Cryptographic operation device control method and electronic device

Abstract

The application discloses a password operation device control method and electronic equipment, and relates to the technical field of passwords, wherein the password operation device registration information created for the password operation device when the password operation device is accessed comprises at least calling parameters of a password service dynamic library, key type mapping information and key mechanism mapping information, the key type mapping information is mapping information between a general key type identifier and a private key type identifier of the password operation device, and the key mechanism mapping information is used for recording a conversion relationship between a general key mechanism and a private key mechanism of the password operation device, a unified password operation device calling interface and general calling parameters are provided for an upper application program, differences of different password operation devices are shielded, and the upper application only needs to call the password operation device calling interface and input the general first task parameters, so that the calling of different password operation devices can be realized, and the difficulty of using different password operation devices is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cryptography, in particular to a cryptographic operation device control method and electronic equipment. BACKGROUND

[0002] With the development of cryptography, different keys or even different types of keys are often required when performing tasks such as encryption and decryption, signature and signature verification, and many cryptographic operation devices for performing cryptographic operations have emerged in the field. In order to use different types of keys, different cryptographic operation devices need to be installed on the device, and different cryptographic operation device manufacturers have also developed expansion functions of cryptographic operation devices, resulting in great development and adaptation difficulty when a new cryptographic operation device is connected.

[0003] How to reduce the adaptation difficulty when the device accesses the cryptographic operation device, and further reduce the difficulty of using different cryptographic operation devices by the device, is a technical problem to be solved by those skilled in the art. SUMMARY

[0004] The present application provides a cryptographic operation device control method and electronic equipment to at least solve the problem of complex adaptation work when the device accesses the cryptographic operation device in the related art, which leads to the difficulty of using different cryptographic operation devices by the device.

[0005] The present application provides a cryptographic operation device control method, comprising:

[0006] In response to a key calling command, a first task parameter input based on a cryptographic operation device calling interface is identified;

[0007] A first cryptographic operation device to be called is determined;

[0008] According to the cryptographic operation device registration information of the first cryptographic operation device, the first task parameter is converted into a second task parameter corresponding to the first cryptographic operation device;

[0009] The second task parameter is used to call the first cryptographic operation device to perform a cryptographic operation task;

[0010] The cryptographic operation device registration information at least includes calling parameters of a cryptographic service dynamic library, key type mapping information and key mechanism mapping information; the key type mapping information is mapping information between a general key type identifier and a private key type identifier of a cryptographic operation device; and the key mechanism mapping information is used to record the conversion relationship between a general key mechanism and a private key mechanism of a cryptographic operation device.

[0011] The application further provides an electronic device, comprising a memory for storing a computer program, and a processor for executing the computer program to implement the steps of the cryptographic operation device control method.

[0012] According to the application, the cryptographic operation device registration information created when the cryptographic operation device is accessed comprises at least the calling parameter of the cryptographic service dynamic library, the key type mapping information and the key mechanism mapping information, the key type mapping information is the mapping information between the general key type identifier and the private key type identifier of the cryptographic operation device, and the key mechanism mapping information is used to record the conversion relationship between the general key mechanism and the private key mechanism of the cryptographic operation device, thus providing a unified cryptographic operation device calling interface and general calling parameters such as the general key type identifier and the general key mechanism for the upper application program, and shielding the differences between different cryptographic operation device manufacturers for the upper application, so that the development of the upper application does not need to adapt to the differentiated content of different cryptographic operation device manufacturers, and only the general first task parameter needs to be transmitted to the cryptographic operation device calling interface to realize the calling of different cryptographic operation devices, thus significantly reducing the difficulty of using different cryptographic operation devices. BRIEF DESCRIPTION OF DRAWINGS

[0013] In order to more clearly illustrate the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort.

[0014] Figure 1 A flowchart of a cryptographic operation device control method provided for the embodiments of the present application;

[0015] Figure 2 An architecture diagram of a cryptographic operation system provided for the embodiments of the present application;

[0016] Figure 3 A flowchart of an encryption initialization stage of an encryption operation process provided for the embodiments of the present application;

[0017] Figure 4 A flowchart of an encryption update stage of an encryption operation process provided for the embodiments of the present application;

[0018] Figure 5 A flowchart of an encryption completion stage of an encryption operation process provided for the embodiments of the present application;

[0019] Figure 6 A flowchart of a decryption initialization stage of a decryption operation process provided for the embodiments of the present application;

[0020] Figure 7 A flowchart of a decryption update stage of a decryption operation process provided for an embodiment of the present application;

[0021] Figure 8 A flowchart of a decryption completion stage of a decryption operation process provided for an embodiment of the present application;

[0022] Figure 9 A flowchart of a key generation and synchronization process provided for an embodiment of the present application. DETAILED DESCRIPTION

[0023] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0024] It should be noted that, in the description of the present application, the terms “comprise”, “contain” or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms “first”, “second” and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0025] In order for those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0026] Embodiments of the present application provide a cryptographic operation device control method, and the method will be described in detail below in combination with the execution flow of the cryptographic operation device control method.

[0027] Figure 1 A flowchart of a cryptographic operation device control method provided for an embodiment of the present application.

[0028] As shown in Figure 1 The cryptographic operation device control method provided by the embodiments of the present application can include: S101: in response to a key calling command, identifying a first task parameter input based on a cryptographic operation device calling interface.

[0029] S102: determining a first cryptographic operation device to be called.

[0030] S103: converting the first task parameter into a second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device.

[0031] S104: calling the first cryptographic operation device to perform the cryptographic operation task by using the second task parameter.

[0032] The cryptographic operation device registration information at least includes a calling parameter of a cryptographic service dynamic library, key type mapping information and key mechanism mapping information; the key type mapping information is mapping information between a general key type identifier and a private key type identifier of the cryptographic operation device; and the key mechanism mapping information is used for recording a conversion relationship between a general key mechanism and a private key mechanism of the cryptographic operation device.

[0033] The cryptographic operation device control method provided in the embodiment of the application is applied to an electronic device in which a cryptographic operation device is installed, and the electronic device is deployed with a cryptographic operation program for calling the cryptographic operation device to perform a cryptographic operation task.

