PCI-E cryptographic card key backup and recovery method and apparatus

Abstract

This application discloses a method and apparatus for backing up and restoring PCI-E cryptographic card keys. In the backup process, a first cache space is allocated based on the maximum number of keys the application can simultaneously receive. At least once, the maximum number of user keys are retrieved from the PCI-E cryptographic card and stored in the first cache space. The user keys in the first cache space are then encrypted using a backup key and stored in the application. In the restoration process, a second cache space is allocated based on the maximum length of data that the PCI-E cryptographic card can simultaneously receive. At least once, multiple encrypted user keys are retrieved from the application and stored in the second cache space. The encrypted user keys in the second cache space are then decrypted using a backup key and stored in the PCI-E cryptographic card. This application embodiment achieves batch key backup and restoration by allocating cache space, reducing the number of data transfers and thus improving the efficiency of the backup and restoration process.

Description

Technical Field

[0001] This application relates to the field of computer technology, and to, but is not limited to, a method and apparatus for backing up and restoring PCI-E cryptographic card keys. Background Technology

[0002] As a hardware and software integrated cryptographic product, the PCI-E cryptographic card provides key management functions such as key generation, key backup and recovery, as well as cryptographic operations. Key backup and recovery is one of the key functions of the PCI-E cryptographic card. However, current technology encrypts and exports the user key of a single index to the PCI-E cryptographic card or decrypts and imports it into the PCI-E cryptographic card during key backup and recovery. This process is repeated until the user key of the last index is encrypted and exported or decrypted and imported into the PCI-E cryptographic card. When there are many user keys and multiple PCI-E cryptographic cards require key synchronization, the key backup and recovery time becomes extremely slow, significantly degrading the user experience. Summary of the Invention

[0003] In view of this, the PCI-E cryptographic card key backup and recovery method and apparatus provided in this application embodiment can achieve batch key backup and recovery by allocating cache space, thereby reducing the number of data transmissions and improving the efficiency of the backup and recovery process.

[0004] The PCI-E cryptographic card key backup and recovery method and apparatus provided in this application are implemented as follows: One aspect of this application provides a PCI-E cryptographic card key backup method, including: The first cache space is allocated according to the maximum number of keys, which represents the maximum number of keys that the application can receive at the same time. At least once, a maximum number of user keys are retrieved from the PCI-E cryptographic card and stored in the first cache space, with each stored user key being unique; After each user key is stored, the user key in the first cache space is encrypted and calculated using the backup key before being stored in the application.

[0005] In one possible implementation, the method also includes: The maximum number of keys is determined based on the communication interface bandwidth of the PCI-E cryptographic card and the different user key types.

[0006] In one possible implementation, retrieving the maximum number of user keys from the PCI-E cryptographic card at least once and storing them in the first cache space includes: Perform the following steps at least once: The user keys in the storage area of ​​the PCI-E cryptographic card are decrypted sequentially using the protection key and stored in the first cache space until the maximum number of keys is reached.

[0007] Another aspect of this application provides a PCI-E cryptographic card key recovery method, including: The second buffer space is allocated according to the maximum received data length, which is used to characterize the maximum data length that the PCI-E cryptographic card can receive simultaneously. Multiple encrypted user keys are retrieved from the application at least once and stored in the second cache space, with each stored encrypted user key being unique; After each encrypted user key is stored, the encrypted user key in the second cache space is decrypted using the backup key and then stored in the PCI-E cryptographic card.

[0008] In one possible implementation, multiple encrypted user keys are retrieved from the application at least once and stored in a second cache space, including: If the length of the encrypted user key that has not been obtained in the application is less than or equal to the maximum received data length, all encrypted user keys in the application will be stored in the second cache space.

[0009] In one possible implementation, multiple encrypted user keys are retrieved from the application at least once and stored in a second cache space, including: If the length of the encrypted user key that has not been obtained in the application is greater than the maximum received data length, the encrypted user keys obtained in the application corresponding to the maximum received data length will be stored in the second cache space.

[0010] Another aspect of the embodiments of this application provides a PCI-E cryptographic card key backup device, comprising: The first cache allocation module is used to allocate the first cache space according to the maximum number of keys, where the maximum number of keys is used to characterize the maximum number of keys that the application can receive at the same time. The first key transmission module is used to obtain a maximum number of user keys from the PCI-E cryptographic card at least once and store them in the first cache space, wherein the user keys stored each time are not repeated; The key backup module is used to perform encrypted calculations on the user key in the first cache space using the backup key after each user key storage is completed, and then store it in the application.

