PCI-E password card key backup and recovery method and device

Abstract

The embodiment of the invention discloses a PCI-E password card key backup and recovery method and device, and the method comprises the steps: distributing a first cache space according to the maximum number of keys which can be received by an application program at the same time in a backup process, obtaining the maximum number of user keys from a PCI-E password card for at least one time, and storing the user keys in the first cache space, and performing encryption calculation on the user key in the first cache space through the backup key, and storing the user key in the application program. In the recovery process, a second cache space is distributed according to the maximum receiving data length received by the PCI-E password card at the same time, multiple ciphertext user keys are obtained from the application program at least once and stored in the second cache space, and the ciphertext user keys in the second cache space are decrypted through the backup key and then stored in the PCI-E password card. According to the embodiment of the invention, batch secret key backup and recovery can be realized by distributing the cache space, the data transmission frequency is reduced, and the efficiency of the backup and recovery process is improved.

Description

TECHNICAL FIELD

[0001] The embodiment of the present application relates to the technical field of computer, and relates to but not limited to a PCI-E cryptographic card key backup and recovery method and device. BACKGROUND

[0002] The PCI-E cryptographic card is a software and hardware combined cryptographic product, integrated in a server end product, and can provide key management functions such as key generation, key backup and recovery, and cryptographic operation functions. The key backup and recovery is one of the important functions of the PCI-E cryptographic card. However, in the prior art, the user keys of a single index are encrypted and exported to the PCI-E cryptographic card or decrypted and imported to the PCI-E cryptographic card when the key backup and recovery is performed. Such a cycle is repeated until the user key of the last index is encrypted and exported to the PCI-E cryptographic card or decrypted and imported to the PCI-E cryptographic card. When the number of user keys is large and the keys of multiple PCI-E cryptographic cards are synchronized, the time for the key backup and recovery is very slow, and the experience of the user is greatly reduced. SUMMARY

[0003] Therefore, the PCI-E cryptographic card key backup and recovery method and device provided by the embodiment of the present application can realize batch key backup and recovery by allocating cache space, reduce the number of data transmission times, and improve the efficiency of the backup and recovery process.

[0004] The PCI-E cryptographic card key backup and recovery method and device provided by the embodiment of the present application are realized as follows: In an aspect of the embodiment of the present application, a PCI-E cryptographic card key backup method is provided, including: allocating a first cache space according to a maximum key number, the maximum key number being used to represent the maximum number of keys that can be simultaneously received by an application program; storing a maximum key number of user keys from a PCI-E cryptographic card to the first cache space at least once, and the user keys stored each time are not repeated; after completing the storage of the user keys each time, performing an encryption calculation on the user keys in the first cache space by a backup key and storing the user keys to the application program.

[0005] In a possible implementation manner, the method further includes: determining the maximum key number according to the communication interface bandwidth of the PCI-E cryptographic card and different user key types.

[0006] In a possible implementation manner, the storing of the maximum key number of user keys from the PCI-E cryptographic card to the first cache space at least once includes: performing the following steps at least once: The user keys in the storage area of the PCI-E cryptographic card are decrypted by the protection key one by one, and are stored in the first cache space until the maximum number of keys is reached.

[0007] In another aspect of the embodiments of the present application, a PCI-E cryptographic card key recovery method is provided, comprising: The second cache space is allocated according to the maximum received data length, and the maximum received data length is used to represent the maximum data length that can be simultaneously received by the PCI-E cryptographic card. The plurality of ciphertext user keys are stored in the second cache space at least once from the application program, and the ciphertext user keys stored each time are not repeated. After the storage of the ciphertext user keys is completed each time, the ciphertext user keys in the second cache space are decrypted by the backup key and are stored in the PCI-E cryptographic card.

[0008] In a possible implementation, the plurality of ciphertext user keys are stored in the second cache space at least once from the application program, comprising: In the case that the length of the ciphertext user keys not acquired in the application program is less than or equal to the maximum received data length, all the ciphertext user keys in the application program are stored in the second cache space.

[0009] In a possible implementation, the plurality of ciphertext user keys are stored in the second cache space at least once from the application program, comprising: In the case that the length of the ciphertext user keys not acquired in the application program is greater than the maximum received data length, the ciphertext user keys corresponding to the number of the maximum received data length are acquired in the application program and are stored in the second cache space.