[0034] In the embodiment of the application, the cryptographic operation program can be a standard cryptographic operation program, such as a PKCS#11 application program. The PKCS#11 is a part of the Public-Key Cryptography Standards, and its core is to map the cryptographic operation device to a logical view of a device as a “cryptographic token”, and to provide a unified cryptographic token interface (Cryptoki) to operate the cryptographic device to perform encryption, decryption, digital signature, key management and other cryptographic operations. With the continuous enrichment of key types, cryptographic operation device manufacturers have added related functions of various key types on the PKCS#11 implementation library to reuse the PKCS#11 interface. On the other hand, in order to use multiple types of keys and actively disperse risks, electronic devices also actively use the strategy of coexistence of cryptographic operation devices of multiple manufacturers, aiming to build a more resilient and secure cryptographic infrastructure. However, the application program of the traditional PKCS#11 library interacts with a specific cryptographic operation device through the PKCS#11 interface of the cryptographic service dynamic library (Provider) of the cryptographic operation device of a single manufacturer to complete the cryptographic operation, but the PKCS#11 standard interface lacks native support for many key types, resulting in incompatible expansion functions of key types between manufacturers, and the need to redevelop and adapt when replacing cryptographic operation devices of different manufacturers, causing resource waste.

[0035] To this end, the cryptographic operation device control method provided in the embodiment of the application aims to shield the differences in the cryptographic operation functions of different key types realized by the standard cryptographic operation program of each manufacturer, and to reduce the development complexity when the electronic device is installed with multiple cryptographic operation devices.

[0036] The control method of the cryptographic operation device can be realized based on an adapter core layer arranged between a cryptographic operation program and a calling interface of each cryptographic operation device.

[0037] Figure 2 An architecture diagram of a cryptographic operation system is provided for the embodiment of the present application.

[0038] As shown in Figure 2 The adapter core layer provided by the embodiment of the present application can include a device management submodule, a key management submodule and an adaptation submodule.

[0039] The device management submodule is used for managing each cryptographic operation device and can include registration of the cryptographic operation device, dynamic library loading, initialization, uninstalling and scheduling of the standard cryptographic operation program and the like. Through the cryptographic operation device registration service, when the cryptographic operation device of a new vendor is accessed, only the related configuration items need to be added, without the need to modify the code.

[0040] The cryptographic operation device registration service can be automatically executed when the adapter core layer is loaded in the application layer, and the initialization process thereof can include: (1) reading and analyzing the local configuration file and the key index file to obtain the detailed information of the accessed cryptographic operation device; (2) dynamically loading the cryptographic service dynamic library (Provider) provided by each vendor; and (3) constructing the related mapping information, which can include device mapping information, key type mapping information and key mechanism mapping information.

[0041] The device mapping information can be in the form of a device mapping table and can be used to record the correspondence between the vendor ID and the path of the cryptographic service dynamic library (Provider).

[0042] The key type mapping information can be in the form of a key type mapping table and is used to realize the conversion from the standard key type (such as CKK_Proxy_SM4) to the private key type of the vendor (such as CKK_VENDOR_SM4).

[0043] The key mechanism mapping information can be in the form of a key mechanism mapping table and is used to realize the conversion from the key mechanism defined by the adapter core layer (such as CKM_Proxy_SM4_CBC) to the extended key mechanism of the vendor (such as CKM_VENDOR_SM4_CBC).

[0044] The cryptographic operation device scheduling service is used when the application layer calls the key to perform the cryptographic operation task and the key generation and other key operations. Through the cryptographic operation device scheduling service, the cryptographic operation device meeting the requirements is scheduled to perform the cryptographic operation task input by the application layer.

[0045] The cryptographic operation device offloading service is used after completing a cryptographic operation task. Through the cryptographic operation device offloading service, resources are safely cleaned up, loaded cryptographic service dynamic libraries are sequentially unloaded (for example, in reverse order of loading time), various mapping tables and statistical information established during the cryptographic operation device registration stage are emptied, and no resource residues are ensured.

[0046] The key management sub-module is responsible for managing keys in the electronic device, and can include key generation, update, destruction, and key identification management.

[0047] The adaptation sub-module is a bridge between the application layer of the standard cryptographic operation program and the device layer of the cryptographic operation device, and is responsible for the interface of the standard cryptographic operation program. The adaptation sub-module does not convert the key types originally provided by the standard cryptographic operation program, and performs bidirectional conversion between the task parameters of the cryptographic operation task transmitted by the application layer and the task parameters of the cryptographic operation device of each vendor, thereby shielding the differences between the underlying cryptographic operation device for the application layer and solving the compatibility problem.

[0048] The driver layer is a cryptographic service dynamic library (Provider) provided by each cryptographic operation device vendor, which interacts with the adapter core layer through an application programming interface (API) provided by each cryptographic operation device vendor.

[0049] The device layer is a cryptographic operation device provided by each cryptographic operation device vendor supporting the standard cryptographic operation program protocol, which can be a heterogeneous device or a homogeneous device.

[0050] In the embodiments of the present application, the types of the cryptographic operation device can include but are not limited to a hardware security module (HSM), an encryption token, an encryption smart card, a hardware cryptographic operation device installed with a software cryptographic module, and the like.

[0051] In the embodiments of the present application, the types of the cryptographic operation task can include but are not limited to an encryption task, a decryption task, a signature task, a signature verification task, and the like.

[0052] In the embodiments of the present application, when a new cryptographic operation device is registered, various types of cryptographic operation device registration information are registered for the cryptographic operation device, respectively.

[0053] For S101, the adapter core layer identifies the first task parameter input based on the cryptographic operation device calling interface in response to the key calling command of the upper layer application.

[0054] For S102, the first cryptographic operation device to be called can be determined according to the first task parameter.

[0055] In some optional embodiments of the present application, the plurality of cryptographic operation devices on the device can be scheduled.

[0056] The determination of the first cryptographic operation device to be invoked in S102 can also include: determining a first candidate cryptographic operation device having the target key according to the identification of the target key included in the first task parameter; and determining the first cryptographic operation device according to the running state parameter of the first candidate cryptographic operation device.

[0057] In the embodiments of the present application, the running state parameter of the cryptographic operation device can be time consumption information of the cryptographic operation device in performing a cryptographic operation task. The recording step of the time consumption information of the cryptographic operation device in performing the cryptographic operation task can include: starting timing when task initialization is completed when the cryptographic operation device is invoked to perform the cryptographic operation task, and ending timing when the cryptographic operation device finishes performing the cryptographic operation task, to obtain time consumption information of the cryptographic operation device in performing the cryptographic operation task once.

