.

[0045] In a specific implementation, a cryptographic operation time consumption statistics table can be maintained in the cryptographic operation device scheduling service of the adapter core layer, which can be used to record the operation type, the identifier of the cryptographic operation device, and the related fields of the time consumption information when the application layer calls the cryptographic operation device, and the average time consumption of different cryptographic operation devices in performing various cryptographic operations is recorded by a preset operation function, which is used as a core basis for scheduling the cryptographic operation device.

[0046] On the basis of the above-mentioned adapter core layer adaptation sub-module, in the embodiment of the present application, the first task parameter includes a first key type identifier, a first key mechanism, a first session handle, an identifier of a first target key, and a pointer of a first function list pointer. In S103, the first task parameter is converted into second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device, which can include: querying the calling parameter of the first cryptographic service dynamic library corresponding to the first cryptographic operation device, the first key type mapping information, and the first key mechanism mapping information according to the identifier of the first cryptographic operation device; converting the first key type identifier into a second key type identifier corresponding to the first cryptographic operation device according to the first key type mapping information; converting the first key mechanism into a second key mechanism corresponding to the first cryptographic operation device according to the first key mechanism mapping information; querying the first cryptographic service dynamic library to obtain a second session handle corresponding to the first session handle and a pointer of a second function list pointer corresponding to the pointer of the first function list pointer; and taking the second key type identifier, the second key mechanism, the second session handle, the identifier of the first target key, and the pointer of the second function list pointer as the second task parameter.

[0047] The cryptographic type identifier is used to indicate the key type adopted by the current cryptographic operation task, which represents the mathematical property and structural category of the key itself, such as SM4 symmetric encryption.

[0048] In the PKCS#11 standard, the cryptographic mechanism is the full name of the cryptographic mechanism, which is used to uniquely determine which basic cryptographic algorithm (such as AES, SM4, RSA, SM2) is used for the cryptographic operation task, which mode or purpose is used (such as CBC, ECB, PKCS#1-Padding, or for signature, encryption, etc.), and other specific parameters (such as initialization vector, parameters for key derivation, etc.), which is usually represented by a constant (such as CKM_AES_CBC, CKM_SM2).

[0049] The session handle is a unique identifier of the cryptographic operation task, and if the cryptographic operation task is executed in multiple stages (such as initialization stage, update stage, completion stage), the same session handle must be used to maintain the operation context. The session handle is usually passed in during the initialization stage.

[0050] The identification of the key refers to the identification used to call the key in the electronic device, which is the identification corresponding to the key itself (different types of keys or different keys of the same type have different identifications).

[0051] The pointer to the function list pointer is the address of the variable used to store the function list pointer, which is used to call the functions required by the cryptographic operation task.

[0052] In the embodiment of the application, the first task parameter passed in by the application layer is converted into the second task parameter that can call the specific cryptographic operation device through the pre-constructed mapping information, the difference between the underlying cryptographic operation device is shielded from the application layer, and the adaptation of the cryptographic operation devices of different manufacturers is realized.

[0053] The cryptographic operation device control method provided by the embodiment of the application includes the following steps: when the cryptographic operation device is accessed, the cryptographic operation device registration information created for the cryptographic operation device includes at least the calling parameters of the cryptographic service dynamic library, the key type mapping information, and the key mechanism mapping information. The key type mapping information is the mapping information between the general key type identifier and the private key type identifier of the cryptographic operation device, and the key mechanism mapping information is used to record the conversion relationship between the general key mechanism and the private key mechanism of the cryptographic operation device. A unified cryptographic operation device calling interface and general calling parameters such as the general key type identifier and the general key mechanism are provided for the upper application program, and the difference between different cryptographic operation device manufacturers is shielded from the upper application, so that the development of the upper application does not need to adapt to the differentiated content of different cryptographic operation device manufacturers, and only the general first task parameter needs to be passed in by calling the cryptographic operation device calling interface, so that the calling of different cryptographic operation devices can be realized, thereby significantly reducing the difficulty of using different cryptographic operation devices.

[0054] In the related art, the use of the key depends on a specific physical handle, and transparent access and cross-device sharing cannot be achieved among multiple devices. To solve this problem, on the basis of the above embodiment, in the cryptographic operation device control method provided in the embodiment of the application, the cryptographic operation device registration information can further include key index mapping information, the key index mapping information being mapping information between the unique identifier of the key in the cryptographic operation system and the device identifier of the key in the cryptographic operation device; and the cryptographic operation system includes multiple cryptographic operation devices installed in the same device.

[0055] In a specific implementation, the key index mapping information can be in the form of a mapping table and can be used to record the mapping relationship between the unique identifier of the key in the electronic device and the identifier of the key in the cryptographic operation device, where the unique identifier of the key in the electronic device can be a virtual key handle, and the identifier of the key in the cryptographic operation device can be a physical key handle.

