Key processing method and apparatus, and related device

Abstract

The present application discloses a key processing method. The key processing method is applied to a management system. The management system is connected to service systems, and manages cryptographic devices on the basis of key indexes. The method comprises: the management system acquires a first key operation instruction sent by a first service system among the service systems, and sends a second key operation instruction to a first cryptographic device on the basis of first key information, wherein the second key operation instruction comprises a first key index and a first operation type, the first key index is an index of a first key corresponding to the first key information, and the second key operation instruction is used for instructing the first cryptographic device to perform operation of the first operation type on the first key; and the management system acquires a first key operation result fed back by the first cryptographic device. By using key indexes in this way, the management system can implement cross-device and cross-cluster key management, and can meet the requirement of unified management of keys in a large-scale service scenario.

Description

Key processing method, device and related equipment

[0001] This application claims priority to Chinese patent application number 202310770039.0, filed with the State Intellectual Property Office on June 27, 2023, entitled “A method, device and other equipment for key management,” the entire contents of which are hereby incorporated by reference into this application. Furthermore, this application claims priority to Chinese patent application number CN202311001529.0, filed with the State Intellectual Property Office on August 9, 2023, entitled “Key processing method, device and related equipment,” the entire contents of which are hereby incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of cloud computing technology, and in particular to a key processing method, apparatus, and related equipment. Background Art

[0003] Current business scenarios require encryption of data with high security requirements. Data encryption scenarios include data storage, data transmission, identity authentication, and data integrity protection. For business scenarios requiring high security and high performance encryption, cryptographic devices are often used to implement key management and cryptographic operations. Examples of cryptographic devices include hardware devices such as cryptographic cards, cryptographic machines, and signature verification servers.

[0004] Currently, cryptographic devices typically manage the keys stored within them. However, in large-scale encryption scenarios, the large number of keys involved makes cross-device key management difficult. Current device-based key management methods are unable to meet the needs of large-scale encryption scenarios.

[0005] Summary of the Invention

[0006] The embodiments of the present application provide a key processing method, apparatus and related equipment, which can be applied to a management system connected to a business system. The management system can use key indexes to manage cryptographic devices, realize cross-device key management, and meet the needs of unified key management in large-scale encrypted business scenarios.

[0007] In a first aspect, the present application provides a key processing method for a management system. The management system is connected to a business system. The management system manages cryptographic devices based on a key index. The management system obtains a first key operation instruction sent by a first business system. The first business system is one of the business systems connected to the management system. The first key operation instruction includes first key information and a first operation type. The first key information is used to identify a first key to be processed. The first operation type is an operation type for operating on the first key. The management system generates a second key operation instruction based on the first key information. The second key operation instruction includes a first key index and the first operation type. The first key index is an index of the first key corresponding to the first key information. The first key index is a unique index of the first key. The management system sends the second key operation instruction to a first cryptographic device. The second key operation instruction instructs the first cryptographic device to perform the first operation type on the first key. The first cryptographic device is one of the cryptographic devices managed by the management system. As an example, the first cryptographic device can be one that the management system determines requires an operation on the first key based on the second key operation instruction. As another example, the first key information includes an identifier of the first cryptographic device. The management system determines the first cryptographic device based on the identifier of the first cryptographic device included in the first key information. The management system obtains the first key operation result fed back by the first cryptographic device, and implements subsequent management of the first key and the first cryptographic device based on the first key operation result.

[0008] The management system uses key indexes to manage cryptographic devices, enabling cross-device and cross-cluster management. Furthermore, using key indexes that uniquely correspond to keys enables global key awareness and management, meeting the needs of key usage and management in large-scale scenarios.