[0058] In specific implementation, a cryptographic operation time consumption statistics table can be maintained in the cryptographic operation device scheduling service of the adapter core layer, which can be used to record related fields of the operation type, the identification of the cryptographic operation device and the time consumption information when the application layer invokes the cryptographic operation device, and the average time consumption of different cryptographic operation devices in performing various cryptographic operations is recorded by a preset operation function as the core basis for scheduling the cryptographic operation device.

[0059] On the basis of the above-mentioned adapter core layer adaptation sub-module, in the embodiments of the present application, the first task parameter includes a first key type identification, a first key mechanism, a first session handle, an identification of a first target key and a pointer of a first function list pointer. The conversion of the first task parameter into a second task parameter corresponding to the first cryptographic operation device in S103 according to the cryptographic operation device registration information of the first cryptographic operation device can include: querying the calling parameter of the first cryptographic service dynamic library, the first key type mapping information and the first key mechanism mapping information corresponding to the first cryptographic operation device according to the identification of the first cryptographic operation device; converting the first key type identification into a second key type identification corresponding to the first cryptographic operation device according to the first key type mapping information; converting the first key mechanism into a second key mechanism corresponding to the first cryptographic operation device according to the first key mechanism mapping information; querying the first cryptographic service dynamic library to obtain a second session handle corresponding to the first session handle and a pointer of a second function list pointer corresponding to the pointer of the first function list pointer; and taking the second key type identification, the second key mechanism, the second session handle, the identification of the first target key and the pointer of the second function list pointer as the second task parameter.

[0060] The password type identifier is used to indicate the key type adopted by the current password operation task, which represents the mathematical property and structural category of the key itself, such as SM4 symmetric encryption.

[0061] In the PKCS#11 standard, the password mechanism is full name "Cryptographic Mechanism", which is used to uniquely determine which basic password algorithm (such as AES, SM4, RSA, SM2) is used in the password operation task, how to use the algorithm (such as CBC, ECB, PKCS#1-Padding, or for signature, encryption, etc.), optional other specific parameters (such as initialization vector, parameters for key derivation, etc.), usually represented by a constant (such as CKM_AES_CBC, CKM_SM2).

[0062] The session handle is a unique identifier of the password operation task, and if the password operation task is executed in multiple stages (such as initialization stage, update stage, completion stage), the same session handle must be used to maintain the operation context. The session handle is usually passed in the initialization stage.

[0063] The identification of the key refers to the identification of the key used to call the key in the electronic device, which is the identification corresponding to the key itself (different types of keys or different keys of the same type have different identifications).

[0064] The function list pointer is a pointer to a variable that stores the address of the function list pointer, which is used to call the functions required by the password operation task.

[0065] In the embodiment of the application, the first task parameter passed in by the application layer is converted into the second task parameter that can call the specific password operation device through the pre-constructed mapping information, the difference between the underlying password operation device is shielded from the application layer, and the adaptation of the password operation device of different manufacturers is realized.

[0066] The password operation device control method provided by the embodiment of the present application, by creating password operation device registration information for the password operation device when the password operation device is accessed, the password operation device registration information at least includes calling parameters of a password service dynamic library, key type mapping information and key mechanism mapping information, the key type mapping information is mapping information between a general key type identifier and a private key type identifier of the password operation device, and the key mechanism mapping information is used for recording conversion relationship between a general key mechanism and a private key mechanism of the password operation device, a unified password operation device calling interface and general calling parameters such as the general key type identifier and the general key mechanism are provided for an upper application program, and differences between different password operation device manufacturers are shielded for the upper application, so that in the development of the upper application, it is not necessary to adapt to different password operation device manufacturers, and only the general first task parameters are input into the password operation device calling interface, and then the calling of different password operation devices can be realized, so that the difficulty of using different password operation devices is significantly reduced.

[0067] In the related art, the use of the key depends on a specific physical handle, and transparent access and cross-device sharing cannot be realized among multiple devices. To solve this problem, on the basis of the above embodiment, in the password operation device control method provided by the embodiment of the present application, the password operation device registration information can further include key index mapping information, the key index mapping information is mapping information between a unique identifier of the key in the password operation system and a device identifier of the key in the password operation device; and the password operation system includes multiple password operation devices installed in the same device.

[0068] In a specific implementation, the key index mapping information can be in the form of a mapping table, and can be used to record the mapping relationship between the unique identifier of the key in the electronic device and the identifier of the key in the password operation device, wherein the unique identifier of the key in the electronic device can be a virtual key handle, and the identifier of the key in the password operation device can be a physical key handle.

[0069] Then, the key identifier management service of the key management submodule of the adapter core layer can realize cross-device management of the key by maintaining the key index mapping information.

[0070] In this embodiment of the invention, the first task parameter may include a first key type identifier, a first key mechanism, a first session handle, a unique identifier of the first target key, and a pointer to a first function list pointer, through the adapter submodule of the adapter core layer. In step S103, converting the first task parameters into second task parameters corresponding to the first cryptographic computing device based on the cryptographic computing device registration information of the first cryptographic computing device may include: querying the call parameters, first key type mapping information, first key mechanism mapping information, and first key index mapping information of the first cryptographic computing device corresponding to the first cryptographic computing device based on the identifier of the first cryptographic computing device; converting the first key type identifier into a second key type identifier corresponding to the first cryptographic computing device based on the first key type mapping information; converting the first key mechanism into a second key mechanism corresponding to the first cryptographic computing device based on the first key mechanism mapping information; obtaining the first device identifier of the first target key on the first cryptographic computing device based on the unique identifier of the first target key and the first key index mapping information; querying the first cryptographic service dynamic library to obtain the second session handle corresponding to the first session handle and the pointer to the second function list pointer corresponding to the pointer to the first function list pointer; and using the second key type identifier, the second key mechanism, the second session handle, the first device identifier of the first target key, and the pointer to the second function list pointer as the second task parameters.

[0071] The unique identifier of the first target key can be the virtual key handle of the first target key, and the first device identifier of the first target key can be the physical key handle of the first target key.

[0072] Through the embodiments of the present invention, the differences between different cryptographic computing devices can be completely shielded from the application layer. The application layer does not need to care which cryptographic computing device performed the cryptographic computing task, thereby further facilitating the load balancing scheduling of multiple cryptographic computing devices by the cryptographic computing device scheduling service of the adapter core layer, while alleviating the workload of the application layer and improving the execution efficiency of cryptographic computing tasks.

[0073] The following describes a practical application scenario of the cryptographic operation device control method provided in this embodiment of the invention, using the SM4 symmetric encryption and decryption operation process as an example.

