Integrated password service management method based on multi-cloud heterogeneous environment

Abstract

The invention discloses an integrated password service management method based on a multi-cloud heterogeneous environment, and relates to the technical field of information security. Comprising the steps that 1, an integrated password service management system of a multi-cloud heterogeneous environment is created, 2, a unified service subsystem provides double-level adaptation based on a manufacturer adaptation plug-in and a national password standard conversion layer, a private interface is converted into a standard interface, and the standard interface is used for equipment to access a cloud platform and automatically execute algorithm correctness detection and equipment identity authentication; 3, the resource management subsystem predicts a load peak value in a preset time period based on an LSTM neural network model in combination with historical data of a period of time, triggers automatic scheduling when CPU is greater than or equal to 80% or TPS is greater than or equal to a preset threshold value according to a resource allocation rule of government affair core service priority and local node priority, and synchronously updates a key routing table; 4, the resource management subsystem sets a three-level key isolation strategy, and 5, the unified operation and maintenance subsystem monitors the equipment state, the service performance, the key life cycle and the operation auditing process, triggers an alarm at a threshold value, automatically dispatches standby resources and locates faults at the same time.

Description

Technical Field

[0001] This invention discloses an integrated cryptographic service management method based on a multi-cloud heterogeneous environment, which relates to the field of information security technology. Background Technology

[0002] Currently, government systems have formed a pattern of coexistence of cryptographic devices from multiple vendors and heterogeneous cloud environments, but information security management still has some limitations, such as:

[0003] Fragmented management of heterogeneous cryptographic devices: Existing cryptographic device access often adopts the form of "general protocol converter + open source interface encapsulation", which easily leads to problems such as: limited cryptographic adaptation, rudimentary verification, and low utilization.

[0004] Insufficient scheduling capabilities in multi-cloud heterogeneous environments: Existing scheduling schemes still suffer from limitations such as algorithmic constraints, simplistic rules, and rudimentary switching mechanisms.

[0005] Key management is disconnected from government systems: Existing key technologies are not linked to government processes, leading to problems such as insecure storage, inflexible updates, and lack of coordination.

[0006] The operation and maintenance monitoring of cryptography is fragmented and inconsistent: for example, the existing monitoring does not meet the government's requirement for "full-link visibility" and may have defects, such as: scattered tools, incomplete data, and lack of self-healing capabilities. Summary of the Invention

[0007] This invention addresses the problems of existing technologies by providing an integrated cryptographic service management method based on a multi-cloud heterogeneous environment. It can realize functions such as standardized management of heterogeneous devices, dynamic resource scheduling, key lifecycle linkage, and closed-loop operation and maintenance monitoring, thus meeting the adaptation requirements of the domestic IT innovation environment.

[0008] The specific solution proposed in this invention is as follows:

[0009] This invention provides an integrated cryptographic service management method based on a multi-cloud heterogeneous environment, comprising:

[0010] Step 1: Create an integrated cryptographic service management system for multi-cloud heterogeneous environments. This system includes a unified service subsystem, a resource management subsystem, and a unified operation and maintenance subsystem.

[0011] Step 2: The unified service subsystem provides a two-level adaptation based on vendor-compatible plugins and a national cryptographic standard conversion layer, converting private interfaces into standard interfaces for device access to the cloud platform.

[0012] It also automatically performs algorithm correctness checks and device authentication;

[0013] Step 3: The resource management subsystem, based on an LSTM neural network model and historical data over a period of time, predicts the load peak for a preset time period.

[0014] Based on the resource allocation rules prioritizing core government services and local nodes, automatic scheduling is triggered when CPU usage is ≥80% or TPS is ≥ a preset threshold.

[0015] And update the key routing table simultaneously;

[0016] Step 4: Configure a three-tier key isolation strategy in the resource management subsystem: from master key hardware storage and destruction upon opening the cover, to associating subkeys with tenant services, and finally to binding session keys for single invocation.

[0017] And dynamically update the session: When the session is called more than a preset number of times or survives for a preset time, it will be automatically updated and the business system will be notified synchronously.