[0010] In another aspect of the embodiments of the present application, a PCI-E cryptographic card key backup device is also provided, comprising: The first cache allocation module is configured to allocate the first cache space according to the maximum number of keys, and the maximum number of keys is used to represent the maximum number of keys that can be simultaneously received by the application program. The first key transmission module is configured to store the maximum number of user keys in the first cache space at least once from the PCI-E cryptographic card, and the user keys stored each time are not repeated. The key backup module is configured to, after the storage of the user keys is completed each time, encrypt and calculate the user keys in the first cache space by the backup key and store them in the application program.

[0011] In a possible implementation, the device further comprises: The key number determination module is configured to determine the maximum number of keys according to the communication interface bandwidth of the PCI-E cryptographic card and different user key types.

[0012] In a possible implementation, the first key transmission module is further configured to: perform the following steps at least once: decrypt the user keys in the storage area of the PCI-E cryptographic card by the protection key one by one and store them in the first cache space until the maximum number of keys is reached.

[0013] Another aspect of the embodiments of the present application further provides a PCI-E cryptographic card key recovery device, comprising: The second cache allocation module is configured to allocate a second cache space according to a maximum received data length, the maximum received data length being used to represent the maximum data length that the PCI-E cryptographic card can receive at the same time. The second key transmission module is configured to store a plurality of ciphertext user keys from the application program into the second cache space at least once, and the ciphertext user keys stored each time are not repeated. The key recovery module is configured to store the ciphertext user keys in the second cache space into the PCI-E cryptographic card after decrypting the ciphertext user keys by the backup key after each storage of the ciphertext user keys is completed.

[0014] In a possible implementation, the second cache allocation module is further configured to: In the case that the length of the ciphertext user keys not acquired in the application program is less than or equal to the maximum received data length, all the ciphertext user keys in the application program are stored into the second cache space.

[0015] In a possible implementation, the second cache allocation module is further configured to: In the case that the length of the ciphertext user keys not acquired in the application program is greater than the maximum received data length, the ciphertext user keys corresponding to the number of the maximum received data length are acquired from the application program and stored into the second cache space.

[0016] The electronic device provided by the embodiments of the present application comprises a memory and a processor, the memory stores a computer program capable of running on the processor, and the processor implements the method provided by the embodiments of the present application when executing the program.

[0017] The computer readable storage medium provided by the embodiments of the present application has a computer program stored thereon, and the computer program is executed by the processor to implement the method provided by the embodiments of the present application.

[0018] The PCI-E cryptographic card key backup and recovery method and device provided in the embodiments of the present application, wherein the backup process allocates a first cache space according to the maximum number of keys that can be simultaneously received by an application, stores the maximum number of user keys obtained from the PCI-E cryptographic card at least once into the first cache space, and stores the user keys in the first cache space after encryption calculation by a backup key to the application. The recovery process allocates a second cache space according to the maximum length of data that can be simultaneously received by the PCI-E cryptographic card, stores a plurality of ciphertext user keys obtained from the application at least once into the second cache space, and stores the ciphertext user keys in the second cache space after decryption by the backup key to the PCI-E cryptographic card. The embodiments of the present application can realize batch key backup and recovery by allocating cache space, reduce the number of data transmission times, and thus improve the efficiency of the backup and recovery process. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0020] Figure 1 A flowchart of a PCI-E cryptographic card key backup method according to an embodiment of the present application is shown; Figure 2 A flowchart of a PCI-E cryptographic card key recovery method according to an embodiment of the present application is shown; Figure 3 A schematic diagram of a PCI-E cryptographic card key backup device according to an embodiment of the present application is shown; Figure 4 A schematic diagram of a PCI-E cryptographic card key recovery device according to an embodiment of the present application is shown; Figure 5 A schematic diagram of an electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0021] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the specific technical solutions of the present application will be further described in detail below with reference to the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application, but not to limit the scope of the present application.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application, and are not intended to limit the present application.

[0023] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other as long as there is no conflict.