[0074] Symmetric encryption operations can include three stages: encryption initialization, encryption update, and encryption completion.

[0075] Figure 3 This is a flowchart of the encryption initialization stage of an encryption operation process provided in an embodiment of the present invention.

[0076] like Figure 3 As shown, based on the adapter core layer, the encryption initialization phase of symmetric encryption may include: S301: Inputting task parameters.

[0077] The upper layer initializes the task parameter of the incoming call encryption initialization function, which can be denoted as a first task parameter, and can include a first key type identifier, a first key mechanism, a first session handle, a virtual key handle of a first target key, and a pointer of a first function list pointer.

[0078] For example, the upper layer application calls the encryption initialization function (Proxy_C_EncryptInit) of the adapter core layer, and inputs the first key mechanism (such as CKM_Proxy_SM4_CBC) of the SM4 symmetric encryption operation, the virtual key handle, the session handle, and the pointer of the function list pointer, wherein the first two parameters are input parameters, and the session handle and the pointer of the function list pointer are input-output parameters.

[0079] S302: Determine the first cryptographic operation device to be called based on the cryptographic operation time consumption statistical table.

[0080] The function internally calls the cryptographic operation device scheduling service, and selects the optimal key operation device as the first key operation device based on the cryptographic operation time consumption statistical table.

[0081] S303: Perform task parameter conversion.

[0082] In a specific implementation, according to the identifier of the first key operation device, a related mapping table established in the registration stage is queried to complete related mapping: (1) mechanism mapping: converting the general key mechanism (such as CKM_Proxy_SM4_CBC) defined by the adapter core layer into the key mechanism (such as CKM_VENDOR__SM4_CBC) extended by the vendor. (2) Key type mapping: converting the general identifier of the key type defined by the adapter core layer into the identifier of the key type on the first cryptographic operation device. (3) Handle mapping: mapping the virtual key handle (vhkey) of the key into the physical key handle (pkey) of the first key operation device. (4) According to the identifier of the first key operation device, the device registry is queried to obtain the session handle and the function list pointer.

[0083] S304: Execute the encryption initialization function.

[0084] In a specific implementation, the encryption initialization function (C_EncryptInit) is called through the pointer of the second function list pointer to perform encryption initialization, and the specific parameters passed are the second key type identifier, the second key mechanism, the second session handle, the physical key handle of the first target key, and the pointer of the second function list pointer obtained in S303.

[0085] S305: Determine whether the initialization is successful. If yes, proceed to S306; if no, proceed to S308.

[0086] S306: Assign the pointer of the session handle and the function list pointer to the output parameter.

[0087] S307: Return the success flag.

[0088] S308: Return the error information.

[0089] After the execution of the encryption initialization function is completed, it is determined whether the initialization is successful. If not, the error code is directly returned. If yes, the pointer of the session handle and the function list pointer is assigned to the output parameter, and the success flag is returned, so that the application layer can enter the subsequent stage of symmetric encryption.

[0090] Figure 4 A flowchart of an encryption update stage of an encryption operation process provided by an embodiment of the present application.

[0091] In some encryption scenarios, for example, when a long plaintext needs to be encrypted, the plaintext often needs to be segmented for segmented encryption, which is performed in the encryption update stage.

[0092] As shown in FIG. 4, taking segmented encryption as an example, the encryption update stage of symmetric encryption based on the adapter core layer can include the following steps. Figure 4

[0093] In a specific implementation, the application layer calls the segmented encryption function (Proxy_C_EncryptUpdate) of the adapter core layer, and inputs the pointer of the function list pointer, the session handle, the plaintext to be encrypted, and the information of the buffer for storing the ciphertext. The buffer can be an input-output buffer.

[0094] S402: Start timing.

[0095] S403: Perform segmented encryption.

[0096] In a specific implementation, the segmented encryption function (C_EncryptUpdate) is called through the pointer of the function list pointer to perform segmented encryption, and the specific parameters of the function are the session handle, the plaintext to be encrypted, and the information of the buffer for storing the ciphertext.

[0097] S404: Return the encryption result to the application layer.

[0098] After the segmented encryption is completed, the encryption result (such as intermediate data) is returned to the application layer. At this time, the timing can be stopped to obtain the time consumption information corresponding to the encryption update stage, or the timing can be continued.

[0099] Figure 5 ​A flow chart of an encryption completion stage of an encryption operation process provided for an embodiment of the present application.

[0100] As shown in Figure 5 , based on the adapter core layer, the completion stage of symmetric encryption can include: S501: passing in task parameters and buffer information.

[0101] In a specific implementation, the application layer calls the encryption completion function (Proxy_C_EncryptFinal) of the adapter core layer, and passes in the pointer of the function list pointer, the session handle, and the information of the buffer for storing the ciphertext. The buffer can be an input-output buffer.

[0102] S502: timing.

[0103] In a specific implementation, it can be superimposed timing based on the previous stage, or it can be separate timing of this stage.

[0104] S503: executing the encryption completion function.

[0105] The encryption completion function (C_EncryptFinal) is called by the pointer of the function list pointer to execute the decryption completion function, and the specific parameters of the function are the session handle and the buffer for storing the plaintext, wherein the buffer for storing the plaintext is an input-output buffer.

[0106] S504: returning the encryption result.

[0107] In a specific implementation, after the encryption completion function is executed, the time consumption information of local encryption is recorded, and the password operation time consumption statistical table is updated.

[0108] The symmetric encryption operation can include three stages of decryption initialization, decryption update, and decryption completion.

[0109] Figure 6 A flow chart of a decryption initialization stage of a decryption operation process provided for an embodiment of the present application.

[0110] As shown in Figure 6 , based on the adapter core layer, the decryption initialization stage of symmetric encryption can include: S601: passing in task parameters.

[0111] The upper layer initializes the task parameters calling the decryption initialization function, which can be recorded as the first task parameters, and can include the first key type identifier, the first key mechanism, the first session handle, the virtual key handle of the first target key, and the pointer of the first function list pointer.

[0112] For example, the upper application calls the decryption initialization function (Proxy_C_DecryptInit) of the adapter core layer, and inputs the first key mechanism (such as CKM_Proxy_SM4_CBC) of the SM4 symmetric encryption operation, the virtual key handle, the session handle and the pointer of the function list pointer, wherein the first two parameters are input parameters, and the session handle and the pointer of the function list pointer are input and output parameters.