[0056] Then, the key identifier management service of the key management submodule of the adapter core layer can achieve cross-device management of the key by maintaining the key index mapping information.

[0057] Then, through the adaptation submodule of the adapter core layer, in the embodiment of the application, the first task parameter can include a first key type identifier, a first key mechanism, a first session handle, a unique identifier of a first target key, and a pointer of a first function list pointer. In S103, the first task parameter is converted into a second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device, which can include: querying the calling parameter of the first cryptographic service dynamic library corresponding to the first cryptographic operation device, the first key type mapping information, the first key mechanism mapping information, and the first key index mapping information according to the identifier of the first cryptographic operation device; converting the first key type identifier into a second key type identifier corresponding to the first cryptographic operation device according to the first key type mapping information; converting the first key mechanism into a second key mechanism corresponding to the first cryptographic operation device according to the first key mechanism mapping information; obtaining a first device identifier of the first target key on the first cryptographic operation device according to the unique identifier of the first target key and the first key index mapping information; querying the first cryptographic service dynamic library to obtain a second session handle corresponding to the first session handle and a pointer of a second function list pointer corresponding to the pointer of the first function list pointer; and taking the second key type identifier, the second key mechanism, the second session handle, the first device identifier of the first target key, and the pointer of the second function list pointer as the second task parameter.

[0058] The unique identifier of the first target key can be a virtual key handle of the first target key, and the first device identifier of the first target key can be a physical key handle of the first target key.

[0059] Therefore, by the embodiment of the present application, the difference of different password operation devices can be completely shielded for the application layer, the application layer does not need to care which password operation device executes the password operation task, thereby further facilitating the password operation device scheduling service of the adapter core layer to perform the load balancing scheduling between multiple password operation devices, meanwhile, the working pressure of the application layer is relieved, and the execution efficiency of the password operation task is improved.

[0060] The following describes one actual application scenario of the password operation device control method provided by the embodiment of the present application by taking the process of SM4 symmetric encryption and decryption operation as an example.

[0061] The symmetric encryption operation can include three stages of encryption initialization, encryption update and encryption completion.

[0062] Figure 3 A flowchart of the encryption initialization stage of the encryption operation process provided by the embodiment of the present application.

[0063] As shown in Figure 3 Based on the adapter core layer, the encryption initialization stage of the symmetric encryption can include: S301: passing in the task parameter.

[0064] The task parameter of the upper layer initialization calling the encryption initialization function can be recorded as the first task parameter, which can include the first key type identifier, the first key mechanism, the first session handle, the virtual key handle of the first target key and the pointer of the first function list pointer.

[0065] For example, the upper layer application calls the encryption initialization function (Proxy_C_EncryptInit) of the adapter core layer, and passes in the first key mechanism (such as CKM_Proxy_SM4_CBC, etc.) of the SM4 symmetric encryption operation, the virtual key handle, the session handle and the pointer of the function list pointer, wherein the first two parameters are input parameters, and the session handle and the pointer of the function list pointer are input and output parameters.

[0066] S302: determining the first password operation device to be called based on the password operation time consumption statistical table.

[0067] The function internally calls the password operation device scheduling service, and selects the optimal key operation device as the first key operation device based on the password operation time consumption statistical table.

[0068] S303: performing the task parameter conversion.

[0069] In a specific implementation, according to the identification of the first key operation device, a relevant mapping table established in the registration stage is queried to complete relevant mapping: (1) mechanism mapping: converting the general key mechanism (such as CKM_Proxy_SM4_CBC) defined by the adapter core layer into the key mechanism (such as CKM_VENDOR__SM4_CBC) extended by the manufacturer; (2) key type mapping: converting the general identification of the key type defined by the adapter core layer into the identification of the key type on the first key operation device; (3) handle mapping: mapping the virtual key handle (vhkey) of the key into the physical key handle (pkey) of the first key operation device; and (4) querying the device registration table according to the identification of the first key operation device to obtain a session handle and a function list pointer.

[0070] S304: executing an encryption initialization function.

[0071] In a specific implementation, the encryption initialization function (C_EncryptInit) is called through the pointer of the second function list pointer to execute encryption initialization, and the specific parameters passed in are the second key type identification, the second key mechanism, the second session handle, the physical key handle of the first target key, and the pointer of the second function list pointer obtained in S303.

[0072] S305: judging whether the initialization is successful. If yes, S306 is entered; if no, S308 is entered.

[0073] S306: assigning the session handle and the pointer of the function list pointer to the output parameter.

[0074] S307: returning a success flag.

[0075] S308: returning an error message.

[0076] After the execution of the encryption initialization function, it is judged whether the initialization is successful. If not, an error code is directly returned. If yes, the session handle and the pointer of the function list pointer are assigned to the output parameter, and a success flag is returned, so that the application layer can enter the subsequent stage of symmetric encryption.