[0024] It should be noted that the terms "first", "second", "third" involved in the embodiments of the present application are used to distinguish similar or different objects, and do not represent a specific order of the objects. Understandably, "first", "second", "third" can be interchanged in a specific order or sequence as long as it is allowed, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0025] The PCI-E cryptographic card key backup and recovery method of the embodiments of the present application can be executed by an electronic device, which can include but is not limited to a mobile phone, a wearable device (such as a smart watch, a smart bracelet, smart glasses, etc.), a tablet computer, a notebook computer, a vehicle terminal, a PC (Personal Computer), etc. The functions implemented by the method can be realized by calling program codes in the processor of the electronic device, and of course the program codes can be saved in a computer storage medium. Therefore, the electronic device at least includes a processor and a storage medium.

[0026] The PCI-E cryptographic card key backup and recovery method of the embodiments of the present application can be used in any application scenario that needs to backup or restore user keys in a PCI-E cryptographic card. For example, the embodiments of the present application can be applied to the scenario of backup and recovery of user keys in a conventional user key backup and recovery environment, or in a development and test environment.

[0027] The related art usually adopts two methods when performing PCI-E cryptographic card key backup and recovery. One of them is to encrypt the user keys to be backed up by a backup key to obtain ciphertext user keys, and export the ciphertext user keys to the PCI-E cryptographic card. Key recovery is to decrypt the imported ciphertext user keys by the backup key and store them in the PCI-E cryptographic card. The other is to split and encrypt the backup key in the PCI-E cryptographic card, save the processed backup key in the storage medium, and then encrypt the user keys to be backed up by the backup key to obtain ciphertext user keys and export them to the PCI-E cryptographic card. Key recovery is to restore and decrypt the split and encrypted backup key and the imported ciphertext user keys, and finally store them in the PCI-E cryptographic card.

[0028] The above two types of PCI-E cryptographic cards encrypt or decrypt the user keys of a single index by a backup key cycle, which is relatively slow and greatly reduces the user experience.

[0029] Therefore, the PCI-E cryptographic card key backup and recovery method provided in the embodiments of the present application solves the technical problem of how to improve the efficiency of the PCI-E cryptographic card key backup and recovery process.

[0030] The PCI-E cryptographic card key backup and recovery scheme provided in the embodiments of the present application will be described in detail below with reference to the accompanying drawings. In order to facilitate description, the electronic device is taken as the execution subject to describe the PCI-E cryptographic card key backup and recovery method provided in the embodiments of the present application. It should be understood that the execution subject provided in the embodiments of the present application can also be a processor or a chip in the electronic device, and the embodiments of the present application are not limited in this regard.

[0031] Figure 1 A flowchart of a PCI-E cryptographic card key backup method according to an embodiment of the present application is shown. As shown in FIG. 1, the PCI-E cryptographic card key backup method provided in the embodiments of the present application can include the following steps S10-S30. Figure 1

[0032] Step S10, the electronic device allocates a first cache space according to a maximum key number.

[0033] In a possible implementation, the application scenario in which the electronic device backs up the user keys in the PCI-E cryptographic card is used to store the user keys stored therein in other application programs after encryption. In the case where the user keys stored in the PCI-E cryptographic card need to be backed up, the electronic device can determine a maximum key number representing the maximum number of keys that can be simultaneously received by the application program, and then allocate a first cache space according to the maximum key number, for temporarily storing the unencrypted user keys.

[0034] Optionally, the maximum key number in the embodiments of the present application can be determined according to the communication interface bandwidth of the PCI-E cryptographic card and different user key types. In actual application, the first cache space can be allocated by the application program. That is, the electronic device can calculate the maximum key number based on the communication interface bandwidth of the PCI-E cryptographic card and the maximum number of returned user keys of different user key types, and then the application program can obtain the maximum key number corresponding to different user key types of the current PCI-E cryptographic card through an interface function. After the application program receives the maximum key number, the first cache space is allocated according to the maximum key number returned by the PCI-E cryptographic card, and the key backup process is initiated.

[0035] Step S20, the electronic device stores the maximum key number of user keys from the PCI-E cryptographic card into the first cache space at least once.