[0011] In one possible implementation, the device further includes: The key quantity determination module is used to determine the maximum number of keys based on the communication interface bandwidth of the PCI-E cryptographic card and different user key types.

[0012] In one possible implementation, the first key transmission module is further configured to: Perform the following steps at least once: The user keys in the storage area of ​​the PCI-E cryptographic card are decrypted sequentially using the protection key and stored in the first cache space until the maximum number of keys is reached.

[0013] Another aspect of this application provides a PCI-E cryptographic card key recovery device, comprising: The second buffer allocation module is used to allocate the second buffer space according to the maximum received data length, where the maximum received data length is used to characterize the maximum data length that the PCI-E cryptographic card can receive simultaneously. The second key transmission module is used to obtain multiple encrypted user keys from the application at least once and store them in the second cache space, wherein the encrypted user keys stored each time are not repeated; The key recovery module is used to decrypt the encrypted user key in the second cache space using the backup key after each encrypted user key is stored, and then store it to the PCI-E cryptographic card.

[0014] In one possible implementation, the second cache allocation module is further used for: If the length of the encrypted user key that has not been obtained in the application is less than or equal to the maximum received data length, all encrypted user keys in the application will be stored in the second cache space.

[0015] In one possible implementation, the second cache allocation module is further used for: If the length of the encrypted user key that has not been obtained in the application is greater than the maximum received data length, the encrypted user keys obtained in the application corresponding to the maximum received data length will be stored in the second cache space.

[0016] The electronic device provided in this application includes a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements the method described in this application.

[0017] The computer-readable storage medium provided in this application embodiment stores a computer program thereon, which, when executed by a processor, implements the method provided in this application embodiment.

[0018] The PCI-E cryptographic card key backup and recovery method and apparatus provided in this application embodiment include the following steps: In the backup process, a first cache space is allocated based on the maximum number of keys that the application can simultaneously receive. At least once, the maximum number of user keys are retrieved from the PCI-E cryptographic card and stored in the first cache space. The user keys in the first cache space are then encrypted using a backup key and stored in the application. In the recovery process, a second cache space is allocated based on the maximum data length that the PCI-E cryptographic card can simultaneously receive. At least once, multiple encrypted user keys are retrieved from the application and stored in the second cache space. The encrypted user keys in the second cache space are then decrypted using a backup key and stored in the PCI-E cryptographic card. This application embodiment achieves batch key backup and recovery by allocating cache space, reducing the number of data transfers and thus improving the efficiency of the backup and recovery process. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating a PCI-E cryptographic card key backup method according to an embodiment of this application is shown; Figure 2 A flowchart illustrating a PCI-E cryptographic card key recovery method according to an embodiment of this application is shown; Figure 3 This diagram illustrates a PCI-E cryptographic card key backup device according to an embodiment of this application; Figure 4 This diagram illustrates a PCI-E cryptographic card key recovery device according to an embodiment of this application. Figure 5 A schematic diagram of an electronic device according to an embodiment of this application is shown. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the specific technical solutions of this application will be further described in detail below with reference to the accompanying drawings of the embodiments of this application. The following embodiments are used to illustrate this application, but are not intended to limit the scope of this application.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0023] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0024] It should be noted that the terms "first, second, third" used in the embodiments of this application are used to distinguish similar or different objects and do not represent a specific order of objects. It can be understood that "first, second, third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0025] The PCI-E cryptographic card key backup and recovery method of this application embodiment can be executed by an electronic device, which may include, but is not limited to, mobile phones, wearable devices (such as smartwatches, smart bracelets, smart glasses, etc.), tablet computers, laptops, vehicle terminals, PCs (Personal Computers), etc. The function implemented by this method can be implemented by the processor in the electronic device calling program code. Of course, the program code can be stored in the computer storage medium. It can be seen that the electronic device includes at least a processor and a storage medium.

[0026] The PCI-E cryptographic card key backup and recovery method of this application can be used in any application scenario that requires backup or recovery of user keys in a PCI-E cryptographic card. For example, this application embodiment can be applied to conventional user key backup and recovery scenarios, or user key backup and recovery application scenarios in a development and testing environment.