[0113] S602: determining the first cryptographic operation device to be called based on the cryptographic operation time consumption statistical table.

[0114] The function internally calls the cryptographic operation device scheduling service, and selects the optimal key operation device as the first key operation device based on the cryptographic operation time consumption statistical table.

[0115] S603: performing task parameter conversion.

[0116] In a specific implementation, according to the identifier of the first key operation device, the related mapping table established in the registration stage is queried to complete the related mapping: (1) mechanism mapping: converting the general key mechanism (such as CKM_Proxy_SM4_CBC) defined by the adapter core layer into the key mechanism (such as CKM_VENDOR__SM4_CBC) extended by the vendor. (2) key type mapping: converting the general identifier of the key type defined by the adapter core layer into the identifier of the key type on the first cryptographic operation device. (3) handle mapping: mapping the virtual key handle (vhkey) of the key into the physical key handle (pkey) of the first key operation device. (4) querying the device registry according to the identifier of the first key operation device to obtain the session handle and the function list pointer.

[0117] S604: executing the decryption initialization function.

[0118] In a specific implementation, the decryption initialization function (C_DecryptInit) is called through the pointer of the second function list pointer to perform decryption initialization, and the specific parameters passed in are the second key type identifier, the second key mechanism, the second session handle, the physical key handle of the first target key and the pointer of the second function list pointer obtained in S603.

[0119] S605: judging whether the initialization is successful. If yes, S606 is entered; if no, S608 is entered.

[0120] S606: assigning the session handle and the pointer of the function list pointer as output parameters.

[0121] S607: returning a success flag.

[0122] S608: returning error information.

[0123] After the decryption initialization function is executed, it is determined whether the initialization is successful. If not, an error code is directly returned. If yes, the session handle and the pointer of the function list pointer are assigned to the output parameters, and a success flag is returned, so that the application layer can enter the subsequent stage of decryption.

[0124] Figure 7 A flowchart of a decryption update stage of a decryption operation process is provided for an embodiment of the present application.

[0125] Similarly to the symmetric encryption process, for longer ciphertexts, segmented decryption also needs to be performed.

[0126] As shown in the figure, taking segmented decryption as an example, based on the adapter core layer, the decryption update stage of symmetric encryption can include the following steps: Figure 7 S701: passing in the task parameters, plaintext to be decrypted, and buffer information.

[0127] In a specific implementation, the application layer calls the segmented decryption function (Proxy_C_DecryptUpdate) of the adapter core layer, and passes in the pointer of the function list pointer, the session handle, the plaintext to be decrypted, and the information of the buffer for storing the ciphertext. The buffer can be an input-output buffer.

[0128] S702: starting timing.

[0129] S703: performing segmented decryption.

[0130] In a specific implementation, the segmented decryption function (C_DecryptUpdate) is called through the pointer of the function list pointer to perform segmented decryption, and the specific parameters of the function are the session handle, the plaintext to be decrypted, and the information of the buffer for storing the ciphertext.

[0131] S704: returning the decryption result to the application layer.

[0132] After the segmented decryption is completed, the decryption result (such as intermediate data) is returned to the application layer. At this time, the timing can be stopped to obtain the time consumption information corresponding to the decryption update stage, or the timing can be continued.

[0133] Figure 8 A flowchart of a decryption completion stage of a decryption operation process is provided for an embodiment of the present application.

[0134] As shown in the figure, based on the adapter core layer, the completion stage of symmetric encryption can include the following steps: Figure 8 S801: passing in the task parameters and buffer information.

[0135]

[0136] ​In a specific implementation, the application layer calls a decryption completion function (Proxy_C_DecryptFinal) of the adapter core layer, and passes in a pointer to a pointer to a function list pointer, a session handle, and information of a buffer for storing ciphertext. The buffer can be an input-output buffer.

[0137] S802: Timing.

[0138] In a specific implementation, the timing can be superimposed on the basis of the previous stage, or can be separate timing of the current stage.

[0139] S803: Execute the decryption completion function.

[0140] The decryption completion function is called through the pointer to the function list pointer to execute the decryption completion function, and the specific parameters of the function are a session handle and a buffer for storing plaintext, wherein the buffer for storing plaintext is an input-output buffer.

[0141] S804: Return the decryption result.

[0142] In a specific implementation, after the decryption completion function is executed, the time consumption information of local decryption is recorded, and a password operation time consumption statistical table is updated.

[0143] For the key generation task, the password operation device control method provided by the embodiment of the application can further include: in response to a key generation command, identifying third task parameters input based on a password operation device calling interface; determining a source password operation device for generating a second target key; converting the third task parameters into fourth task parameters for the source password operation device according to password operation device registration information of the source password operation device; and calling the source password operation device to execute the key generation task by using the fourth task parameters.

[0144] In a specific implementation, the password operation device registration information can further include key index mapping information, the key index mapping information being mapping information between a unique identifier of a key in a password operation system and a device identifier of the key in the password operation device; and the password operation system including a plurality of password operation devices installed in the same device. Then, calling the source password operation device to execute the key generation task by using the fourth task parameters can include: calling the source password operation device to generate the second target key by using the fourth task parameters, and determining a second device identifier of the second target key on the source password operation device; determining a unique identifier of the second target key in the password operation system; and adding mapping information between the unique identifier of the second target key and the second device identifier of the second target key in the key index mapping information.

[0145] If the password operation device registration information further comprises key index mapping information, the key index mapping information is mapping information between the unique identifier of the key in the password operation system and the device identifier of the key in the password operation device; the password operation system comprises a plurality of password operation devices installed in the same device; the password operation device control method provided by the embodiment of the present application can further comprise: determining a second password operation device; after the source password operation device generates a second target key, determining a second device identifier of the second target key on the source password operation device; determining the unique identifier of the second target key in the password operation system; controlling the source password operation device to encrypt and synchronize the second target key to the second password operation device, and determining a third device identifier of the second target key on the second password operation device; adding, in the key index mapping information, mapping information between the unique identifier of the second target key and the second device identifier of the second target key and mapping information between the unique identifier of the second target key and the third device identifier of the second target key.

[0146] Further, before adding, in the key index mapping information, the mapping information between the unique identifier of the second target key and the second device identifier of the second target key and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key, the password operation device control method provided by the embodiment of the present application can further comprise: performing consistency verification on the second target key on the source password operation device and the second target key on the second password operation device; in the case that the consistency verification passes, adding, in the key index mapping information, the mapping information between the unique identifier of the second target key and the second device identifier of the second target key and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key; the password operation device control method further comprises: in the case that the consistency verification does not pass, deleting the second target key in the source password operation device and the second password operation device.