[0077] Figure 4 A flowchart of an encryption update stage of an encryption operation process provided by the embodiment of the application.

[0078] In some encryption scenarios, for example, when a longer plaintext needs to be encrypted, the plaintext often needs to be segmented for segmented encryption, and this stage is performed in the encryption update stage.

[0079] As Figure 4As shown, taking segmented encryption as an example, based on the adapter core layer, the encryption update phase of symmetric encryption can include: S401: Input task parameters, plaintext to be encrypted, and buffer information.

[0080] In practice, the application layer calls the segmented encryption function (Proxy_C_EncryptUpdate) in the adapter core layer, passing in a pointer to the function list, a session handle, the plaintext to be encrypted, and information about the buffer used to store the ciphertext. The buffer can be an input / output buffer.

[0081] S402: Start timing.

[0082] S403: Perform segmented encryption.

[0083] In practice, segmented encryption is performed by calling the segmented encryption function (C_EncryptUpdate) through the pointer of the function list pointer. The specific parameters of the function are the session handle, the plaintext to be encrypted, and the information of the buffer used to store the ciphertext.

[0084] S404: Return the encryption result to the application layer.

[0085] After segmented encryption is complete, the encryption result (such as intermediate data) is returned to the application layer. At this point, the timer can be stopped to obtain the time consumed for the encryption update phase, or the timer can be continued.

[0086] Figure 5 This is a flowchart of the encryption completion stage of an encryption operation process provided in an embodiment of the present invention.

[0087] like Figure 5 As shown, based on the adapter core layer, the completion stage of symmetric encryption may include: S501: Inputting task parameters and buffer information.

[0088] In practice, the application layer calls the encryption completion function (Proxy_C_EncryptFinal) of the adapter core layer, passing in a pointer to the function list, a session handle, and information about the buffer used to store the ciphertext. The buffer can be an input / output buffer.

[0089] S502: Timing.

[0090] In practice, timing can be added on top of the previous stage or it can be a separate timing for the current stage.

[0091] S503: Execute the encryption completion function.

[0092] The decryption completion function is called by the pointer of the function list pointer to call the encryption completion function (C_EncryptFinal), and the specific parameters of the function are a session handle and a buffer for storing plaintext, wherein the buffer for storing plaintext is an input and output buffer.

[0093] S504: return the encryption result.

[0094] In a specific implementation, after the encryption completion function is executed, the time consumption information of local encryption is recorded, and a password operation time consumption statistical table is updated.

[0095] The symmetric encryption operation can include three stages of decryption initialization, decryption update and decryption completion.

[0096] Figure 6 A flowchart of a decryption initialization stage of a decryption operation process provided by an embodiment of the present application.

[0097] As shown in Figure 6 Based on the adapter core layer, the decryption initialization stage of the symmetric encryption can include: S601: passing in a task parameter.

[0098] The task parameter for calling the decryption initialization function of the upper layer can be recorded as a first task parameter, and can include a first key type identifier, a first key mechanism, a first session handle, a virtual key handle of a first target key and a pointer of a first function list pointer.

[0099] For example, the upper layer application calls the decryption initialization function (Proxy_C_DecryptInit) of the adapter core layer, and passes in the first key mechanism (such as CKM_Proxy_SM4_CBC) of the SM4 symmetric encryption operation, a virtual key handle, a session handle and a pointer of a function list pointer, wherein the first two parameters are input parameters, and the session handle and the pointer of the function list pointer are input and output parameters.

[0100] S602: determining a first password operation device to be called based on a password operation time consumption statistical table.

[0101] The function internally calls a password operation device scheduling service, and selects an optimal key operation device as the first key operation device based on the password operation time consumption statistical table.

[0102] S603: performing task parameter conversion.

[0103] In specific implementation, based on the identifier of the first key processing device, the relevant mapping table established during its registration phase is queried to complete the relevant mapping: (1) Mechanism mapping: the general key mechanism defined by the adapter core layer (such as CKM_Proxy_SM4_CBC) is converted into the vendor-extended key mechanism (such as CKM_VENDOR__SM4_CBC). (2) Key type mapping: the general identifier of the key type defined by the adapter core layer is converted into the identifier of the key type on the first key processing device. (3) Handle mapping: the virtual key handle (vhkey) of the key is mapped to the physical key handle (pkey) of the first key processing device. (4) Based on the identifier of the first key processing device, the device registry is queried to obtain the session handle and function list pointer.

[0104] S604: Execute the decryption initialization function.

[0105] In practice, the decryption initialization function (C_DecryptInit) is called through the pointer of the second function list pointer to perform decryption initialization. The specific parameters passed are the second key type identifier, the second key mechanism, the second session handle, the physical key handle of the first target key, and the pointer of the second function list pointer obtained in S603.

[0106] S605: Determine if initialization was successful. If successful, proceed to S606; otherwise, proceed to S608.