[0027] There are typically two methods for backing up and restoring PCI-E cryptographic card keys. One method involves encrypting the user key to be backed up using the backup key to obtain an ciphertext user key, which is then exported to the PCI-E cryptographic card. Key recovery involves decrypting the imported ciphertext user key using the backup key and storing it in the PCI-E cryptographic card. The other method involves splitting and encrypting the backup key on the PCI-E cryptographic card, importing the processed backup key into a storage medium, then encrypting the user key to be backed up using the backup key to obtain an ciphertext user key, which is then exported to the PCI-E cryptographic card. Key recovery involves restoring the split and encrypted backup key, decrypting the imported ciphertext user key, and finally storing it in the PCI-E cryptographic card.

[0028] Both of the aforementioned PCI-E cryptographic cards encrypt or decrypt user keys for a single index by cyclically using backup keys, which is slow and greatly reduces the user experience.

[0029] Therefore, it can be seen that the technical problem solved by the PCI-E cryptographic card key backup and recovery method in this application is how to improve the efficiency of the PCI-E cryptographic card key backup and recovery process.

[0030] The PCI-E cryptographic card key backup and recovery scheme of this application embodiment is described in detail below with reference to the accompanying drawings. For ease of description, an electronic device is used as the execution subject to illustrate the PCI-E cryptographic card key backup and recovery method of this application embodiment. It should be understood that the execution subject of this application embodiment can also be a processor or chip in an electronic device, etc., and this application embodiment does not impose any limitations.

[0031] Figure 1 A flowchart illustrating a PCI-E cryptographic card key backup method according to an embodiment of this application is shown. Figure 1 As shown, the PCI-E cryptographic card key backup method of this application embodiment may include the following steps S10-S30.

[0032] Step S10: The electronic device allocates the first buffer space according to the maximum number of keys.

[0033] In one possible implementation, the application scenario where the electronic device backs up the user keys in the PCI-E cryptographic card is to encrypt the user keys stored therein and store them in other applications. When it is necessary to back up the user keys stored in the PCI-E cryptographic card, the electronic device can determine the maximum number of keys that an application can receive simultaneously, and then allocate a first cache space based on the maximum number of keys for temporarily storing unencrypted user keys.

[0034] Optionally, the maximum number of keys in this embodiment can be determined based on the communication interface bandwidth of the PCI-E cryptographic card and different user key types. In practical applications, this first cache space can be allocated by the application program. That is, the electronic device can calculate the maximum number of returned user keys based on its own communication interface bandwidth and different user key types using the PCI-E cryptographic card, and then the application program can obtain the maximum number of keys corresponding to different user key types of the current PCI-E cryptographic card through interface functions. After receiving the maximum number of keys, the application program allocates the first cache space according to the maximum number of keys returned by the PCI-E cryptographic card and initiates the key backup process.

[0035] Step S20: The electronic device retrieves the maximum number of user keys from the PCI-E cryptographic card at least once and stores them in the first cache space.

[0036] In one possible implementation, after the electronic device allocates the first cache space via the application, it can retrieve the maximum number of user keys from the PCI-E cryptographic card at least once and store them in the first cache space. Optionally, when initiating user key backup, the electronic device can send corresponding instruction information to the PCI-E cryptographic card via the application. Upon receiving the instruction information indicating the start of user key backup, the PCI-E cryptographic card sequentially decrypts the user keys stored in its storage area using the protection key and stores them in the first cache space until the maximum number of keys is reached.

[0037] Optionally, the first cache space can be the communication cache space of the PCI-E cryptographic card. The number of user keys stored in the first cache space during each stored procedure is less than or equal to the maximum number of keys.

[0038] In some embodiments, after receiving an instruction indicating the start of user key backup, the PCI-E cryptographic card can determine the maximum number of keys based on the type of stored user keys. Then, it sequentially decrypts the user keys stored in the PCI-E cryptographic card's storage area using a protection key and stores them in a first cache space until the maximum number of keys is reached. Each time a user key is stored in the first cache space, it is unique.

[0039] Step S30: After each storage of the user key is completed, the electronic device performs encrypted calculation on the user key in the first cache space using the backup key and then stores it in the application.

[0040] In one possible implementation, after the electronic device completes the storage of user keys, that is, after storing the decrypted user keys in the first cache space until the maximum number of keys is reached, the electronic device then performs encryption calculations on each user key in the first cache space using the backup key to obtain the ciphertext user key corresponding to each user key. After completing the encryption calculations of all user keys, the electronic device then stores all the current ciphertext user keys in the first cache space in batches to the application.