[0018] Step 5: The unified operation and maintenance subsystem monitors device status, service performance, key lifecycle, and operation audit process, and triggers alarms at thresholds, automatically scheduling backup resources and locating faults.

[0019] Furthermore, in step 2 of the integrated cryptographic service management method based on a multi-cloud heterogeneous environment, a unified service subsystem is first deployed:

[0020] Deploying a unified service subsystem using Nginx load balancing and Tomcat containers:

[0021] Deploying Nginx: Install dependencies: `yum -y install gcc zlib zlib-devel pcre-devel opensslopenssl-devel`

[0022] Unzip nginx-1.13.7.tar.gz, execute `. / configure --with-http_stub_status_module --with-http_ssl_module` to compile, then run `make && make install` to install.

[0023] Modify ` / usr / local / nginx / conf / nginx.conf` to configure load balancing, then execute `. / nginx` to start it.

[0024] Deploying the application: Create a user named ccuss and upload Tomcat to / home / ccuss.

[0025] Modify the bootstrap.yml file in the WAR package, and change server-addr to the Nacos address.

[0026] Place the WAR file in Tomcat / webapps and execute . / startup.sh to start the service;

[0027] Connect to the cloud platform: Call the unified authentication interface to obtain the access_token and code, and obtain the user's unified code through the code;

[0028] Passwordless login can be achieved using the information returned by the cloud platform through the login interface.

[0029] Furthermore, in step 3 of the aforementioned integrated cryptographic service management method based on a multi-cloud heterogeneous environment, a resource management subsystem is deployed:

[0030] Deploying middleware:

[0031] Deploying JDK 1.8: Configure the environment variable JAVA_HOME= / usr / local / jdk1.8.0_271, and execute source / etc / profile to take effect;

[0032] Deploying Nacos 2.1.0: After decompression, modify conf / application.properties, configure the MySQL data source, and execute sh startup.sh -m standalone to start it;

[0033] Deploying Redis 7.0.5: After compiling and installing, execute `redis-server --daemonize yes` to start it in the background and configure the password;

[0034] Deployment of applications:

[0035] Create a ccrm user and upload the resource management subsystem WAR package to Tomcat; modify bootstrap.yml to configure Nacos, Redis, and database addresses; after starting Tomcat, log in to the management interface and add heterogeneous devices;

[0036] Perform service orchestration and configuration: Configure SM2 signature atomic service, SM4 encryption atomic service, and timestamp generation atomic service to combine them into an electronic contract signing process;

[0037] Configure compliance verification rules, generate service processes, and publish them.

[0038] Furthermore, in step 5 of the integrated cryptographic service management method based on a multi-cloud heterogeneous environment, a unified operation and maintenance subsystem is deployed, integrating Prometheus + Grafana:

[0039] Deploy monitoring components:

[0040] Prometheus: Configure prometheus.yml, add monitoring targets, and execute . / prometheus--config.file=prometheus.yml to start it;

[0041] Grafana: After installation, import the monitoring template, configure the Prometheus data source, and create dashboards for device load, service call success rate, and key status;

[0042] Deploying the application: Create a DevOps user, upload the unified operations and maintenance system WAR package to Tomcat, and modify bootstrap.yml to point to Nacos and the database.

[0043] After starting the service, configure the alarm rules;

[0044] Log auditing configuration: Integrates ELK components to collect device logs, service logs, and operation logs, and uses the SM3 algorithm to generate log summaries.

[0045] Configure log retention for 3 years to meet government data retention requirements.

[0046] This invention also provides an integrated cryptographic service management system based on a multi-cloud heterogeneous environment, including a unified service subsystem, a resource management subsystem, and a unified operation and maintenance subsystem.

[0047] The unified service subsystem provides a two-tiered adaptation based on vendor-compatible plugins and a national cryptographic standard conversion layer, converting proprietary interfaces into standard interfaces for device access to the cloud platform.

[0048] It also automatically performs algorithm correctness checks and device authentication;

[0049] The resource management subsystem, based on an LSTM neural network model, predicts the load peak for a preset time period by combining historical data over a certain period.