[0147] In the embodiment of the present application, the consistency verification on the second target key on the source password operation device and the second target key on the second password operation device can comprise: calling the source password operation device and the second password operation device to respectively encrypt preset information by using the local second target key to obtain an encryption result; if there is an inconsistent encryption result, it is determined that the consistency verification does not pass; otherwise, it is determined that the consistency verification passes.

[0148] Figure 9 A flowchart of a key generation and synchronization process provided by the embodiment of the present application.

[0149] As shown in FIG. 9, Figure 9 In the embodiment of the present application, the key generation and synchronization process can comprise: S901: generating a virtual key handle.

[0150] S902: Determine the source cryptographic operation device.

[0151] The upper layer application calls the application program interface function (Proxy_GenerateKey) of the adapter core layer for generating symmetric key, and passes in the parameters of the standard cryptographic operation program, taking PKCS#11 as an example, wherein the parameter pMechanism specifies the key generation mechanism, and the pTemplate is the template attribute, which sets the key name, encryption and decryption functions, and supports key wrapping.

[0152] The incoming parameters are preprocessed and converted, including mechanism mapping and template conversion.

[0153] The device scheduling module is called to select the device with the optimal performance as the source cryptographic operation device according to the key operation type (key generation).

[0154] S903: Establish the initial key identification mapping.

[0155] The device mapping table is queried to obtain the session handle of the source cryptographic operation device according to the identification of the source cryptographic operation device. According to the key index mapping information, the virtual key handle of the second target key to be generated is generated, which can be the maximum index number + 1 in the current key index mapping information. Thus, the initial key identification mapping of the second target key is established.

[0156] S904: Call the source cryptographic operation device to generate the second target key.

[0157] The key generation tool (C_GenerateKey) provided by the cryptographic service dynamic library of the source cryptographic operation device is called to pass in the converted task parameters, so as to generate the second target key and obtain the physical key handle of the second target key on the source cryptographic operation device.

[0158] S905: Add the mapping of the virtual key handle to the physical key handle in the key index mapping information.

[0159] The mapping of the virtual key handle of the second target key to the physical key handle of the second target key is added in the key index mapping information.

[0160] S906: Call the source cryptographic operation device to synchronize the second target key to the second cryptographic operation device.

[0161] In a specific implementation, the master key handle on the source cryptographic operation device is obtained as the handle of the wrapped second target key, and the standard wrapping function (C_WrapKey) is called to wrap (export) the newly generated second target key on the source cryptographic operation device. After the encrypted second target key is wrapped by means of another key, the encrypted second target key is synchronized to the second cryptographic operation device.

[0162] S907: After determining that the synchronization is completed, a physical key handle of the second target key on the second cryptographic operation device is acquired.

[0163] In a specific implementation, the session handle of each second cryptographic operation device is acquired through the device mapping table, each second cryptographic operation device is traversed, the encrypted second target key is imported (unwrapped) on each second cryptographic operation device, and the physical key handle returned after being imported on each second cryptographic operation device is recorded into the key index mapping information.

[0164] S908: The random number is encrypted by the source cryptographic operation device and each second cryptographic operation device.

[0165] S909: It is determined whether the encryption results are consistent. If yes, S910 is entered; if no, S912 is entered.

[0166] S910: The key index mapping information is confirmed to be updated.

[0167] S911: The virtual key handle of the second target key and a generation success identifier are returned.

[0168] S912: A rollback operation is performed, the second target key is deleted by traversing the source cryptographic operation device and each second cryptographic operation device.

[0169] S913: The key index mapping corresponding to the second target key is emptied.

[0170] S914: Error information is returned.

[0171] In a specific implementation, after the synchronization of the second target key is completed, a random number is generated for key consistency verification (the random number can be generated by calling a system function of an adapter core layer or generated by calling a key operation device), specifically, an encryption function based on a standard cryptographic operation program on the source cryptographic operation device and each second cryptographic operation device is called, and the random number is respectively encrypted by using the physical key handle of each second cryptographic operation device. Subsequently, the encryption results of the source cryptographic operation device and each second cryptographic operation device are compared. If the results are consistent, the consistency verification is successful, the virtual key mapping table in the memory and on the file is updated, and the virtual handle and a success state are returned; if the results are inconsistent, the consistency verification fails, all related cryptographic operation devices are traversed, a standard delete object function is called to delete the second target key that has been generated or synchronized, and error information is returned.

[0172] Those skilled in the art can clearly understand from the description of the above implementation mode that the method according to the above embodiment can be realized by means of software and a general hardware platform as required, of course, it can also be realized by hardware, but in many cases, the former is a better implementation mode.

[0173] The embodiment of the present application further provides a cryptographic operation device control device, comprising: a first response unit, configured to identify a first task parameter input based on a cryptographic operation device calling interface in response to a key calling command; a first determination unit, configured to determine a first cryptographic operation device to be called; a first conversion unit, configured to convert the first task parameter into a second task parameter corresponding to the first cryptographic operation device according to cryptographic operation device registration information of the first cryptographic operation device; and a first control unit, configured to call the first cryptographic operation device to execute a cryptographic operation task by using the second task parameter; wherein the cryptographic operation device registration information at least comprises calling parameters of a cryptographic service dynamic library, key type mapping information and key mechanism mapping information; the key type mapping information is mapping information between a general key type identifier and a private key type identifier of the cryptographic operation device; and the key mechanism mapping information is used to record a conversion relationship between a general key mechanism and a private key mechanism of the cryptographic operation device.

[0174] In the embodiment of the present application, the first task parameter can comprise a first key type identifier, a first key mechanism, a first session handle, an identifier of a first target key and a pointer of a first function list pointer; and the conversion of the first task parameter into the second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device can comprise: querying calling parameters of a first cryptographic service dynamic library corresponding to the first cryptographic operation device, the first key type mapping information and the first key mechanism mapping information according to the identifier of the first cryptographic operation device; converting the first key type identifier into a second key type identifier corresponding to the first cryptographic operation device according to the first key type mapping information; converting the first key mechanism into a second key mechanism corresponding to the first cryptographic operation device according to the first key mechanism mapping information; querying the first cryptographic service dynamic library to obtain a second session handle corresponding to the first session handle and a pointer of a second function list pointer corresponding to the pointer of the first function list pointer; and taking the second key type identifier, the second key mechanism, the second session handle, the identifier of the first key and the pointer of the second function list pointer as the second task parameter.