[0036] ​In a possible implementation, after the electronic device allocates the first cache space through the application program, the electronic device can store the maximum number of user keys in the first cache space from the PCI-E cryptographic card at least once. Optionally, in the case that the electronic device starts to backup the user keys, the electronic device can send corresponding instruction information to the PCI-E cryptographic card through the application program. After the PCI-E cryptographic card receives the instruction information representing the start of the user key backup, the PCI-E cryptographic card stores the user keys in the first cache space by decrypting the user keys stored in the storage area of the PCI-E cryptographic card with the protection key one by one until the maximum number of keys is reached.

[0037] Optionally, the first cache space can be a communication cache space of the PCI-E cryptographic card. The number of user keys stored in the first cache space each time is less than or equal to the maximum number of keys.

[0038] In some embodiments, after the PCI-E cryptographic card receives the instruction information representing the start of the user key backup, the PCI-E cryptographic card can determine the corresponding maximum number of keys based on the type of the stored user keys, and then store the user keys in the first cache space by decrypting the user keys stored in the storage area of the PCI-E cryptographic card with the protection key one by one until the maximum number of keys is reached. The user keys stored in the first cache space each time are not repeated.

[0039] Step S30: After each storage of the user keys is completed, the electronic device stores the user keys in the first cache space in the application program after the user keys are encrypted and calculated by the backup key.

[0040] In a possible implementation, after the electronic device completes the storage of the user keys each time, that is, the user keys after decryption are stored in the first cache space until the maximum number of keys is reached, the electronic device further encrypts and calculates each user key in the first cache space by the backup key to obtain the ciphertext user key corresponding to each user key, and then after the encryption and calculation of all user keys are completed, the electronic device stores all the current ciphertext user keys in the first cache space to the application program in batches.

[0041] Optionally, after each batch of ciphertext user keys is stored, the cache is emptied and step S20 is executed again to reacquire the user keys that have not been backed up to the first cache space, until all the user keys in the PCI-E cryptographic card are backed up and the key backup process is stopped.

[0042] Based on the above technical features, in the case of backing up the user keys in the PCI-E cryptographic card, the embodiments of the present application realize batch user key backup by allocating cache space, reduce the number of interactions between the application program and the PCI-E cryptographic card, and thus improve the efficiency of the key backup process.

[0043] Figure 2 A flow chart of a PCI-E cryptographic card key recovery method according to an embodiment of the present application is shown. As shown in the figure, the PCI-E cryptographic card key backup method of the present application can include the following steps S40-S60. Figure 2

[0044] Step S40, the electronic device allocates a second cache space according to the maximum received data length.

[0045] In a possible implementation, the application scenario of the electronic device for recovering the user key in the PCI-E cryptographic card is used to decrypt the backup ciphertext user key in the application program and store it in the PCI-E cryptographic card. Optionally, in the case of needing to recover the backup ciphertext user key in the application program to the PCI-E cryptographic card, the electronic device can determine the maximum data length representing the maximum data length that the PCI-E cryptographic card can receive at the same time, and then allocate a second cache space according to the maximum received data length, for temporarily storing the encrypted ciphertext user key in the backup process.

[0046] Optionally, the maximum received data length in the present application can also be determined according to the communication interface bandwidth of the PCI-E cryptographic card and different user key types. In actual application, the second cache space can also be allocated by the application program. That is, the electronic device can calculate the maximum received data length through the PCI-E cryptographic card and return it to the application program. The maximum received data length can be the same as or different from the length corresponding to the maximum number of keys in the user key backup process. After the application program receives the maximum received data length, it allocates a first cache space according to the maximum received data length returned by the PCI-E cryptographic card, and initiates the key recovery process.

[0047] Step S50, the electronic device stores a plurality of ciphertext user keys from the application program to the second cache space at least once.

[0048] In a possible implementation, after the electronic device allocates the second cache space through the application program, it can store a plurality of ciphertext user keys from the application program to the second cache space at least once. Optionally, the electronic device can determine the total length of the ciphertext user keys that have not been acquired in the application program when starting the user key recovery, and perform data transmission on the ciphertext user keys by comparing the ciphertext user key length and the maximum data length.

[0049] ​Optionally, if the length of the unacquired ciphertext user key in the application is less than or equal to the maximum received data length, the electronic device can store all ciphertext user keys in the application into the second cache space. If the length of the unacquired ciphertext user key in the application is greater than the maximum received data length, the electronic device can store the number of ciphertext user keys acquired in the application corresponding to the maximum received data length into the second cache space.