[0050] Based on the resource allocation rules prioritizing core government services and local nodes, automatic scheduling is triggered when CPU usage is ≥80% or TPS is ≥ a preset threshold.

[0051] And update the key routing table simultaneously;

[0052] The resource management subsystem sets up a three-tier key isolation strategy: from master key hardware storage and destruction upon opening the cover, to subkey association with tenant business, and finally to session key binding for single invocation.

[0053] And dynamically update the session: When the session is called more than a preset number of times or survives for a preset time, it will be automatically updated and the business system will be notified synchronously.

[0054] The unified operation and maintenance subsystem monitors device status, service performance, key lifecycle, and operation auditing processes.

[0055] It triggers alarms at thresholds, automatically schedules backup resources, and locates faults.

[0056] Furthermore, in the aforementioned integrated cryptographic service management system based on a multi-cloud heterogeneous environment, a unified service subsystem is first deployed:

[0057] Deploying a unified service subsystem using Nginx load balancing and Tomcat containers:

[0058] Deploying Nginx: Install dependencies: `yum -y install gcc zlib zlib-devel pcre-devel opensslopenssl-devel`

[0059] Unzip nginx-1.13.7.tar.gz, execute `. / configure --with-http_stub_status_module --with-http_ssl_module` to compile, then run `make && make install` to install.

[0060] Modify ` / usr / local / nginx / conf / nginx.conf` to configure load balancing, then execute `. / nginx` to start it.

[0061] Deploying the application: Create a user named ccuss and upload Tomcat to / home / ccuss.

[0062] Modify the bootstrap.yml file in the WAR package, and change server-addr to the Nacos address.

[0063] Place the WAR file in Tomcat / webapps and execute . / startup.sh to start the service;

[0064] Connect to the cloud platform: Call the unified authentication interface to obtain the access_token and code, and obtain the user's unified code through the code;

[0065] Passwordless login can be achieved using the information returned by the cloud platform through the login interface.

[0066] Furthermore, a resource management subsystem is deployed in the aforementioned integrated cryptographic service management system based on a multi-cloud heterogeneous environment:

[0067] Deploying middleware:

[0068] Deploying JDK 1.8: Configure the environment variable JAVA_HOME= / usr / local / jdk1.8.0_271, and execute source / etc / profile to take effect;

[0069] Deploying Nacos 2.1.0: After decompression, modify conf / application.properties, configure the MySQL data source, and execute sh startup.sh -m standalone to start it;

[0070] Deploying Redis 7.0.5: After compiling and installing, execute `redis-server --daemonize yes` to start it in the background and configure the password;

[0071] Deployment of applications:

[0072] Create a ccrm user and upload the resource management subsystem WAR package to Tomcat; modify bootstrap.yml to configure Nacos, Redis, and database addresses; after starting Tomcat, log in to the management interface and add heterogeneous devices;

[0073] Perform service orchestration and configuration: Configure SM2 signature atomic service, SM4 encryption atomic service, and timestamp generation atomic service to combine them into an electronic contract signing process;

[0074] Configure compliance verification rules, generate service processes, and publish them.

[0075] Furthermore, a unified operation and maintenance subsystem is deployed in the aforementioned integrated cryptographic service management system based on a multi-cloud heterogeneous environment, integrating Prometheus + Grafana:

[0076] Deploy monitoring components:

[0077] Prometheus: Configure prometheus.yml, add monitoring targets, and execute . / prometheus--config.file=prometheus.yml to start it;

[0078] Grafana: After installation, import the monitoring template, configure the Prometheus data source, and create dashboards for device load, service call success rate, and key status;

[0079] Deploying the application: Create a DevOps user, upload the unified operations and maintenance system WAR package to Tomcat, and modify bootstrap.yml to point to Nacos and the database.

[0080] After starting the service, configure the alarm rules;

[0081] Log auditing configuration: Integrates ELK components to collect device logs, service logs, and operation logs, and uses the SM3 algorithm to generate log summaries.

[0082] Configure log retention for 3 years to meet government data retention requirements.