[0107] S606: Assign the pointers to the session handle and the function list pointers to the output parameters.

[0108] S607: Returns a success flag.

[0109] S608: Error message returned.

[0110] After the decryption initialization function is executed, it checks whether the initialization was successful. If it was unsuccessful, an error code is returned directly. If it was successful, the session handle and the pointer to the function list are assigned to the output parameters, and a success flag is returned, allowing the application layer to proceed to the subsequent decryption stages.

[0111] Figure 7 This is a flowchart of the decryption update stage of a decryption operation process provided in an embodiment of the present invention.

[0112] Similar to symmetric encryption, long ciphertexts also need to be decrypted in segments.

[0113] like Figure 7 As shown, taking segmented decryption as an example, based on the adapter core layer, the decryption update stage of symmetric encryption can include: S701: Input task parameters, plaintext to be decrypted, and buffer information.

[0114] In a specific implementation, the application layer calls the segment decryption function (Proxy_C_DecryptUpdate) of the adapter core layer and inputs the pointer of the function list pointer, the session handle, the plaintext to be decrypted, and the information of the buffer for storing the ciphertext. The buffer can be an input-output buffer.

[0115] S702: Start timing.

[0116] S703: Perform segment decryption.

[0117] In a specific implementation, the segment decryption function (C_DecryptUpdate) is called through the pointer of the function list pointer to perform segment decryption, and the function specific parameters are the session handle, the plaintext to be decrypted, and the information of the buffer for storing the ciphertext.

[0118] S704: Return the decryption result to the application layer.

[0119] After the segment decryption is completed, the decryption result (such as intermediate data) is returned to the application layer. At this time, the timing can be stopped to obtain the time consumption information corresponding to the decryption update stage, or the timing can be continued.

[0120] Figure 8 A flowchart of a decryption completion stage of a decryption operation process provided by an embodiment of the present application.

[0121] As shown in FIG. 8, based on the adapter core layer, the completion stage of the symmetric encryption can include: Figure 8

[0122] S801: Input task parameters and buffer information.

[0123] In a specific implementation, the application layer calls the decryption completion function (Proxy_C_DecryptFinal) of the adapter core layer and inputs the pointer of the function list pointer, the session handle, and the information of the buffer for storing the ciphertext. The buffer can be an input-output buffer.

[0124] S802: Timing.

[0125] In a specific implementation, the timing can be superimposed on the basis of the previous stage, or the timing can be independent of the present stage.

[0126] S803: Execute the decryption completion function.

[0127] The decryption completion function (C_DecryptFinal) is called through the pointer of the function list pointer to execute the decryption completion function, and the function specific parameters are the session handle and the buffer for storing the plaintext, wherein the buffer for storing the plaintext is an input-output buffer.

[0128] ​S804: return the decryption result.

[0129] In a specific implementation, after the decryption completion function is executed, time consumption information of local decryption is recorded, and a password operation time consumption statistical table is updated.

[0130] For the key generation task, the password operation device control method provided by the embodiment of the application can further include: in response to a key generation command, identifying third task parameters input based on a password operation device calling interface; determining a source password operation device for generating a second target key; converting the third task parameters into fourth task parameters for the source password operation device according to password operation device registration information of the source password operation device; and calling the source password operation device to execute the key generation task by using the fourth task parameters.

[0131] In a specific implementation, the password operation device registration information can further include key index mapping information, the key index mapping information being mapping information between a unique identifier of a key in a password operation system and a device identifier of the key in the password operation device; and the password operation system including multiple password operation devices installed in the same device. Then, calling the source password operation device to execute the key generation task by using the fourth task parameters can include: calling the source password operation device to generate the second target key by using the fourth task parameters, and determining a second device identifier of the second target key on the source password operation device; determining a unique identifier of the second target key in the password operation system; and adding mapping information between the unique identifier of the second target key and the second device identifier of the second target key in the key index mapping information.

[0132] If the password operation device registration information further includes key index mapping information, the key index mapping information being mapping information between a unique identifier of a key in a password operation system and a device identifier of the key in the password operation device; and the password operation system including multiple password operation devices installed in the same device, the password operation device control method provided by the embodiment of the application can further include: determining a second password operation device; determining a second device identifier of the second target key on the source password operation device after the source password operation device generates the second target key; determining a unique identifier of the second target key in the password operation system; controlling the source password operation device to synchronize the second target key to the second password operation device after the second target key is encrypted, and determining a third device identifier of the second target key on the second password operation device; and adding mapping information between the unique identifier of the second target key and the second device identifier of the second target key and mapping information between the unique identifier of the second target key and the third device identifier of the second target key in the key index mapping information.