[0009] In some possible implementations, there are multiple business systems connected to the management system. That is, the relationship between the management system and the business systems is one-to-one or one-to-many. The business systems connected to the management system include a second business system. The management system obtains a third key operation instruction sent by the second business system. The third key operation instruction includes second key information and a second operation type. Based on the second key information, the management system sends a fourth key operation instruction to the second cryptographic device. The fourth key operation instruction includes a second key index and a second operation type. The second key index is the index of the second key corresponding to the second key information. The fourth key operation instruction is used to instruct the second cryptographic device to perform an operation of the second operation type on the second key. The second cryptographic device is one of the cryptographic devices managed by the management system. The second cryptographic device can be determined by the management system based on the second key operation instruction or based on the cryptographic device identifier included in the first key information. The management system obtains the second key operation result fed back by the second cryptographic device, and implements subsequent management of the second key and the second cryptographic device based on the second key operation result.

[0010] In some possible implementations, after the management system obtains the first key operation result fed back by the first cryptographic device, the management system updates the key management information of the key index based on the first key operation. The key management information includes information related to the key. The key management information includes one or more of a key ID, a key algorithm name, a key type, and a key version. The management system can manage the key lifecycle based on the key management information.

[0011] In some possible implementations, the first operation type includes one or more of a creation type, a query type, an update type, and a deletion type.

[0012] In some possible implementations, the first operation type is a creation type. That is, the second key operation instruction instructs the first cryptographic device to create a first key corresponding to a first key index. After receiving the first key operation result from the first cryptographic device, the management system records the generated first key index in the key management information for the key index. This enables timely updates of the key management information, facilitates the management system's determination of key status based on the key management information, and facilitates key management.

[0013] In some possible implementations, a management system controls a first cryptographic device to synchronize a first key. The management system sends a key synchronization instruction to the first cryptographic device. The key synchronization instruction includes a first key index. The key synchronization instruction instructs the first cryptographic device to synchronize the first key corresponding to the first key index to a third cryptographic device. In this manner, synchronization of the first key between the cryptographic devices is achieved.

[0014] In some other possible implementations, the management system can implement key backup. The management system obtains a key backup instruction including a first key index sent by the fourth cryptographic device. The management system obtains the first key corresponding to the first key index from the first cryptographic device, and sends the first key to the fourth cryptographic device. This application does not limit the manner in which the management system obtains the first key corresponding to the first key index from the first cryptographic device. As an example, after the first cryptographic device creates the first key, the management system obtains the first key from the first key operation result sent by the first cryptographic device. As another example, after obtaining the key backup instruction, the management system queries whether the first key corresponding to the first key index is created by the first cryptographic device. The management system obtains the first key from the first cryptographic device.

[0015] Key synchronization and key backup address key migration requirements for scenarios such as application migration and the addition of new cryptographic devices. This decouples business applications from the local hardware that stores keys, expanding the scope of applicable scenarios. Furthermore, synchronizing or backing up keys improves key reliability and ensures key recoverability. This reduces the need for other cryptographic devices to create the same key, simplifying key management.

[0016] In some possible implementations, the cryptographic device is a physical functional device. The cryptographic device includes multiple virtual functional devices (VFDs) derived through virtualization. Multiple keys corresponding to a key index are associated with the VFDs via an attribution index. This allows the VFD associated with a key to be determined based on the attribution index, enabling the VFD to access the associated key. This eliminates the need to store the same key in different VFDs, conserving key storage space, improving key management efficiency, and reducing space costs.

[0017] In some possible implementations, the management system can also adjust the virtual function devices corresponding to the keys in the cryptographic device. The management system sends a key adjustment instruction to the first cryptographic device. The key adjustment instruction instructs the first cryptographic device to adjust the distribution of the first key among the virtual function devices of the first cryptographic device and update the attribution index associated with the first key. Using the attribution index, the association between the key and the virtual function device can be dynamically adjusted, avoiding the storage of the same key in different virtual function devices, reducing key storage space and saving costs.