[0050] Optionally, the second cache space can be a key cache space within the application. The encrypted user key stored in the second cache space by the electronic device is unique each time.

[0051] Step S60: After each storage of the encrypted user key is completed, the encrypted user key in the second cache space is decrypted using the backup key and then stored in the PCI-E cryptographic card.

[0052] In one possible implementation, each time the application completes the storage of the encrypted user key (i.e., storing the encrypted user key to be recovered in the second buffer space until the maximum received data length is reached), the electronic device can send a key recovery command to the PCI-E cryptographic card through the application to instruct the PCI-E cryptographic card to perform the key recovery process.

[0053] Optionally, after receiving the key recovery command, the PCI-E cryptographic card can use the backup key to decrypt the encrypted user key to obtain the decrypted plaintext user key. It then parses the plaintext user key and performs key verification. After successful verification, it encrypts and stores the key in the PCI-E cryptographic card storage area using the protection key and returns a success notification to the application.

[0054] In some embodiments, after each successful notification received from the PCI-E cryptographic card, the application may repeat step S50 to recover the unrecovered ciphertext user keys until all of the application's ciphertext user keys have been recovered to the PCI-E cryptographic card, at which point the key recovery process stops.

[0055] Based on the above technical features, in the case of recovering user keys in a PCI-E cryptographic card, this application embodiment achieves batch user key recovery by allocating cache space, thereby reducing the number of interactions between the application and the PCI-E cryptographic card and improving the efficiency of the key recovery process.

[0056] It should be understood that although each step in the above flowcharts is shown in sequence according to the direction of the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless otherwise explicitly stated herein, there is no strict order limitation for the execution of these steps, and these steps can be executed in other orders. Moreover, at least part of the steps in the above flowcharts can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or sub-steps or stages of other steps.

[0057] Based on the foregoing embodiments, the embodiments of the application provide a PCI-E cryptographic card key backup and recovery device, which comprises the modules included and the units included in the modules, and can be implemented by a processor; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP), or a field programmable gate array (FPGA), etc.

[0058] Figure 3 A schematic diagram of a PCI-E cryptographic card key backup device according to an embodiment of the application is shown. As shown in the figure, the PCI-E cryptographic card key backup device according to an embodiment of the application can include: Figure 3 The first cache allocation module 30 is configured to allocate a first cache space according to a maximum key quantity, the maximum key quantity being used to represent the maximum number of keys that an application program can receive at the same time. The first key transmission module 31 is configured to store user keys in the first cache space from the PCI-E cryptographic card at least once, and the user keys stored each time are not repeated. The key backup module 32 is configured to, after completing the storage of the user keys each time, store the user keys in the first cache space after encryption calculation by a backup key to an application program.

[0059] In a possible implementation manner, the device further includes: The key quantity determination module is configured to determine the maximum key quantity according to the communication interface bandwidth of the PCI-E cryptographic card and different user key types.

[0060] In a possible implementation manner, the first key transmission module 31 is further configured to: At least once, the following steps are performed: The user keys in the storage area of the PCI-E cryptographic card are decrypted by the protection key one by one, and are stored in the first cache space until the maximum key quantity is reached.​

[0061] Figure 4 A schematic diagram of a PCI-E cryptographic card key recovery device according to an embodiment of this application is shown. Figure 4 As shown, a PCI-E cryptographic card key recovery device according to an embodiment of this application may include: The second buffer allocation module 40 is used to allocate a second buffer space according to the maximum received data length, where the maximum received data length is used to characterize the maximum data length that the PCI-E cryptographic card can receive simultaneously. The second key transmission module 41 is used to obtain multiple encrypted user keys from the application at least once and store them in the second cache space, wherein the encrypted user keys stored each time are not repeated; The key recovery module 42 is used to decrypt the encrypted user key in the second cache space using the backup key after each storage of the encrypted user key is completed, and then store it to the PCI-E cryptographic card.

[0062] In one possible implementation, the second cache allocation module 41 is further configured to: If the length of the encrypted user key that has not been obtained in the application is less than or equal to the maximum received data length, all encrypted user keys in the application will be stored in the second cache space.