[0083] The advantages of this invention are:

[0084] Resource utilization has been significantly improved: Unified management and dynamic scheduling of heterogeneous equipment have increased equipment utilization from 30% to over 85%, reducing the annual procurement cost of provincial government cryptographic equipment by approximately 2 million yuan.

[0085] Response performance optimization: Service response time is stable at ≤100ms, and scheduling switching time is <1 second;

[0086] Enhanced security and compliance: Three-level key isolation + dynamic updates + operation auditing, meeting the requirements of Level 3 Information Security Protection and commercial cryptography application security assessment, reducing the risk of key leakage by 90%, and meeting the requirements of Level 3 Information Security Protection and commercial cryptography assessment.

[0087] Improved operational efficiency: Fault location time reduced from 1 hour to 5 minutes, system availability reaches 99.99%;

[0088] Improved adaptation efficiency: Supports multiple provincial government service scenarios, and the adaptation cycle for new devices has been shortened from 15 days to 2 days. Attached Figure Description

[0089] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0090] Figure 1 This is a schematic diagram of the method flow of the present invention.

[0091] Figure 2 This is a schematic diagram of the system architecture of the present invention. Detailed Implementation

[0092] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0093] Example 1

[0094] This invention provides an integrated cryptographic service management method based on a multi-cloud heterogeneous environment, comprising:

[0095] Step 1: Create an integrated cryptographic service management system for multi-cloud heterogeneous environments. The system includes a unified service subsystem, a resource management subsystem, and a unified operation and maintenance subsystem.

[0096] The relevant databases are also deployed:

[0097] Master-slave deployment ensures high data availability:

[0098] (1) Dependency installation: Execute yum -y install gcc zlib zlib-devel pcre-devel opensslopenssl-devel to install dependencies;

[0099] (2) MySQL installation:

[0100] Upload mysql-8.0.21-linux-glibc2.12-x86_64.tar.xz to / usr / local, extract it, and configure the environment variables;

[0101] Execute `mysqld --initialize --console` to initialize the system, and then view the temporary password (using `cat / var / log / mysqld.log`).

[0102] After logging in, execute `alter USER 'root'@'localhost' IDENTIFIED BY 'Gov@2024'` to change the password;

[0103] (3) Master-slave configuration:

[0104] The primary database configuration file / etc / my.cnf should have the following settings: server-id=1, log-bin=mysql-bin;

[0105] Configure the slave database in / etc / my.cnf: server-id=2, relay-log=mysql-relay;

[0106] On the master database, execute `grant replication slave on *.*to'slave'@'slave IP'identifiedby'Slave'`. On the slave database, execute `change master to master_host='master IP',master_user='slave',master_password='Slave@2024',master_log_file='master binlog file',master_log_pos=master pos value`.

[0107] (4) Database initialization: Create cccmp-config (configuration library) and cccmp-cloud (business library), and execute the corresponding SQL scripts to generate table structures.

[0108] Step 2: The unified service subsystem provides a two-level adaptation based on vendor-compatible plugins and a national cryptographic standard conversion layer, converting private interfaces into standard interfaces for device access to the cloud platform.

[0109] It also automatically performs algorithm correctness checks and device authentication.

[0110] This includes pre-deploying a unified service subsystem:

[0111] Deploying a unified service subsystem using Nginx load balancing and Tomcat containers:

[0112] Deploying Nginx: Install dependencies: `yum -y install gcc zlib zlib-devel pcre-devel opensslopenssl-devel`

[0113] Unzip nginx-1.13.7.tar.gz, execute `. / configure --with-http_stub_status_module --with-http_ssl_module` to compile, then run `make && make install` to install.

[0114] Modify ` / usr / local / nginx / conf / nginx.conf` to configure load balancing, then execute `. / nginx` to start it.

[0115] Deploying the application: Create a user named ccuss and upload Tomcat to / home / ccuss.

[0116] Modify the bootstrap.yml file in the WAR package, and change server-addr to the Nacos address.

[0117] Place the WAR file in Tomcat / webapps and execute . / startup.sh to start the service;

[0118] Connect to the cloud platform: Call the unified authentication interface to obtain the access_token and code, and obtain the user's unified code through the code;

[0119] Passwordless login can be achieved using the information returned by the cloud platform through the login interface.