[0133] Furthermore, before adding the mapping information between the unique identifier of the second target key and the second device identifier of the second target key, and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key, to the key index mapping information, the cryptographic operation device control method provided in this embodiment of the invention may further include: performing consistency verification on the second target key on the source cryptographic operation device and the second target key on the second cryptographic operation device; if the consistency verification is successful, adding the mapping information between the unique identifier of the second target key and the second device identifier of the second target key, and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key, to the key index mapping information; the cryptographic operation device control method further includes: if the consistency verification fails, deleting the second target key from the source cryptographic operation device and the second cryptographic operation device.

[0134] In this embodiment of the invention, the consistency verification of the second target key on the source cryptographic operation device and the second target key on the second cryptographic operation device may include: calling the source cryptographic operation device and the second cryptographic operation device to encrypt preset information using their local second target keys respectively, and obtaining encryption results; if there are inconsistent encryption results, it is determined that the consistency verification fails; otherwise, it is determined that the consistency verification passes.

[0135] Figure 9 This is a flowchart of a key generation and synchronization process provided in an embodiment of the present invention.

[0136] like Figure 9 As shown, in this embodiment of the invention, the key generation and synchronization process may include: S901: generating a virtual key handle.

[0137] S902: Determine the source cryptographic operation device.

[0138] The upper-layer application calls the application programming interface function (Proxy_GenerateKey) of the adapter core layer to generate the symmetric key, and passes in the parameters of the standard cryptographic operation program. Taking PKCS#11 as an example, the parameter pMechanism specifies the key generation mechanism, pTemplate is a template attribute that sets the key name, encryption and decryption functions, and supports key wrapping.

[0139] The input parameters are preprocessed and transformed, including mechanism mapping and template transformation.

[0140] The device scheduling module is invoked to select the device with the best performance as the source cryptographic operation device based on the key operation type (key generation).

[0141] S903: Establish initial key identifier mapping.

[0142] The device mapping table is queried to obtain the session handle of the source cryptographic operation device according to the identifier of the source cryptographic operation device. According to the key index mapping information, a virtual key handle of the second target key to be generated is generated, which can be the maximum index number + 1 in the current key index mapping information. Thus, the initial key identifier mapping of the second target key is established.

[0143] S904: The source cryptographic operation device is called to generate the second target key.

[0144] The key generation tool (C_GenerateKey) provided by the cryptographic service dynamic library of the source cryptographic operation device is called, and the converted task parameters are passed to generate the second target key and obtain the physical key handle thereof on the source cryptographic operation device.

[0145] S905: The mapping of the virtual key handle to the physical key handle is added in the key index mapping information.

[0146] The mapping of the virtual key handle of the second target key to the physical key handle of the second target key is added in the key index mapping information.

[0147] S906: The source cryptographic operation device is called to synchronize the second target key to the second cryptographic operation device.

[0148] In a specific implementation, the master key handle on the source cryptographic operation device is obtained as the handle of the wrapped second target key, and a standard wrapping function (C_WrapKey) is called to wrap (export) the newly generated second target key on the source cryptographic operation device. After the encrypted second target key is wrapped by means of another key, the encrypted second target key is synchronized to the second cryptographic operation device.

[0149] S907: After determining that the synchronization is completed, the physical key handle of the second target key on the second cryptographic operation device is obtained.

[0150] In a specific implementation, the session handle of each second cryptographic operation device is obtained through the device mapping table, each second cryptographic operation device is traversed, the encrypted second target key is imported (unwrapped) on each second cryptographic operation device, and the physical key handle returned after being imported on each second cryptographic operation device is recorded in the key index mapping information.

[0151] S908: The source cryptographic operation device and each second cryptographic operation device are called to encrypt the random number.

[0152] S909: It is judged whether the encryption results are consistent. If yes, S910 is entered; if no, S912 is entered.

[0153] S910: It is confirmed that the key index mapping information is updated.

[0154] S911: return the virtual key handle of the second target key and a success identifier.

[0155] S912: perform a rollback operation, traverse the source cryptographic operation device and each second cryptographic operation device, and delete the second target key.

[0156] S913: clear the key identifier mapping corresponding to the second target key.

[0157] S914: return error information.

[0158] In a specific implementation, after the synchronization of the second target key is completed, a random number is generated for key consistency verification (the random number can be generated by calling a system function of an adapter core layer or by calling a key operation device), specifically, an encryption function based on a standard cryptographic operation program on the source cryptographic operation device and each second cryptographic operation device is called, and the random number is encrypted by using the physical key handle of each device respectively. Then, the encryption results of the source cryptographic operation device and each second cryptographic operation device are compared. If the results are consistent, the consistency verification is successful, the virtual key mapping table in the memory and on the file is updated, and the virtual handle and a success state are returned; if the results are inconsistent, the consistency verification fails, all related cryptographic operation devices are traversed, a standard delete object function is called to delete the second target key that has been generated or synchronized, and error information is returned.