[0063] In one possible implementation, the second cache allocation module 41 is further configured to: If the length of the encrypted user key that has not been obtained in the application is greater than the maximum received data length, the encrypted user keys obtained in the application corresponding to the maximum received data length will be stored in the second cache space.

[0064] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0065] It should be noted that, in the embodiments of this application... Figure 4 The module division of the PCI-E cryptographic card key backup and recovery device shown is illustrative and represents only one logical functional division; in actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, exist as separate physical units, or be integrated into one unit by two or more units. The integrated units can be implemented in hardware, as software functional units, or a combination of both.

[0066] It should be noted that, in the embodiments of the present application, if the above-mentioned method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes a plurality of instructions for causing an electronic device to execute all or part of the methods described in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read only memory (ROM), a magnetic disk or an optical disk, and various media that can store program codes. Thus, the embodiments of the present application are not limited to any specific hardware and software combination.

[0067] Figure 5 A schematic diagram of an electronic device according to an embodiment of the present application is shown. As shown in Figure 5 , the present application provides an electronic device, which can be a server, and the internal structure diagram thereof can be as shown in Figure 5 . The electronic device includes a processor 520, a memory and a transceiver 540 connected through a system bus 510. Among them, the processor 520 of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium 531 and an internal memory 532. The non-volatile storage medium 531 stores an operating system, a computer program and a database. The internal memory 532 provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium 531. The database of the electronic device is used to store data. The transceiver 540 of the electronic device is used to communicate with the external terminal through the network connection. The computer program is executed by the processor 520 to implement the above-mentioned method.

[0068] The embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by the processor 520 to implement the steps in the method provided in the above-mentioned embodiment.

[0069] The embodiment of the present application provides a computer program product containing instructions, which, when running on a computer, causes the computer to execute the steps in the method provided by the above-mentioned method embodiment.

[0070] Those skilled in the art can understand, Figure 5 the structure shown in the figure, only the block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied, and the specific electronic device can include more or less components than those shown in the figure, or combine certain components, or have different component arrangement.

[0071] In a possible implementation, the photographing prompting apparatus provided in the present application can be implemented in the form of a computer program, which can run on an electronic device as shown in Figure 5 The memory of the electronic device can store various program modules constituting the above apparatus. The computer program constituted by the various program modules causes the processor 520 to execute the steps in the method of various embodiments of the present application described in the specification.

[0072] It should be noted that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details of the present application that are not disclosed in the storage medium, storage medium and device embodiments, please refer to the description of the method embodiments.

[0073] It should be understood that the "one embodiment" or "an embodiment" or "some embodiments" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiments are included in at least one embodiment of the present application. Therefore, "in a possible implementation" or "in an embodiment" or "in some embodiments" appearing throughout the specification does not necessarily mean the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above processes does not mean the execution order, and the execution order of the processes should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above sequence number of the embodiments of the present application is only for description, not representing the advantages and disadvantages of the embodiments. The above description of each embodiment tends to emphasize the differences between each embodiment, and the same or similar parts can be referred to each other. For the sake of brevity, this paper will not repeat here.

[0074] The term "and / or" in this paper is only a description of the association relationship of the associated objects, which means that there can be three kinds of relationships, for example, object A and / or object B, which can represent the existence of object A, the existence of object A and object B, and the existence of object B.

[0075] It should be noted that in this paper, the term "include", "contain" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device. Without more limitations, the element defined by the sentence "including a…" does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0076] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other manners. The embodiments described above are merely exemplary, for example, the division of the modules is only a logical function division, and there can be another division manner for the actual implementation, for example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the various components shown or discussed can be indirect coupling or communication connection through some interfaces, devices or modules, and can be electrical, mechanical or other forms.

[0077] The modules described above as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules; they can be located in one place, or distributed on multiple network units; and some or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments.

[0078] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can be a separate unit, or two or more modules can be integrated into one unit; the integrated module can be realized in the form of hardware or hardware plus software functional unit.

[0079] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware, and the foregoing program can be stored in a computer readable storage medium, and the program executes the steps including the above-mentioned method embodiments when executed; and the foregoing storage medium includes mobile storage devices, read only memory (Read Only Memory, ROM), magnetic discs or optical discs and various storage medium that can store program codes.