[0120] Step 3: The resource management subsystem, based on an LSTM neural network model and historical data over a period of time, predicts the load peak for a preset time period.

[0121] Based on the resource allocation rules prioritizing core government services and local nodes, automatic scheduling is triggered when CPU usage is ≥80% or TPS is ≥ a preset threshold.

[0122] And update the key routing table simultaneously.

[0123] Pre-deploy the resource management subsystem:

[0124] Deploying middleware:

[0125] Deploying JDK 1.8: Configure the environment variable JAVA_HOME= / usr / local / jdk1.8.0_271, and execute source / etc / profile to take effect;

[0126] Deploying Nacos 2.1.0: After decompression, modify conf / application.properties, configure the MySQL data source, and execute sh startup.sh -m standalone to start it;

[0127] Deploying Redis 7.0.5: After compiling and installing, execute `redis-server --daemonize yes` to start it in the background and configure the password;

[0128] Deployment of applications:

[0129] Create a ccrm user and upload the resource management subsystem WAR package to Tomcat; modify bootstrap.yml to configure Nacos, Redis, and database addresses; after starting Tomcat, log in to the management interface and add heterogeneous devices;

[0130] Perform service orchestration and configuration: Configure SM2 signature atomic service, SM4 encryption atomic service, and timestamp generation atomic service to combine them into an electronic contract signing process;

[0131] Configure compliance verification rules, generate service processes, and publish them.

[0132] Step 4: Configure a three-tier key isolation strategy in the resource management subsystem: from master key hardware storage and destruction upon opening the cover, to associating subkeys with tenant services, and finally to binding session keys for single invocation.

[0133] It also dynamically updates sessions: when a session is called more than a preset number of times or survives for more than a preset time, it is automatically updated and the business system is notified synchronously.

[0134] During the deployment of cryptographic devices, the cloud cryptographic machine is initialized:

[0135] IP Configuration: Modify the network interface configuration file

[0136] In ` / etc / sysconfig / network-scripts / ifcfg-br-eno1`, set the management IP address, and then execute `systemctl restart network` to apply the changes.

[0137] Virtual machine network configuration: Edit ` / mnt / dos / linux / etc / ccmp / net / containers.cfg`, modify the 16 virtual machine IPs, execute `systemctl restart docker`; run ` / mnt / dos / linux / etc / ccmp / net / duration.py` to apply the configuration.

[0138] Password card initialization:

[0139] Switch to the directory / mnt / dos / linux / test_qhcard and execute . / testG3pc to enter the password card management interface;

[0140] Select "Password Card Management" → "View Password Card Information" and confirm that the password card version is 1513;

[0141] Insert the administrator U-key and execute "Administrator Login"; insert the operator U-key and execute "Operator Login".

[0142] Execute "Generate Symmetric Key" to generate the default key used by the cloud cryptographic machine;

[0143] Service verification: On a client in the same network segment, execute telnet virtual machine IP 6006. If the port is open, the service is normal.

[0144] During signature verification server initialization:

[0145] (1) Log in as the dean user, switch to the root user, and enter the key directory;

[0146] (2) Execute “Initialize Password Card” → “Initialize Administrator”, insert the administrator UKEY to complete the initialization;

[0147] (3) Execute “Administrator Login” → “Add Operator”, insert the operator UKEY to complete the authorization;

[0148] (4) Execute “Generate Master Key” (twice consecutively), “Generate SM4 Key”, and “Generate SM2 Key”, and configure the number of keys according to business requirements;

[0149] (5) Execute dtserver to start the main service. Access http: / / deviceIP:8080 in the browser. After the administrator logs in, add the signature verification service and the operator starts the service.

[0150] Step 5: The unified operation and maintenance subsystem monitors device status, service performance, key lifecycle, and operation audit process, and triggers alarms at thresholds, automatically scheduling backup resources and locating faults.