[0041] Optionally, after each batch of encrypted user keys is stored, the cache is cleared and step S20 is executed again to retrieve the user keys that have not been backed up to the first cache space, until all user keys in the PCI-E cryptographic card have been backed up and the key backup process is stopped.

[0042] Based on the above technical features, this application embodiment achieves batch backup of user keys by allocating cache space when backing up user keys in PCI-E cryptographic cards, thereby reducing the number of interactions between the application and the PCI-E cryptographic card and improving the efficiency of the key backup process.

[0043] Figure 2 A flowchart illustrating a PCI-E cryptographic card key recovery method according to an embodiment of this application is shown. Figure 2 As shown, the PCI-E cryptographic card key backup method of this application embodiment may include the following steps S40-S60.

[0044] Step S40: The electronic device allocates a second buffer space according to the maximum received data length.

[0045] In one possible implementation, the electronic device recovers the user key from the PCI-E cryptographic card in an application scenario, specifically by decrypting the encrypted user key backed up in the application and storing it in the PCI-E cryptographic card. Optionally, when it is necessary to restore the encrypted user key already backed up in the application to the PCI-E cryptographic card for storage, the electronic device can determine the maximum data length that the PCI-E cryptographic card can receive simultaneously, and then allocate a second buffer space based on the maximum receive data length for temporarily storing the encrypted user key that was encrypted during the backup process.

[0046] Optionally, the maximum received data length in this embodiment can also be determined based on the communication interface bandwidth of the PCI-E cryptographic card and different user key types. In practical applications, the second buffer space can also be allocated by the application program. That is, the electronic device can calculate and return the maximum received data length to the application program through the PCI-E cryptographic card. This maximum received data length can be the same as or different from the length corresponding to the maximum number of keys during user key backup. After receiving the maximum received data length, the application program allocates the first buffer space according to the maximum received data length returned by the PCI-E cryptographic card and initiates the key recovery process.

[0047] Step S50: The electronic device retrieves multiple encrypted user keys from the application at least once and stores them in the second cache space.

[0048] In one possible implementation, after allocating a second cache space through the application, the electronic device can retrieve multiple encrypted user keys from the application at least once and store them in the second cache space. Optionally, upon initiating user key recovery, the electronic device can determine the total length of the encrypted user keys currently not retrieved from the application and transmit the encrypted user keys by comparing the encrypted user key length with the maximum data length.

[0049] Optionally, if the length of the unacquired ciphertext user key in the application is less than or equal to the maximum received data length, the electronic device can store all ciphertext user keys in the application into the second cache space. If the length of the unacquired ciphertext user key in the application is greater than the maximum received data length, the electronic device can store the number of ciphertext user keys acquired in the application corresponding to the maximum received data length into the second cache space.

[0050] Optionally, the second cache space can be a key cache space within the application. The encrypted user key stored in the second cache space by the electronic device is unique each time.

[0051] Step S60: After each storage of the encrypted user key is completed, the encrypted user key in the second cache space is decrypted using the backup key and then stored in the PCI-E cryptographic card.

[0052] In one possible implementation, each time the application completes the storage of the encrypted user key (i.e., storing the encrypted user key to be recovered in the second buffer space until the maximum received data length is reached), the electronic device can send a key recovery command to the PCI-E cryptographic card through the application to instruct the PCI-E cryptographic card to perform the key recovery process.

[0053] Optionally, after receiving the key recovery command, the PCI-E cryptographic card can use the backup key to decrypt the encrypted user key to obtain the decrypted plaintext user key. It then parses the plaintext user key and performs key verification. After successful verification, it encrypts and stores the key in the PCI-E cryptographic card storage area using the protection key and returns a success notification to the application.

[0054] In some embodiments, after each successful notification received from the PCI-E cryptographic card, the application may repeat step S50 to recover the unrecovered ciphertext user keys until all of the application's ciphertext user keys have been recovered to the PCI-E cryptographic card, at which point the key recovery process stops.

[0055] Based on the above technical features, in the case of recovering user keys in a PCI-E cryptographic card, this application embodiment achieves batch user key recovery by allocating cache space, thereby reducing the number of interactions between the application and the PCI-E cryptographic card and improving the efficiency of the key recovery process.

[0056] It should be understood that although the steps in the above flowcharts are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the above flowcharts may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0057] Based on the foregoing embodiments, this application provides a PCI-E cryptographic card key backup and recovery device. The device includes various modules and units included in each module, which can be implemented by a processor; of course, it can also be implemented by specific logic circuits. In the implementation process, the processor can be a central processing unit (CPU), microprocessor (MPU), digital signal processor (DSP), or field programmable gate array (FPGA), etc.