[0159] Those skilled in the art can clearly understand from the description of the above embodiments that the method according to the above embodiments can be realized by means of software and a general hardware platform as required, of course, and can also be realized by hardware, but in many cases, the former is a better implementation manner.

[0160] The embodiment of the application further provides a cryptographic operation device control device, which comprises: a first response unit, configured to identify first task parameters input based on a cryptographic operation device calling interface in response to a key calling command; a first determination unit, configured to determine a first cryptographic operation device to be called; a first conversion unit, configured to convert the first task parameters into second task parameters corresponding to the first cryptographic operation device according to cryptographic operation device registration information of the first cryptographic operation device; and a first control unit, configured to call the first cryptographic operation device to perform a cryptographic operation task by using the second task parameters; wherein the cryptographic operation device registration information at least comprises calling parameters of a cryptographic service dynamic library, key type mapping information and key mechanism mapping information; the key type mapping information is mapping information between a general key type identifier and a private key type identifier of the cryptographic operation device; and the key mechanism mapping information is used to record a conversion relationship between a general key mechanism and a private key mechanism of the cryptographic operation device.

[0161] In the embodiment of the present application, the first task parameter can include a first key type identifier, a first key mechanism, a first session handle, an identifier of a first target key, and a pointer of a first function list pointer; and the conversion of the first task parameter into the second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device can include: querying the calling parameter of the first cryptographic service dynamic library corresponding to the first cryptographic operation device, the first key type mapping information, and the first key mechanism mapping information according to the identifier of the first cryptographic operation device; converting the first key type identifier into a second key type identifier corresponding to the first cryptographic operation device according to the first key type mapping information; converting the first key mechanism into a second key mechanism corresponding to the first cryptographic operation device according to the first key mechanism mapping information; querying the first cryptographic service dynamic library to obtain a second session handle corresponding to the first session handle and a pointer of a second function list pointer corresponding to the pointer of the first function list pointer; and taking the second key type identifier, the second key mechanism, the second session handle, the identifier of the first target key, and the pointer of the second function list pointer as the second task parameter.

[0162] In the embodiment of the present application, the cryptographic operation device registration information can further include key index mapping information, which is mapping information between the unique identifier of a key in the cryptographic operation system and the device identifier of the key in the cryptographic operation device; and the cryptographic operation system includes a plurality of cryptographic operation devices installed in the same device.

[0163] Then, the first task parameter can include a first key type identifier, a first key mechanism, a first session handle, a unique identifier of a first target key, and a pointer of a first function list pointer; and the conversion of the first task parameter into the second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device can include: querying the calling parameter of the first cryptographic service dynamic library corresponding to the first cryptographic operation device, the first key type mapping information, the first key mechanism mapping information, and the first key index mapping information according to the identifier of the first cryptographic operation device; converting the first key type identifier into a second key type identifier corresponding to the first cryptographic operation device according to the first key type mapping information; converting the first key mechanism into a second key mechanism corresponding to the first cryptographic operation device according to the first key mechanism mapping information; obtaining a first device identifier of the first target key on the first cryptographic operation device according to the identifier of the first target key and the first key index mapping information; querying the first cryptographic service dynamic library to obtain a second session handle corresponding to the first session handle and a pointer of a second function list pointer corresponding to the pointer of the first function list pointer; and taking the second key type identifier, the second key mechanism, the second session handle, the first device identifier of the first target key, and the pointer of the second function list pointer as the second task parameter.

[0164] The password operation device control device provided by the embodiment of the present application can further comprise: a second response unit, configured to identify third task parameters input based on a password operation device calling interface in response to a key generation command; a second determination unit, configured to determine a source password operation device for generating a second target key; a second conversion unit, configured to convert the third task parameters into fourth task parameters for the source password operation device according to password operation device registration information of the source password operation device; and a second control unit, configured to call the source password operation device to execute a key generation task by using the fourth task parameters.

[0165] In the embodiment of the present application, the password operation device registration information further comprises key index mapping information, the key index mapping information being mapping information between a unique identifier of a key in a password operation system and a device identifier of the key in a password operation device; the password operation system comprising a plurality of password operation devices installed in the same device; and the calling of the source password operation device to execute the key generation task by using the fourth task parameters can comprise: calling the source password operation device to generate the second target key by using the fourth task parameters, and determining a second device identifier of the second target key on the source password operation device; determining a unique identifier of the second target key in the password operation system; and adding mapping information between the unique identifier of the second target key and the second device identifier of the second target key in the key index mapping information.