[0151] Pre-deploy a unified operations and maintenance subsystem, integrating Prometheus and Grafana:

[0152] Deploy monitoring components:

[0153] Prometheus: Configure prometheus.yml, add monitoring targets, and execute . / prometheus--config.file=prometheus.yml to start it;

[0154] Grafana: After installation, import the monitoring template, configure the Prometheus data source, and create dashboards for device load, service call success rate, and key status;

[0155] Deploying the application: Create a DevOps user, upload the unified operations and maintenance system WAR package to Tomcat, and modify bootstrap.yml to point to Nacos and the database.

[0156] After starting the service, configure the alarm rules;

[0157] Log auditing configuration: Integrates ELK components to collect device logs, service logs, and operation logs, and uses the SM3 algorithm to generate log summaries.

[0158] Configure log retention for 3 years to meet government data retention requirements.

[0159] Example 2

[0160] This invention also provides an integrated cryptographic service management system based on a multi-cloud heterogeneous environment, including a unified service subsystem, a resource management subsystem, and a unified operation and maintenance subsystem.

[0161] The unified service subsystem provides a two-tiered adaptation based on vendor-compatible plugins and a national cryptographic standard conversion layer, converting proprietary interfaces into standard interfaces for device access to the cloud platform.

[0162] It also automatically performs algorithm correctness checks and device authentication;

[0163] The resource management subsystem, based on an LSTM neural network model, predicts the load peak for a preset time period by combining historical data over a certain period.

[0164] Based on the resource allocation rules prioritizing core government services and local nodes, automatic scheduling is triggered when CPU usage is ≥80% or TPS is ≥ a preset threshold.

[0165] And update the key routing table simultaneously;

[0166] The resource management subsystem sets up a three-tier key isolation strategy: from master key hardware storage and destruction upon opening the cover, to subkey association with tenant business, and finally to session key binding for single invocation.

[0167] And dynamically update the session: When the session is called more than a preset number of times or survives for a preset time, it will be automatically updated and the business system will be notified synchronously.

[0168] The unified operation and maintenance subsystem monitors device status, service performance, key lifecycle, and operation auditing processes.

[0169] It triggers alarms at thresholds, automatically schedules backup resources, and locates faults.

[0170] The information interaction and execution process of the various subsystems within the above system are based on the same concept as the method embodiments of the present invention, and the specific details can be found in the descriptions in the method embodiments of the present invention, and will not be repeated here.

[0171] Similarly, the advantages of the system of the present invention are:

[0172] Resource utilization has been significantly improved: Unified management and dynamic scheduling of heterogeneous equipment have increased equipment utilization from 30% to over 85%, reducing the annual procurement cost of provincial government cryptographic equipment by approximately 2 million yuan.

[0173] Response performance optimization: Service response time is stable at ≤100ms, and scheduling switching time is <1 second;

[0174] Enhanced security and compliance: Three-level key isolation + dynamic updates + operation auditing, meeting the requirements of Level 3 Information Security Protection and commercial cryptography application security assessment, reducing the risk of key leakage by 90%, and meeting the requirements of Level 3 Information Security Protection and commercial cryptography assessment.

[0175] Improved operational efficiency: Fault location time reduced from 1 hour to 5 minutes, system availability reaches 99.99%;

[0176] Improved adaptation efficiency: Supports multiple provincial government service scenarios, and the adaptation cycle for new devices has been shortened from 15 days to 2 days.

[0177] It should be noted that not all steps and modules in the above processes and system structures are mandatory; some steps or modules can be omitted as needed. The execution order of each step is not fixed and can be adjusted as required. The system structures described in the above embodiments can be physical or logical structures. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be jointly implemented by certain components in multiple independent devices.

[0178] The above-described embodiments are merely preferred embodiments provided to fully illustrate the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the scope of protection of the present invention. The scope of protection of the present invention is defined by the claims.