[0018] In the second aspect, the present application provides a key processing device, which is applied to a management system, which is connected to a business system, and the management system manages cryptographic devices according to a key index. The device includes: an acquisition module for acquiring a first key operation instruction sent by a first business system in the business system, the first key operation instruction including first key information and a first operation type; a sending module for sending a second key operation instruction to a first cryptographic device based on the first key information, the second key operation instruction including a first key index and the first operation type, the first key index being the index of the first key corresponding to the first key information, and the second key operation instruction being used to instruct the first cryptographic device to perform the first operation type operation on the first key; the acquisition module is also used to obtain the first key operation result fed back by the first cryptographic device.

[0019] In some possible implementations, the acquisition module is further used to acquire a third key operation instruction sent by the second business system in the business system, where the third key operation instruction includes second key information and a second operation type; the sending module is further used to send a fourth key operation instruction to the second cryptographic device based on the second key information, where the fourth key operation instruction includes a second key index and the second operation type, where the second key index is the index of the second key corresponding to the second key information, and the fourth key operation instruction is used to instruct the second cryptographic device to perform the second operation type operation on the second key; the acquisition module is also used to obtain the second key operation result fed back by the second cryptographic device.

[0020] In some possible implementations, the apparatus further includes:

[0021] An update module is used to update the key management information of the key index according to the first key operation result, where the key management information includes one or more of the following: key ID, key algorithm name, key type, and key version.

[0022] In some possible implementations, the first operation type includes one or more of the following: a create type, a query type, an update type, and a delete type.

[0023] In some possible implementations, the first operation type is the create type, and the apparatus further includes:

[0024] A recording module is used to record the generated first key index into the key management information of the key index.

[0025] In some possible implementations, the sending module is further used to send a key synchronization instruction to the first cryptographic device, where the key synchronization instruction includes the first key index, and the key synchronization instruction is used to synchronize the first key corresponding to the first key index to a third cryptographic device.

[0026] In some possible implementations, the acquisition module is further configured to acquire a key backup instruction of a fourth cryptographic device, where the key backup instruction includes the first key index;

[0027] The acquisition module is further configured to acquire the first key corresponding to the first key index from the first cryptographic device;

[0028] The sending module is further configured to send the first key to the fourth cryptographic device.

[0029] In some possible implementations, the cryptographic device is a physical functional device, the cryptographic device includes multiple virtual functional devices, and the multiple keys corresponding to the key index are associated with the multiple virtual functional devices through a belonging index.

[0030] In some possible implementations, the sending module is further used to send a key adjustment instruction to the first cryptographic device, where the key adjustment instruction is used to instruct the first cryptographic device to adjust the distribution of the first key in the virtual function device of the first cryptographic device and update the attribution index associated with the first key.

[0031] In a third aspect, the present application provides a computing device cluster, wherein the computing device includes at least one computing device, and the at least one computing device includes at least one processor and at least one memory; the at least one memory is used to store instructions, and the at least one processor executes the instructions stored in the at least one memory, so that the computing device cluster performs the key processing method in the above-mentioned first aspect or any possible implementation of the first aspect. It should be noted that the memory can be integrated into the processor or can be independent of the processor. The at least one computing device may also include a bus. The processor is connected to the memory via a bus. The memory may include a readable memory and a random access memory.

[0032] In a fourth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is run on at least one computing device, the at least one computing device executes the method described in the first aspect or any implementation of the first aspect.

[0033] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on at least one computing device, enables the at least one computing device to execute the method described in the first aspect or any one of the implementations of the first aspect.

[0034] Based on the implementation methods provided in the above aspects, this application can also be further combined to provide more implementation methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] FIG1 is a schematic diagram of an exemplary cryptographic device and server architecture provided in an embodiment of the present application;

[0036] FIG2 is a schematic diagram of a mapping relationship between a service node and a virtual cryptographic device provided in an embodiment of the present application;

[0037] FIG3 is a schematic diagram of a system architecture provided in an embodiment of the present application;

[0038] FIG4 is a schematic diagram of the structure of a system provided in an embodiment of the present application;

[0039] FIG5 is a schematic diagram of the interaction process between the first business system, the management system, and the first cryptographic device according to an embodiment of the present application;

[0040] FIG6 is a flow chart of a key processing method provided in an embodiment of the present application;

[0041] FIG7 is a structural diagram of a key processing method and apparatus further provided in an embodiment of the present application;

[0042] FIG8 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0043] FIG9 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0044] FIG10 is a schematic diagram of a connection method of computing devices in a computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] The following will describe the solutions in the embodiments provided in this application in conjunction with the drawings in this application.