[0166] If the password operation device registration information further comprises key index mapping information, the key index mapping information being mapping information between a unique identifier of a key in a password operation system and a device identifier of the key in a password operation device, the password operation device control device provided by the embodiment of the present application can further comprise: a third determination unit, configured to determine a second password operation device; and a third control unit, configured to: after the source password operation device generates the second target key, determine a second device identifier of the second target key on the source password operation device; determine a unique identifier of the second target key in the password operation system; control the source password operation device to synchronize the second target key to the second password operation device after the second target key is encrypted, and determine a third device identifier of the second target key on the second password operation device; and add mapping information between the unique identifier of the second target key and the second device identifier of the second target key and mapping information between the unique identifier of the second target key and the third device identifier of the second target key in the key index mapping information.

[0167] The password operation device control device provided in the embodiment of the present application can further comprise a verification unit configured to, before adding the mapping information between the unique identifier of the second target key and the second device identifier of the second target key and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key in the key index mapping information, perform consistency verification on the second target key on the source password operation device and the second target key on the second password operation device; in the case that the consistency verification is passed, add the mapping information between the unique identifier of the second target key and the second device identifier of the second target key and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key in the key index mapping information; in the case that the consistency verification is not passed, delete the second target key in the source password operation device and the second password operation device.

[0168] In the embodiment of the present application, the first password operation device to be called can comprise: determining a first candidate password operation device having the target key according to the identifier of the target key included in the first task parameter; and determining the first password operation device according to the running state parameter of the first candidate password operation device. The running state parameter of the password operation device can be time consumption information of the password operation device in performing the password operation task. The password operation device control provided in the embodiment of the present application can further comprise a time consumption monitoring unit configured to monitor the time consumption information of the password operation device in performing the password operation task.

[0169] The features of the embodiments of the password operation device control device can be referred to the related descriptions of the embodiments of the password operation device control method, which will not be repeated here.

[0170] The embodiments of the present application further provide an electronic device comprising a memory and a processor, the memory storing a computer program, and the processor being configured to execute the computer program to perform the steps in any of the embodiments of the password operation device control method.

[0171] The embodiments of the present application further provide a non-volatile storage medium storing a computer program, wherein the computer program is configured to perform the steps in any of the embodiments of the password operation device control method when executed.

[0172] In an exemplary embodiment, the non-volatile storage medium can include, but is not limited to, a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media capable of storing computer programs.

[0173] The embodiment of the present application further provides a computer program product, which comprises a computer program, and the computer program realizes the steps in any of the method embodiments of the control method of the cryptographic operation device when executed by a processor.

[0174] The embodiment of the present application further provides another computer program product, which comprises a nonvolatile storage medium, and the nonvolatile storage medium stores a computer program, and the computer program realizes the steps in any of the method embodiments of the control method of the cryptographic operation device when executed by a processor.

[0175] Those skilled in the art can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in general terms. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0176] The method of the control method of the cryptographic operation device and the electronic device provided by the present application are described in detail above. The principles and implementation manners of the present application are described by applying specific examples herein, and the description of the above examples is only applicable to help understand the method of the present application and its core idea. It should be pointed out that those skilled in the art can make some improvements and modifications to the present application without departing from the principles of the present application, and these improvements and modifications also fall within the protection scope of the present application.

Claims

1. A method of controlling a cryptographic operation device, characterized by, The method comprises the following steps: In response to a key calling command, a first task parameter input by a cryptographic operation device calling interface is identified; A first cryptographic operation device to be called is determined; The first task parameter is converted into a second task parameter corresponding to the first cryptographic operation device according to cryptographic operation device registration information of the first cryptographic operation device; The first cryptographic operation device is called to perform a cryptographic operation task by using the second task parameter; The cryptographic operation device registration information at least comprises calling parameters of a cryptographic service dynamic library, key type mapping information and key mechanism mapping information; the key type mapping information is mapping information between a general key type identifier and a private key type identifier of a cryptographic operation device; the key mechanism mapping information is used to record a conversion relationship between a general key mechanism and a private key mechanism of a cryptographic operation device.

2. The cryptographic operation device control method according to claim 1, characterized by, The first task parameter comprises a first key type identifier, a first key mechanism, a first session handle, an identifier of a first target key and a pointer of a first function list pointer; The first task parameter is converted into a second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device, which comprises the following steps: According to the identifier of the first cryptographic operation device, calling parameters of a first cryptographic service dynamic library corresponding to the first cryptographic operation device, first key type mapping information and first key mechanism mapping information are queried; According to the first key type mapping information, the first key type identifier is converted into a second key type identifier corresponding to the first cryptographic operation device; According to the first key mechanism mapping information, the first key mechanism is converted into a second key mechanism corresponding to the first cryptographic operation device; The first cryptographic service dynamic library is queried to obtain a second session handle corresponding to the first session handle and a pointer of a second function list pointer corresponding to the pointer of the first function list pointer; The second key type identifier, the second key mechanism, the second session handle, the identifier of the first target key and the pointer of the second function list pointer are taken as the second task parameter.