Claims

1. An integrated cryptographic service management method based on a multi-cloud heterogeneous environment, characterized by: include: Step 1: Create an integrated cryptographic service management system for multi-cloud heterogeneous environments. This system includes a unified service subsystem, a resource management subsystem, and a unified operation and maintenance subsystem. Step 2: The unified service subsystem provides a two-level adaptation based on vendor-compatible plugins and a national cryptographic standard conversion layer, converting private interfaces into standard interfaces for device access to the cloud platform. It also automatically performs algorithm correctness checks and device authentication; Step 3: The resource management subsystem, based on an LSTM neural network model and historical data over a period of time, predicts the load peak for a preset time period. Based on the resource allocation rules prioritizing core government services and local nodes, automatic scheduling is triggered when CPU usage is ≥80% or TPS is ≥ a preset threshold. And update the key routing table simultaneously; Step 4: Configure a three-tier key isolation strategy in the resource management subsystem: from master key hardware storage and destruction upon opening the cover, to associating subkeys with tenant services, and finally to binding session keys for single invocation. And dynamically update the session: When the session is called more than a preset number of times or survives for a preset time, it will be automatically updated and the business system will be notified synchronously. Step 5: The unified operation and maintenance subsystem monitors device status, service performance, key lifecycle, and operation auditing processes. It triggers alarms at thresholds, automatically schedules backup resources, and locates faults.

2. The integrated cryptographic service management method based on a multi-cloud heterogeneous environment according to claim 1, characterized in that: Step 2 involves first deploying the unified service subsystem: Deploying a unified service subsystem using Nginx load balancing and Tomcat containers: Deploying Nginx: Install dependencies: `yum -y install gcc zlib zlib-devel pcre-devel opensslopenssl-devel` Unzip nginx-1.13.7.tar.gz, execute `. / configure --with-http_stub_status_module --with-http_ssl_module` to compile, then run `make && make install` to install. Modify ` / usr / local / nginx / conf / nginx.conf` to configure load balancing, then execute `. / nginx` to start it. Deploying the application: Create a user named ccuss and upload Tomcat to / home / ccuss. Modify the bootstrap.yml file in the WAR package, and change server-addr to the Nacos address. Place the WAR file in Tomcat / webapps and execute . / startup.sh to start the service; Connect to the cloud platform: Call the unified authentication interface to obtain the access_token and code, and obtain the user's unified code through the code; Passwordless login can be achieved using the information returned by the cloud platform through the login interface.

3. The integrated cryptographic service management method based on a multi-cloud heterogeneous environment as described in claim 1, Its characteristic is the deployment of a resource management subsystem in step 3: Deploying middleware: Deploying JDK 1.8: Configure the environment variable JAVA_HOME= / usr / local / jdk1.8.0_271, and execute source / etc / profile to take effect; Deploying Nacos 2.1.0: After decompression, modify conf / application.properties, configure the MySQL data source, and execute sh startup.sh -m standalone to start it; Deploying Redis 7.0.5: After compiling and installing, execute `redis-server --daemonize yes` to start it in the background and configure the password; Deployment of applications: Create a ccrm user and upload the resource management subsystem WAR package to Tomcat; modify bootstrap.yml to configure Nacos, Redis, and database addresses; After starting Tomcat, log in to the management interface and add heterogeneous devices; Perform service orchestration and configuration: Configure SM2 signature atomic service, SM4 encryption atomic service, and timestamp generation atomic service to combine them into an electronic contract signing process; Configure compliance verification rules, generate service processes, and publish them.

4. The integrated cryptographic service management method based on a multi-cloud heterogeneous environment according to claim 1, characterized in that: Step 5 involves deploying a unified operations and maintenance subsystem, integrating Prometheus and Grafana: Deploy monitoring components: Prometheus: Configure prometheus.yml, add monitoring targets, and execute . / prometheus--config.file=prometheus.yml to start it; Grafana: After installation, import the monitoring template, configure the Prometheus data source, and create dashboards for device load, service call success rate, and key status; Deploying the application: Create a DevOps user, upload the unified operations and maintenance system WAR package to Tomcat, and modify bootstrap.yml to point to Nacos and the database. After starting the service, configure the alarm rules; Log auditing configuration: Integrates ELK components to collect device logs, service logs, and operation logs, and uses the SM3 algorithm to generate log summaries. Configure log retention for 3 years to meet government data retention requirements.