[0046] The terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate and are merely used to describe the manner in which objects with the same attributes are described in the embodiments of this application.

[0047] In business scenarios with high security and high-performance encryption requirements, independent hardware security modules (HSMs) are often used to implement cryptographic operations and key management. HSMs are tamper-resistant and intrusion-resistant hardware components used to enhance the security of cryptographic operations and store encryption keys. HSMs can provide authorized users with key usage and management services while ensuring the security of the cryptographic operation process. HSMs are mainly divided into two forms: Peripheral Component Interconnect (PCI) boards or server cryptographic machines. PCI board forms include high-speed Peripheral Component Interconnect Express (PCIE) cryptographic cards. Server cryptographic machine forms include cryptographic machines and signature verification servers. Such devices that have certain cryptographic functions or can complete certain cryptographic tasks can also be called cryptographic devices.

[0048] Currently, cryptographic devices primarily manage keys using a key index table. Each key has a unique index within the device's management scope. The device manages the keys and key indexes stored within it. This makes cross-device operations like key lookups difficult in large-scale cloud or big data scenarios, making unified key management difficult.

[0049] In some business scenarios, cryptographic devices need to be virtualized. A physical function (PF) cryptographic device is virtualized into multiple virtual function (VF) cryptographic devices to meet the needs of large-scale cryptographic usage and key management. PF cryptographic devices can also be called physical cryptographic devices, and VF cryptographic devices can be called virtual cryptographic devices.

[0050] As an example, refer to Figure 1, which is a schematic diagram of the architecture of an exemplary cryptographic device and server provided in an embodiment of the present application. The server is used to provide service resources or application resources to users. The server is connected to M physical cryptographic devices. The physical cryptographic device is used to manage device keys, cluster keys, and manufacturer keys. Each physical cryptographic device can be virtualized into N virtual cryptographic devices through virtualization methods such as virtualization technology (Single Root I / O Virtualization, SR-IOV). The virtual cryptographic device is used to manage key encryption keys (Key Encryption Key, KEK), data encryption keys (Data Encryption Key, DEK), public-private key pairs, and card root keys.

[0051] The virtual cryptographic device is called by service resources or application resources to provide cryptographic operations and key management services.

[0052] Virtual cryptographic devices are assigned to the service nodes included in the required business system. See Figure 2, which shows a schematic diagram of the mapping relationship between service nodes and virtual cryptographic devices, provided in an embodiment of the present application. Each service node is assigned A virtual cryptographic devices as needed. Each virtual cryptographic device is assigned B keys to provide cryptographic operations and key management services for the service node.

[0053] However, the keys and key indexes included in the virtual cryptographic devices in each physical cryptographic device are independent of each other. If different virtual cryptographic devices need to use the same key, each virtual cryptographic device using the key must store the same key and key index, resulting in the same key being stored repeatedly in different virtual cryptographic devices, wasting storage space.

[0054] Based on this, an embodiment of the present application provides a key processing method. The key processing method can be applied to a management system. The management system is connected to a business system. The management system manages cryptographic devices based on a key index. The management system obtains a first key operation instruction sent by a first business system in the business system. The first business system is one of the business systems to which the management system is connected. The first key operation instruction includes first key information and a first operation type. The management system sends a second key operation instruction to the first cryptographic device based on the obtained first key operation instruction. The first cryptographic device is one of the cryptographic devices managed by the management system. The second key operation instruction includes a first key index and a first operation type. The first key index is an index of the first key corresponding to the key information. The second key operation instruction is used to instruct the first cryptographic device to perform an operation of the first operation type on the first key. The management system obtains the first key operation result fed back by the first cryptographic device.