[0175] In the embodiment of the present application, the cryptographic operation device registration information can further comprise key index mapping information, which is mapping information between a unique identifier of a key in a cryptographic operation system and a device identifier of the key in the cryptographic operation device; and the cryptographic operation system comprises a plurality of cryptographic operation devices installed in the same device.

[0176] The first task parameter can include a first key type identifier, a first key mechanism, a first session handle, a unique identifier of a first target key, and a pointer of a first function list pointer; and the first task parameter is converted into a second task parameter corresponding to the first cryptographic operation device according to cryptographic operation device registration information of the first cryptographic operation device, which can include: querying calling parameters of a first cryptographic service dynamic library corresponding to the first cryptographic operation device, first key type mapping information, first key mechanism mapping information, and first key index mapping information according to an identifier of the first cryptographic operation device; converting the first key type identifier into a second key type identifier corresponding to the first cryptographic operation device according to the first key type mapping information; converting the first key mechanism into a second key mechanism corresponding to the first cryptographic operation device according to the first key mechanism mapping information; obtaining a first device identifier of the first target key on the first cryptographic operation device according to an identifier of the first target key and the first key index mapping information; querying the first cryptographic service dynamic library to obtain a second session handle corresponding to the first session handle and a pointer of a second function list pointer corresponding to the pointer of the first function list pointer; and taking the second key type identifier, the second key mechanism, the second session handle, the first device identifier of the first target key, and the pointer of the second function list pointer as the second task parameter.

[0177] The cryptographic operation device control device provided by the embodiment of the present application can further include: a second response unit configured to identify third task parameters input based on a cryptographic operation device calling interface in response to a key generation command; a second determination unit configured to determine a source cryptographic operation device for generating a second target key; a second conversion unit configured to convert the third task parameters into fourth task parameters for the source cryptographic operation device according to cryptographic operation device registration information of the source cryptographic operation device; and a second control unit configured to call the source cryptographic operation device to execute a key generation task by using the fourth task parameters.

[0178] In the embodiment of the present application, the cryptographic operation device registration information further includes key index mapping information, which is mapping information between a unique identifier of a key in a cryptographic operation system and a device identifier of the key in a cryptographic operation device; the cryptographic operation system includes a plurality of cryptographic operation devices installed in the same device; and calling the source cryptographic operation device to execute the key generation task by using the fourth task parameters can include: calling the source cryptographic operation device to generate the second target key by using the fourth task parameters, and determining a second device identifier of the second target key on the source cryptographic operation device; determining a unique identifier of the second target key in the cryptographic operation system; and adding mapping information between the unique identifier of the second target key and the second device identifier of the second target key in the key index mapping information.

[0179] If the password operation device registration information further comprises key index mapping information, the key index mapping information is mapping information between the unique identifier of the key in the password operation system and the device identifier of the key in the password operation device; the password operation device control device provided by the embodiment of the present application can further comprise: a third determination unit configured to determine a second password operation device; a third control unit configured to, after the source password operation device generates a second target key, determine a second device identifier of the second target key on the source password operation device; determine the unique identifier of the second target key in the password operation system; control the source password operation device to synchronize the encrypted second target key to the second password operation device, and determine a third device identifier of the second target key on the second password operation device; and add, in the key index mapping information, mapping information between the unique identifier of the second target key and the second device identifier of the second target key and mapping information between the unique identifier of the second target key and the third device identifier of the second target key.

[0180] The password operation device control device provided by the embodiment of the present application can further comprise: a verification unit configured to, before adding, in the key index mapping information, the mapping information between the unique identifier of the second target key and the second device identifier of the second target key and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key, perform consistency verification on the second target key on the source password operation device and the second target key on the second password operation device; in the case that the consistency verification is passed, add, in the key index mapping information, the mapping information between the unique identifier of the second target key and the second device identifier of the second target key and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key; and in the case that the consistency verification is not passed, delete the second target key in the source password operation device and the second password operation device.

[0181] In the embodiment of the present application, the first password operation device to be called can comprise: determining a first candidate password operation device having the target key according to the identifier of the target key included in the first task parameter; and determining the first password operation device according to the running state parameter of the first candidate password operation device. The running state parameter of the password operation device can be time consumption information of the password operation device performing the password operation task; the password operation device control provided by the embodiment of the present application can further comprise: a time consumption monitoring unit configured to monitor the time consumption information of the password operation device performing the password operation task.

[0182] The features of the embodiments corresponding to the password operation device control device can be referred to the related descriptions of the embodiments corresponding to the password operation device control method, which will not be repeated here.

[0183] The embodiment of the present application also provides an electronic device, comprising a memory and a processor, the memory stores a computer program, and the processor is arranged to run the computer program to execute the steps in any of the above-mentioned cryptographic operation device control method embodiments.

[0184] The embodiment of the present application also provides a non-volatile storage medium, which stores a computer program, wherein the computer program is arranged to execute the steps in any of the above-mentioned cryptographic operation device control method embodiments when running.

[0185] In an example embodiment, the above-mentioned non-volatile storage medium can include but is not limited to a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0186] The embodiment of the present application also provides a computer program product, which comprises a computer program, and the computer program is arranged to execute the steps in any of the above-mentioned cryptographic operation device control method embodiments when running by a processor.

[0187] The embodiment of the present application also provides another computer program product, which comprises a non-volatile storage medium, and the non-volatile storage medium stores a computer program, and the computer program is arranged to execute the steps in any of the above-mentioned cryptographic operation device control method embodiments when running by a processor.

[0188] The skilled person can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in general terms in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0189] The above has introduced in detail a cryptographic operation device control method and an electronic device provided by the present application. The principles and implementation manners of the present application have been described by applying specific examples in this paper, and the above description of the examples is only applicable to help understand the method of the present application and its core idea. It should be pointed out that for ordinary skilled persons in the technical field, without departing from the principles of the present application, some improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the present application.