3. The cryptographic operation device control method according to claim 1, wherein The cryptographic operation device registration information further comprises key index mapping information, which is mapping information between a unique identifier of a key in a cryptographic operation system and a device identifier of a key in a cryptographic operation device; The cryptographic operation system comprises a plurality of cryptographic operation devices installed in the same device.

4. The password operation device control method according to claim 3, characterized by, The first task parameter comprises a first key type identifier, a first key mechanism, a first session handle, a unique identifier of a first target key and a pointer of a first function list pointer; The first task parameter is converted into a second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device, which comprises the following steps: According to the identifier of the first cryptographic operation device, calling parameters of a first cryptographic service dynamic library corresponding to the first cryptographic operation device, first key type mapping information, first key mechanism mapping information and first key index mapping information are queried; According to the first key type mapping information, the first key type identifier is converted into a second key type identifier corresponding to the first cryptographic operation device; According to the first key mechanism mapping information, the first key mechanism is converted into a second key mechanism corresponding to the first cryptographic operation device; According to the unique identifier of the first target key and the first key index mapping information, a first device identifier of the first target key on the first cryptographic operation device is obtained; The first cryptographic service dynamic library is queried to obtain a second session handle corresponding to the first session handle and a second function list pointer corresponding to the pointer of the first function list pointer; The second key type identifier, the second key mechanism, the second session handle, the first device identifier of the first target key, and the pointer of the second function list pointer are used as the second task parameter.

5. The password operation device control method according to claim 1, wherein Further comprising: In response to a key generation command, a third task parameter input based on the cryptographic operation device calling interface is identified; A source cryptographic operation device for generating a second target key is determined; According to the cryptographic operation device registration information of the source cryptographic operation device, the third task parameter is converted into a fourth task parameter for the source cryptographic operation device; The source cryptographic operation device is called to perform a key generation task using the fourth task parameter.

6. The password operation device control method according to claim 5, characterized by, The cryptographic operation device registration information further comprises key index mapping information, which is mapping information between the unique identifier of a key in a cryptographic operation system and the device identifier of the key in a cryptographic operation device; The cryptographic operation system comprises a plurality of cryptographic operation devices installed on the same device; Calling the source cryptographic operation device to perform a key generation task using the fourth task parameter comprises: Generating the second target key using the fourth task parameter and determining a second device identifier of the second target key on the source cryptographic operation device; Determining the unique identifier of the second target key in the cryptographic operation system; Adding mapping information between the unique identifier of the second target key and the second device identifier of the second target key in the key index mapping information.

7. The password operation device control method according to claim 5, wherein The cryptographic operation device registration information further comprises key index mapping information, which is mapping information between the unique identifier of a key in a cryptographic operation system and the device identifier of the key in a cryptographic operation device; The cryptographic operation device control method further comprises: Determining a second cryptographic operation device; After the source cryptographic operation device generates the second target key, determining a second device identifier of the second target key on the source cryptographic operation device; Determining the unique identifier of the second target key in the cryptographic operation system; Controlling the source cryptographic operation device to synchronize the encrypted second target key to the second cryptographic operation device and determining a third device identifier of the second target key on the second cryptographic operation device; adding, in the key index mapping information, mapping information between the unique identification of the second target key and the second device identification of the second target key and mapping information between the unique identification of the second target key and the third device identification of the second target key.

8. The password operation device control method according to claim 7, characterized by, Before adding, in the key index mapping information, mapping information between the unique identification of the second target key and the second device identification of the second target key and mapping information between the unique identification of the second target key and the third device identification of the second target key, the method further comprises: performing consistency verification on the second target key on the source cryptographic operation device and the second target key on the second cryptographic operation device; in the case of passing the consistency verification, adding, in the key index mapping information, mapping information between the unique identification of the second target key and the second device identification of the second target key and mapping information between the unique identification of the second target key and the third device identification of the second target key; the cryptographic operation device control method further comprises: in the case of failing the consistency verification, deleting the second target key in the source cryptographic operation device and the second cryptographic operation device.

9. The password operation device control method according to claim 1, wherein determining the first cryptographic operation device to be invoked, comprising: determining, according to the identification of the target key included in the first task parameter, a first candidate cryptographic operation device having the target key; determining the first cryptographic operation device according to the running state parameter of the first candidate cryptographic operation device.

10. The password operation device control method according to claim 9, wherein the running state parameter of the cryptographic operation device is time consumption information of the cryptographic operation device performing a cryptographic operation task; the recording step of the time consumption information of the cryptographic operation device performing the cryptographic operation task comprises: when invoking the cryptographic operation device to perform the cryptographic operation task, starting timing when completing task initialization, and ending timing when the cryptographic operation device completes the cryptographic operation task, to obtain time consumption information of the cryptographic operation device performing the cryptographic operation task once.

11. An electronic device, comprising: comprising: a memory for storing a computer program; a processor for implementing the steps of the cryptographic operation device control method according to any one of claims 1 to 10 when executing the computer program.

Images