[0055] The management system manages cryptographic devices based on key indexes. A key index is a unique index generated by the management system for each key. Using this unique key index, the management system can implement global key management across devices and clusters, eliminating the need for single-device key management and meeting the needs of unified key management in large-scale business scenarios.

[0056] The following describes the system involved in the key processing method provided in the embodiment of the present application. The system can be applied to cloud computing, big data, storage, database and other scenarios involving key management.

[0057] The key processing method provided in the embodiment of the present application can be applied to the system of the system architecture shown in Figure 3. The system includes hardware devices, a platform layer, a service layer and an application layer. The hardware devices of the system include physical cryptographic devices that support virtualization, build multiple virtual cryptographic devices, and map the virtual cryptographic devices to information technology (IT) resources. At the platform layer, the key creation and life cycle management capabilities of the virtual cryptographic devices are implemented based on the management system, and the key synchronization and management capabilities between cryptographic devices are supported. The service layer integrates the virtual cryptographic devices into the service process as needed to realize encryption operations, key management and other capabilities. The application layer supports applications to directly connect to cryptographic devices to manage keys based on tools, and can also reuse key management capabilities to achieve rapid management of keys.

[0058] Refer to Figure 4, which is a structural diagram of a system provided in an embodiment of the present application. The system includes multiple business systems and a management system. Multiple business systems are connected to the management system. The business system has multiple cryptographic devices. The cryptographic devices are virtualized to obtain multiple virtual functional devices. The management system is used to manage the cryptographic devices of the business system. It should be noted that the management system can manage the cryptographic devices of one or more business systems, and this embodiment of the present application does not limit this. The embodiment of the present application also does not limit the specific type of cryptographic device, such as a cryptographic card, a cryptographic machine, or a signature verification server that supports virtualization.

[0059] Next, various non-limiting specific implementations of the key processing method are described in detail.

[0060] The key processing method provided in the embodiment of the present application can be applied to a management system. For ease of understanding, the following description is given using the structure of the system shown in FIG4 as an example.

[0061] Referring to FIG5 , which is a schematic diagram of the interaction process between the first business system, the management system, and the first cryptographic device provided in an embodiment of the present application, the key processing method provided in an embodiment of the present application includes the following steps:

[0062] Step S501: The first business system generates a first key operation instruction.

[0063] The first business system is one of the business systems connected to the management system. When processing cryptographic-related business, the first business system needs to operate on a key and generates a first key operation instruction. The first key operation instruction includes first key information and a first operation type. The first key information corresponds to the first key to be operated. The first operation type is the type of operation to be performed on the first key corresponding to the first key information. The first key operation instruction is used to instruct the first key operation to be performed using the first key corresponding to the first key information.

[0064] The first key information and the first operation type are determined based on business needs. As an example, the first key information includes a key type. For example, the key type includes a key encryption key (KEK) or a data encryption key (DEK). As another example, the first key information includes a first key index. The first key index is a pre-established index that uniquely corresponds to the first key. Based on the first key index, the first key corresponding to the first key index can be determined. As another example, the first key information includes an identifier of a first cryptographic device. This makes it easy to determine the cryptographic device that needs to process the first key corresponding to the first key information based on the identifier of the first cryptographic device.

[0065] The first operation type is, for example, one or more types of operations related to the key, such as a creation type, a query type, an update type, a deletion type, and a management type.

[0066] It should be noted that in some scenarios, the first operation type is determined based on the first key information. For example, the first cryptographic device is used to generate a DEK-type key and encrypt the DEK using the KEK. The cryptographic device does not store DEK-type keys, nor does it manage DEKs. The first key information included in the first key operation instruction is the key type of the DEK and the first key index of the KEK, and the first operation type is a creation type. For another example, the first cryptographic device is used to generate a KEK-type key and is capable of maintaining and managing the KEK-type key. For example, the first key information included in the first key operation instruction is the key type of the KEK, and the first operation type is a creation type. Or, for another example, the first key information included in the first key operation instruction is the first key index of the KEK, and the first operation type is one or more of the operation types such as the query type, the update type, and the deletion type.