Claims

1. A method of controlling a cryptographic operation device, characterized by, The method comprises the following steps: in response to a key calling command, identifying a first task parameter input by a cryptographic operation device calling interface; determining a first cryptographic operation device to be called; converting the first task parameter into a second task parameter corresponding to the first cryptographic operation device according to cryptographic operation device registration information of the first cryptographic operation device; calling the first cryptographic operation device to perform a cryptographic operation task by using the second task parameter; wherein the cryptographic operation device registration information at least comprises calling parameters of a cryptographic service dynamic library, key type mapping information and key mechanism mapping information; the key type mapping information is mapping information between a general key type identifier and a private key type identifier of a cryptographic operation device; the key mechanism mapping information is used to record a conversion relationship between a general key mechanism and a private key mechanism of a cryptographic operation device; the first task parameter comprises a first key type identifier, a first key mechanism, a first session handle, an identifier of a first target key and a pointer of a first function list pointer; converting the first task parameter into a second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device comprises: querying calling parameters of a first cryptographic service dynamic library corresponding to the first cryptographic operation device, first key type mapping information and first key mechanism mapping information according to the identifier of the first cryptographic operation device; converting the first key type identifier into a second key type identifier corresponding to the first cryptographic operation device according to the first key type mapping information; converting the first key mechanism into a second key mechanism corresponding to the first cryptographic operation device according to the first key mechanism mapping information; querying the first cryptographic service dynamic library to obtain a second session handle corresponding to the first session handle and a pointer of a second function list pointer corresponding to the pointer of the first function list pointer; taking the second key type identifier, the second key mechanism, the second session handle, the identifier of the first target key and the pointer of the second function list pointer as the second task parameter; wherein functions in the first function list pointer and the second function list pointer are functions required by the cryptographic operation task.

2. The cryptographic operation device control method according to claim 1, characterized by, the cryptographic operation device registration information further comprises key index mapping information, which is mapping information between a unique identifier of a key in a cryptographic operation system and a device identifier of a key in a cryptographic operation device; the cryptographic operation system comprises a plurality of cryptographic operation devices installed in the same device.

3. The cryptographic operation device control method according to claim 2, wherein the first task parameter comprises a first key type identifier, a first key mechanism, a first session handle, a unique identifier of a first target key and a pointer of a first function list pointer; converting the first task parameter into a second task parameter corresponding to the first cryptographic operation device according to the cryptographic operation device registration information of the first cryptographic operation device comprises: According to the identification of the first cryptographic operation device, the calling parameters, the first key type mapping information, the first key mechanism mapping information and the first key index mapping information of the first cryptographic service dynamic library corresponding to the first cryptographic operation device are queried; According to the first key type mapping information, the first key type identifier is converted into a second key type identifier corresponding to the first cryptographic operation device; According to the first key mechanism mapping information, the first key mechanism is converted into a second key mechanism corresponding to the first cryptographic operation device; According to the unique identifier of the first target key and the first key index mapping information, a first device identifier of the first target key on the first cryptographic operation device is obtained; The first cryptographic service dynamic library is queried to obtain a second session handle corresponding to the first session handle and a second function list pointer corresponding to the pointer of the first function list pointer; The second key type identifier, the second key mechanism, the second session handle, the first device identifier of the first target key and the pointer of the second function list pointer are used as the second task parameters.

4. The password operation device control method according to claim 1, characterized by, Further comprising: In response to a key generation command, third task parameters input based on the cryptographic operation device calling interface are identified; A source cryptographic operation device for generating a second target key is determined; According to the cryptographic operation device registration information of the source cryptographic operation device, the third task parameters are converted into fourth task parameters for the source cryptographic operation device; The source cryptographic operation device is called to execute a key generation task using the fourth task parameters.

5. The password operation device control method according to claim 4, characterized by, The cryptographic operation device registration information further comprises key index mapping information, which is mapping information between the unique identifier of a key in a cryptographic operation system and the device identifier of the key in a cryptographic operation device; The cryptographic operation system comprises a plurality of cryptographic operation devices installed on the same device; The source cryptographic operation device is called to execute a key generation task using the fourth task parameters, comprising: The source cryptographic operation device is called to generate the second target key using the fourth task parameters, and a second device identifier of the second target key on the source cryptographic operation device is determined; The unique identifier of the second target key in the cryptographic operation system is determined; Mapping information between the unique identifier of the second target key and the second device identifier of the second target key is added in the key index mapping information.

6. The password operation device control method according to claim 4, wherein The cryptographic operation device registration information further comprises key index mapping information, which is mapping information between the unique identifier of a key in a cryptographic operation system and the device identifier of the key in a cryptographic operation device; The cryptographic operation device control method further comprises: A second cryptographic operation device is determined; After the second target key is generated on the source cryptographic operation device, a second device identifier of the second target key on the source cryptographic operation device is determined; The unique identifier of the second target key in the cryptographic operation system is determined; controlling the source cryptographic operation device to encrypt and synchronize the second target key to the second cryptographic operation device, and determining a third device identifier of the second target key on the second cryptographic operation device; adding mapping information between a unique identifier of the second target key and the second device identifier of the second target key and mapping information between the unique identifier of the second target key and the third device identifier of the second target key in the key index mapping information.

7. The password operation device control method according to claim 6, characterized by, Before the adding of the mapping information between the unique identifier of the second target key and the second device identifier of the second target key and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key in the key index mapping information, the method further comprises: performing consistency verification on the second target key on the source cryptographic operation device and the second target key on the second cryptographic operation device; in the case of passing of the consistency verification, adding the mapping information between the unique identifier of the second target key and the second device identifier of the second target key and the mapping information between the unique identifier of the second target key and the third device identifier of the second target key in the key index mapping information; the cryptographic operation device control method further comprises: in the case of failing of the consistency verification, deleting the second target key in the source cryptographic operation device and the second cryptographic operation device.

8. The password operation device control method according to claim 1, wherein determining a first cryptographic operation device to be called, comprising: determining a first candidate cryptographic operation device having a target key according to an identifier of the target key included in the first task parameter; determining the first cryptographic operation device according to a running state parameter of the first candidate cryptographic operation device.

9. The cryptographic operation device control method according to claim 8, characterized by, the running state parameter of the cryptographic operation device is time consumption information of the cryptographic operation device performing a cryptographic operation task; the recording step of the time consumption information of the cryptographic operation device performing the cryptographic operation task comprises: when the cryptographic operation device is called to perform the cryptographic operation task, starting timing when task initialization is completed, and ending timing when the cryptographic operation device finishes performing the cryptographic operation task, to obtain time consumption information of the cryptographic operation device performing the cryptographic operation task once.

10. An electronic device, comprising: comprising: a memory for storing a computer program; a processor for implementing steps of the cryptographic operation device control method according to any one of claims 1 to 9 when executing the computer program.

Images