[0058] Figure 3 A schematic diagram of a PCI-E cryptographic card key backup device according to an embodiment of this application is shown. Figure 3 As shown, a PCI-E cryptographic card key backup device according to an embodiment of this application may include: The first cache allocation module 30 is used to allocate a first cache space according to the maximum number of keys, where the maximum number of keys is used to characterize the maximum number of keys that the application can receive at the same time. The first key transmission module 31 is used to obtain a maximum number of user keys from the PCI-E cryptographic card at least once and store them in the first cache space, wherein the user keys stored each time are not repeated; The key backup module 32 is used to perform encrypted calculations on the user key in the first cache space using the backup key after each user key storage is completed, and then store it to the application.

[0059] In one possible implementation, the device further includes: The key quantity determination module is used to determine the maximum number of keys based on the communication interface bandwidth of the PCI-E cryptographic card and different user key types.

[0060] In one possible implementation, the first key transmission module 31 is further configured to: Perform the following steps at least once: The user keys in the storage area of ​​the PCI-E cryptographic card are decrypted sequentially using the protection key and stored in the first cache space until the maximum number of keys is reached.

[0061] Figure 4 A schematic diagram of a PCI-E cryptographic card key recovery device according to an embodiment of this application is shown. Figure 4 As shown, a PCI-E cryptographic card key recovery device according to an embodiment of this application may include: The second buffer allocation module 40 is used to allocate a second buffer space according to the maximum received data length, where the maximum received data length is used to characterize the maximum data length that the PCI-E cryptographic card can receive simultaneously. The second key transmission module 41 is used to obtain multiple encrypted user keys from the application at least once and store them in the second cache space, wherein the encrypted user keys stored each time are not repeated; The key recovery module 42 is used to decrypt the encrypted user key in the second cache space using the backup key after each storage of the encrypted user key is completed, and then store it to the PCI-E cryptographic card.

[0062] In one possible implementation, the second cache allocation module 40 is further used for: If the length of the encrypted user key that has not been obtained in the application is less than or equal to the maximum received data length, all encrypted user keys in the application will be stored in the second cache space.

[0063] In one possible implementation, the second cache allocation module 40 is further used for: If the length of the encrypted user key that has not been obtained in the application is greater than the maximum received data length, the encrypted user keys obtained in the application corresponding to the maximum received data length will be stored in the second cache space.

[0064] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0065] It should be noted that, in the embodiments of this application... Figure 4 The module division of the PCI-E cryptographic card key backup and recovery device shown is illustrative and represents only one logical functional division; in actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, exist as separate physical units, or be integrated into one unit by two or more units. The integrated units can be implemented in hardware, as software functional units, or a combination of both.

[0066] It should be noted that, in the embodiments of this application, if the above-described methods are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0067] Figure 5 A schematic diagram of an electronic device according to an embodiment of this application is shown. For example... Figure 5 As shown in the figure, this application provides an electronic device, which can be a server, and its internal structure diagram can be as follows. Figure 5 As shown, the electronic device includes a processor 520, a memory, and a transceiver 540 connected via a system bus 510. The processor 520 provides computing and control capabilities. The memory includes a non-volatile storage medium 531 and internal memory 532. The non-volatile storage medium 531 stores an operating system, computer programs, and a database. The internal memory 532 provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium 531. The database stores data. The transceiver 540 communicates with external terminals via a network connection. When the computer program is executed by the processor 520, it implements the methods described above.

[0068] This application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor 520, implements the steps of the method provided in the above embodiments.

[0069] This application provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the steps in the method provided in the above-described method embodiments.

[0070] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0071] In one possible implementation, the shooting prompting device provided in this application can be implemented as a computer program, which can be configured as follows: Figure 5 The device operates on the electronic device shown. The memory of the electronic device can store various program modules that make up the above-described apparatus. The computer program composed of the various program modules causes the processor 520 to execute the steps of the methods in the various embodiments of this application described in this specification.

[0072] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium, storage medium, and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0073] It should be understood that the phrases "one embodiment," "an embodiment," or "some embodiments" mentioned throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, phrases such as "in one possible implementation," "in one embodiment," or "in some embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. The descriptions of the various embodiments above tend to emphasize the differences between the various embodiments; their similarities or commonalities can be referred to mutually, and for the sake of brevity, they will not be repeated here.