[0067] In some possible implementations, the first key operation instruction may include, in addition to the first key information and the first operation type, other operation information. The operation information may be determined based on the requirements for processing the key.

[0068] Step S502: The first business system sends a first key operation instruction to the management system.

[0069] The management system is a system that manages the cryptographic devices of the first business system. The first business system can establish a connection with the management system in advance. After generating the first key operation instruction, the first business system sends the first key operation instruction to the management system.

[0070] It should be noted that, in some implementations, the first key operation instruction also includes system information of the first business system. This facilitates the management system to determine the first business system on which the key operation is to be performed. The system information may be, for example, the system identifier of the first business system or the address of the first business system that sent the first key operation instruction.

[0071] Step S503: The management system obtains the first key operation instruction sent by the first business system.

[0072] Step S504: The management system sends a second key operation instruction to the first cryptographic device according to the first key information.

[0073] The management system generates a second key operation instruction based on the obtained first key operation instruction. The second key operation instruction includes a first key index and a first operation type. The first key index is a unique index of the first key corresponding to the first key information. The first key index is determined by the management system. Using the unique first key index enables unified key management and global scheduling, no longer limited to the management of a single device. The second key operation instruction is used to instruct the execution of the first operation type using the first key corresponding to the first key index.

[0074] In one possible implementation, the first key operation instruction is used to create a key. The first operation type included in the first key operation instruction is a creation type. The first key information of the first key operation instruction does not include a first key index, for example, the first key information only includes a key type. After obtaining the first key operation instruction, the management system assigns a first key index to the first key to be created based on an index creation rule. In another possible implementation, the first key operation instruction is used to perform other operations on the already created first key, such as a query operation, an update operation, or a deletion operation. The first key information included in the first key operation instruction includes a first key index. The management system generates a second key operation instruction using the first key index and the first operation type included in the first key operation instruction.

[0075] The embodiments of the present application do not limit the specific content of the index creation rule. The index creation rule is used to generate a first key index that uniquely corresponds to the first key. As an example, the index creation rule uses the sequence number of key creation as the first key index. As another example, the index creation rule selects an index from an index resource pool as the first key index.

[0076] In addition to the first key index and the first operation type, in some implementations, the second key operation instruction also includes other information required for performing key operations, such as key version, key type, etc. For example, for a second key operation instruction for creating a DEK, the second key operation instruction includes that the first key index is the first key index of the KEK, the first operation type is a creation operation, and the key type of the DEK.

[0077] The management system determines a first cryptographic device that operates a first key based on a second key operation instruction. The first cryptographic device is one of the cryptographic devices of the first business system. The embodiments of the present application do not limit the method for determining the first cryptographic device. For example, the first operation type included in the second key operation instruction is a creation type. As an example, the management system can select any cryptographic device from the cryptographic devices of the first business system as the first cryptographic device. As another example, the management system determines the first cryptographic device that creates a key based on a resource pool of cryptographic devices. For another example, the first operation type included in the second key operation instruction is an update type, a query type, or a deletion type. The management system determines the first cryptographic device based on the cryptographic device that stores the key corresponding to the first key index of the second key operation instruction. For another example, the first key information included in the first key operation instruction includes an identifier of the first cryptographic device. The management system determines the first cryptographic device based on the identifier of the first cryptographic device included in the first key information. After determining the first cryptographic device, the management system sends the second key operation instruction to the first cryptographic device.

[0078] Step S505: The first cryptographic device obtains the second key operation instruction sent by the management system.

[0079] Step S506: The first cryptographic device performs an operation of the first operation type on the first key corresponding to the first key index to generate a first key operation result.