[0080] Alternatively, the integrated units of the present application, if implemented in the form of software functional modules and sold or used as independent products, can also be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application can be embodied in the form of software products, and the computer software products are stored in a storage medium, including a plurality of instructions for causing an electronic device to execute all or part of the methods described in the embodiments of the present application. The foregoing storage medium includes mobile storage devices, ROM, magnetic discs or optical discs and various storage medium that can store program codes.

[0081] The methods disclosed in the several method embodiments provided by the present application can be combined arbitrarily without conflict, to obtain new method embodiments.

[0082] The features disclosed in several product embodiments provided by the present application can be arbitrarily combined, without conflict, to obtain new product embodiments.

[0083] The features disclosed in several method or device embodiments provided by the present application can be arbitrarily combined, without conflict, to obtain new method embodiments or device embodiments.

[0084] The above description is merely illustrative of the application, and the scope of the application is not limited thereto. Any variations and modifications of the application, which would occur to those skilled in the art, are to be considered within the scope of the application. Therefore, the scope of the application is defined by the appended claims.

Claims

1. A method for backing up PCI-E cryptographic card keys, characterized in that, The method includes: The first cache space is allocated according to the maximum number of keys, where the maximum number of keys is used to characterize the maximum number of keys that the application can receive simultaneously; At least once, a maximum number of user keys are retrieved from the PCI-E cryptographic card and stored in the first cache space, with each stored user key being unique; After each user key is stored, the user key in the first cache space is encrypted and calculated using the backup key before being stored in the application.

2. The method according to claim 1, characterized in that, The method further includes: The maximum number of keys is determined based on the communication interface bandwidth of the PCI-E cryptographic card and the different user key types.

3. The method according to claim 1, characterized in that, Retrieving the maximum number of user keys from the PCI-E cryptographic card at least once and storing them in the first cache space includes: Perform the following steps at least once: sequentially decrypt the user keys in the storage area of ​​the PCI-E cryptographic card using the protection key, and store them in the first cache space until the maximum number of keys is reached.

4. A method for recovering a PCI-E cryptographic card key, characterized in that, The method includes: The second buffer space is allocated according to the maximum received data length, which is used to characterize the maximum data length that the PCI-E cryptographic card can receive simultaneously. Multiple encrypted user keys are retrieved from the application at least once and stored in the second cache space, with each stored encrypted user key being unique; After each storage of the encrypted user key is completed, the encrypted user key in the second cache space is decrypted using the backup key and then stored in the PCI-E cryptographic card.

5. The method according to claim 4, characterized in that, The step of retrieving multiple encrypted user keys from the application at least once and storing them in the second cache space includes: If the length of the encrypted user key that has not been acquired in the application is less than or equal to the maximum received data length, all the encrypted user keys in the application are stored in the second cache space.

6. The method according to claim 4 or 5, characterized in that, The step of retrieving multiple encrypted user keys from the application at least once and storing them in the second cache space includes: If the length of the encrypted user key that has not been acquired in the application is greater than the maximum received data length, the encrypted user keys acquired in the application corresponding to the maximum received data length are stored in the second cache space.

7. A PCI-E cryptographic card key backup device, characterized in that, The device includes: The first cache allocation module is used to allocate a first cache space according to the maximum number of keys, wherein the maximum number of keys is used to characterize the maximum number of keys that the application can receive at the same time. The first key transmission module is used to obtain a maximum number of user keys from the PCI-E cryptographic card at least once and store them in the first cache space, wherein the user keys stored each time are not repeated; The key backup module is used to perform encrypted calculations on the user key in the first cache space using the backup key after each user key storage is completed, and then store it in the application.

8. A PCI-E cryptographic card key recovery device, characterized in that, The device includes: The second cache allocation module is used to allocate a second cache space according to the maximum received data length, wherein the maximum received data length is used to characterize the maximum data length that the PCI-E cryptographic card can receive simultaneously. The second key transmission module is used to obtain multiple encrypted user keys from the application at least once and store them in the second cache space, wherein the encrypted user keys stored each time are not repeated; The key recovery module is used to decrypt the encrypted user key in the second cache space using a backup key after each storage of the encrypted user key is completed, and then store it in the PCI-E cryptographic card.

9. An electronic device comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.

Images