5. An integrated cryptographic service management system based on a multi-cloud heterogeneous environment, characterized in that: It includes a unified service subsystem, a resource management subsystem, and a unified operation and maintenance subsystem. The unified service subsystem provides a two-tiered adaptation based on vendor-compatible plugins and a national cryptographic standard conversion layer, converting proprietary interfaces into standard interfaces for device access to the cloud platform. It also automatically performs algorithm correctness checks and device authentication; The resource management subsystem, based on an LSTM neural network model, predicts the load peak for a preset time period by combining historical data over a certain period. Based on the resource allocation rules prioritizing core government services and local nodes, automatic scheduling is triggered when CPU usage is ≥80% or TPS is ≥ a preset threshold. And update the key routing table simultaneously; The resource management subsystem sets up a three-tier key isolation strategy: from master key hardware storage and destruction upon opening the cover, to subkey association with tenant business, and finally to session key binding for single invocation. And dynamically update the session: When the session is called more than a preset number of times or survives for a preset time, it will be automatically updated and the business system will be notified synchronously. The unified operation and maintenance subsystem monitors device status, service performance, key lifecycle, and operation auditing processes. It triggers alarms at thresholds, automatically schedules backup resources, and locates faults.

6. The integrated cryptographic service management system based on a multi-cloud heterogeneous environment according to claim 5, characterized in that: First, deploy the unified service subsystem: Deploying a unified service subsystem using Nginx load balancing and Tomcat containers: Deploying Nginx: Install dependencies: `yum -y install gcc zlib zlib-devel pcre-devel opensslopenssl-devel` Unzip nginx-1.13.7.tar.gz, execute `. / configure --with-http_stub_status_module --with-http_ssl_module` to compile, then run `make && make install` to install. Modify ` / usr / local / nginx / conf / nginx.conf` to configure load balancing, then execute `. / nginx` to start it. Deploying the application: Create a user named ccuss and upload Tomcat to / home / ccuss. Modify the bootstrap.yml file in the WAR package, and change server-addr to the Nacos address. Place the WAR file in Tomcat / webapps and execute . / startup.sh to start the service; Connect to the cloud platform: Call the unified authentication interface to obtain the access_token and code, and obtain the user's unified code through the code; Passwordless login can be achieved using the information returned by the cloud platform through the login interface.

7. The integrated cryptographic service management system based on a multi-cloud heterogeneous environment according to claim 5, characterized in that: Deploy the resource management subsystem: Deploying middleware: Deploying JDK 1.8: Configure the environment variable JAVA_HOME= / usr / local / jdk1.8.0_271, and execute source / etc / profile to take effect; Deploying Nacos 2.1.0: After decompression, modify conf / application.properties, configure the MySQL data source, and execute sh startup.sh -m standalone to start it; Deploying Redis 7.0.5: After compiling and installing, execute `redis-server --daemonize yes` to start it in the background and configure the password; Deployment of applications: Create a ccrm user and upload the resource management subsystem WAR package to Tomcat; modify bootstrap.yml to configure Nacos, Redis, and database addresses; After starting Tomcat, log in to the management interface and add heterogeneous devices; Perform service orchestration and configuration: Configure SM2 signature atomic service, SM4 encryption atomic service, and timestamp generation atomic service to combine them into an electronic contract signing process; Configure compliance verification rules, generate service processes, and publish them.

8. The integrated cryptographic service management system based on a multi-cloud heterogeneous environment according to claim 5, characterized in that: Deploy a unified operations and maintenance subsystem, integrating Prometheus and Grafana: Deploy monitoring components: Prometheus: Configure prometheus.yml, add monitoring targets, and execute . / prometheus--config.file=prometheus.yml to start it; Grafana: After installation, import the monitoring template, configure the Prometheus data source, and create dashboards for device load, service call success rate, and key status; Deploying the application: Create a DevOps user, upload the unified operations and maintenance system WAR package to Tomcat, and modify bootstrap.yml to point to Nacos and the database. After starting the service, configure the alarm rules; Log auditing configuration: Integrates ELK components to collect device logs, service logs, and operation logs, and uses the SM3 algorithm to generate log summaries. Configure log retention for 3 years to meet government data retention requirements.

Images