[0080] The first cryptographic device performs an operation of the first operation type based on the first key corresponding to the first key index according to the second key operation instruction, and generates a first key operation result based on the result of the operation.

[0081] In one possible implementation, the operation of the first operation type is an operation on the first key corresponding to the first key index. For example, for a second key operation instruction for deleting a KEK, the first key index included in the second key operation instruction is the first key index of the KEK, and the first operation type is a deletion operation. The first cryptographic device performs the second key operation to delete the KEK corresponding to the first key index. In another possible implementation, the operation of the first operation type is an operation performed using the first key corresponding to the first key index. For example, for a second key operation instruction for creating a DEK, the first key index included in the second key operation instruction is the first key index of the KEK, the first operation type is a creation operation, and the key type of the DEK. The first cryptographic device performs the second key operation to create a DEK, and encrypts the DEK using the KEK corresponding to the first key index.

[0082] The embodiments of the present application do not limit the specific content of the first key operation result. The content of the first key operation result is related to the second key operation instruction. As some examples, the embodiments of the present application provide four specific contents of the first key operation result.

[0083] The first type: the first operation type included in the second key operation instruction is a creation type.

[0084] The first key operation result includes a result indicating whether the creation was successful. As an example, the second key operation instruction is used to instruct the creation of a KEK-type key. If the first key operation result includes a result indicating successful creation, the first key operation result also includes the first key index and other related information. The related information may include a key version. As another example, the second key operation instruction is used to instruct the creation of a DEK-type key. If the first key operation result includes a result indicating successful creation, the first key operation result also includes an encryption result.

[0085] The second type: the first operation type included in the second key operation instruction is a query type.

[0086] The first key operation result includes the first key index and other related information.

[0087] The third type: the first operation type included in the second key operation instruction is an update type.

[0088] The first key operation result includes a result indicating whether the update is successful, an updated key index, and other related information.

[0089] Fourth type: the first operation type included in the second key operation instruction is a deletion type.

[0090] The first key operation result includes a result indicating whether the deletion is successful.

[0091] Step S507: The first cryptographic device feeds back the first key operation result to the management system.

[0092] Step S508: The management system obtains the first key operation result.

[0093] The management system can determine the processing result of the second key operation instruction based on the obtained first key operation result, thereby realizing the management of the first key and the first cryptographic device.

[0094] In a possible implementation, after obtaining the first key operation result, the management system feeds back the first key operation result to the first business system, and the first business system can use the obtained first key operation result to implement business processing.

[0095] The management system manages the cryptographic devices of the business system, enabling cross-device and cross-cluster management of cryptographic devices. Furthermore, using key indexes that uniquely correspond to keys, it enables global key awareness and management, meeting the needs of key usage and management in large-scale scenarios.

[0096] The management system can also establish connections with multiple business systems to manage cryptographic devices in other business systems. As an example, the business system includes a second business system. This second business system is a business system other than the first business system. The second business system can interact with the management system to perform operations on the second key.

[0097] In one possible implementation, the embodiment of the present application provides a schematic diagram of an interaction process between a second business system, a management system, and a second cryptographic device. The key processing method provided in the embodiment of the present application includes steps A1-A8:

[0098] Step A1: The second business system generates a third key operation instruction.

[0099] The second business system is one of the business systems connected to the management system. When processing cryptographic-related services, the second business system needs to operate on a key and generates a third key operation instruction. The third key operation instruction includes second key information and a second operation type. The second key information corresponds to the second key to be operated on. The second operation type is the type of operation to be performed on the second key corresponding to the second key information.

[0100] The specific content included in the third key operation instruction is similar to that of the second key operation instruction. For the content of the second key operation instruction, please refer to the above description and will not be repeated here.

[0101] Step A2: The second business system sends a third key operation instruction to the management system.

[0102] Step A3: The management system obtains the third key operation instruction sent by the second business system.

[0103] Step A4: The management system sends a fourth key operation instruction to the second cryptographic device based on the second key information.