[0074] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three kinds of relationships. For example, object A and / or object B can represent three situations: object A exists alone, object A and object B exist simultaneously, and object B exists alone.

[0075] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0076] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple modules or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or modules can be electrical, mechanical, or other forms.

[0077] The modules described above as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules. They may be located in one place or distributed across multiple network units. Some or all of the modules may be selected to achieve the purpose of this embodiment according to actual needs.

[0078] In addition, each functional module in the various embodiments of this application can be integrated into one processing unit, or each module can be a separate unit, or two or more modules can be integrated into one unit; the integrated modules can be implemented in hardware or in the form of hardware plus software functional units.

[0079] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0080] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0081] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0082] The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0083] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0084] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for backing up PCI-E cryptographic card keys, characterized in that, The method includes: The maximum number of keys is determined based on the communication interface bandwidth of the PCI-E cryptographic card and the different user key types; The first cache space is allocated according to the maximum number of keys, where the maximum number of keys is used to characterize the maximum number of keys that the application can receive simultaneously; At least once, a maximum number of user keys are retrieved from the PCI-E cryptographic card and stored in the first cache space, with each stored user key being unique; After each user key is stored, the user key in the first cache space is encrypted using the backup key and then stored in the application; after each batch of encrypted user key storage is completed, the first cache space is cleared.

2. The method according to claim 1, characterized in that, Retrieving the maximum number of user keys from the PCI-E cryptographic card at least once and storing them in the first cache space includes: Perform the following steps at least once: sequentially decrypt the user keys in the storage area of ​​the PCI-E cryptographic card using the protection key, and store them in the first cache space until the maximum number of keys is reached.

3. A method for recovering a PCI-E cryptographic card key, characterized in that, The method includes: The second buffer space is allocated according to the maximum received data length, which is used to characterize the maximum data length that the PCI-E cryptographic card can receive simultaneously. Multiple encrypted user keys are retrieved from the application at least once and stored in the second cache space, with each stored encrypted user key being unique; After each encrypted user key is stored, the encrypted user key in the second cache space is decrypted using the backup key and then stored in the PCI-E cryptographic card; each time a success notification is received from the PCI-E cryptographic card, multiple encrypted user keys are retrieved from the application and stored in the second cache space.

4. The method according to claim 3, characterized in that, The step of retrieving multiple encrypted user keys from the application at least once and storing them in the second cache space includes: If the length of the encrypted user key that has not been acquired in the application is less than or equal to the maximum received data length, all the encrypted user keys in the application are stored in the second cache space.

5. The method according to claim 3 or 4, characterized in that, The step of retrieving multiple encrypted user keys from the application at least once and storing them in the second cache space includes: If the length of the ciphertext user key that has not been acquired in the application is greater than the maximum received data length, the number of ciphertext user keys acquired in the application corresponding to the maximum received data length will be stored in the second cache space.

6. A PCI-E cryptographic card key backup device, characterized in that, The device includes: The key quantity determination module is used to determine the maximum number of keys based on the communication interface bandwidth of the PCI-E cryptographic card and different user key types. The first cache allocation module is used to allocate a first cache space according to the maximum number of keys, wherein the maximum number of keys is used to characterize the maximum number of keys that the application can receive at the same time. The first key transmission module is used to obtain a maximum number of user keys from the PCI-E cryptographic card at least once and store them in the first cache space, wherein the user keys stored each time are not repeated; The key backup module is used to perform encrypted calculations on the user keys in the first cache space using the backup key after each storage of user keys is completed, and then store the backup key in the application; after each batch of encrypted user keys is stored, the first cache space is cleared.

7. A PCI-E cryptographic card key recovery device, characterized in that, The device includes: The second cache allocation module is used to allocate a second cache space according to the maximum received data length, wherein the maximum received data length is used to characterize the maximum data length that the PCI-E cryptographic card can receive simultaneously. The second key transmission module is used to obtain multiple encrypted user keys from the application at least once and store them in the second cache space, wherein the encrypted user keys stored each time are not repeated; The key recovery module is used to decrypt the encrypted user key in the second cache space using the backup key after each storage of the encrypted user key is completed, and then store it in the PCI-E cryptographic card; after each successful notification returned by the PCI-E cryptographic card, it retrieves multiple encrypted user keys from the application and stores them in the second cache space again.

8. An electronic device comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 5.

Images