[0104] The management system generates a fourth key operation instruction based on the acquired second key operation instruction. The fourth key operation instruction includes a second key index and a second operation type. The second key index is a unique index of the second key corresponding to the second key information. The second key index is determined by the management system. Using the unique second key index enables unified key management and global scheduling, no longer limited to the management of a single device. The fourth key operation instruction is used to instruct the execution of the second operation type using the second key corresponding to the second key index.

[0105] The management system determines a second cryptographic device to operate the second key based on the fourth key operation instruction. The second cryptographic device is one of the cryptographic devices in the second business system. This embodiment of the present application does not limit the method for determining the second cryptographic device. The method for determining the second cryptographic device by the management system is similar to the method for determining the first cryptographic device. For details about the method for determining the first cryptographic device, please refer to the above description and will not be repeated here.

[0106] Step A5: The second cryptographic device obtains the fourth key operation instruction sent by the management system.

[0107] Step A6: The second cryptographic device performs an operation of the second operation type on the second key corresponding to the second key index to generate a second key operation result.

[0108] The second cryptographic device performs an operation of the second operation type based on the second key corresponding to the second key index according to the fourth key operation instruction, and generates a second key operation result based on the result of the operation.

[0109] Step A7: The second cryptographic device feeds back the second key operation result to the management system.

[0110] Step A8: The management service system obtains the second key operation result.

[0111] The interaction process of the above steps A1-A8 is similar to the above steps S501-S508 respectively. Please refer to the detailed introduction of the above steps S501-S508.

[0112] In addition to the above steps, the management system can also manage the lifecycle of the keys stored in the managed cryptographic devices. The management system records key management information for the keys. Key management information may include one or more key-related information such as the key ID, key algorithm name, key version, key type, key content, etc.

[0113] Taking the first key index as an example, after creating the first key index, the management system records the first key index into the key management information of the key index.

[0114] After the first cryptographic device generates a first key operation result based on the second key operation instruction, it sends the first key operation result to the management system. The management system updates key management information, including the key index, based on the obtained first key operation result. In this way, the management system can manage keys based on the key management information, achieving unified key management.

[0115] After the key is created, it is also possible to synchronize or back up the key so that cryptographic devices other than the one that created the key can obtain and manage the key.

[0116] Key synchronization or backup can be achieved within the management system. Key synchronization involves the cryptographic device that creates a key sending it to other cryptographic devices, allowing them to retrieve it. Key backup involves the cryptographic device that needs the key obtaining it from the management device. Key synchronization or backup can address key migration requirements, such as application migration and the addition of new cryptographic devices. This decouples business applications from the local hardware that stores the keys, expanding the scope of applicable scenarios. Furthermore, key synchronization or backup improves key reliability and ensures key recoverability. It also reduces the need for other cryptographic devices to create the same key, simplifying key management.

[0117] Taking the first cryptographic device and the first key as an example, the key synchronization process is first described in detail. The embodiment of the present application does not limit the method of triggering the first cryptographic device to synchronize the key.

[0118] As an example, after the first cryptographic device completes creation of the first key based on a second key operation instruction whose first operation type is a creation type, synchronization of the first key to the third cryptographic device is triggered. As another example, after the first cryptographic device receives a key synchronization instruction sent by the management device, synchronization of the first key to the third cryptographic device is triggered.

[0119] The third cryptographic device, that is, the range of key synchronization can be preset.

[0120] As an example, a pre-configured synchronization rule. The synchronization rule includes a cryptographic device identifier of a third cryptographic device. In this way, when the first cryptographic device performs key synchronization based on the synchronization rule, relevant information about the first key is sent to the cryptographic device corresponding to the cryptographic device identifier included in the synchronization rule, that is, the third cryptographic device. As another example, the third cryptographic device is all the cryptographic devices in the cluster to which the first cryptographic device belongs except the first cryptographic device, or all the cryptographic devices included in the business system except the first cryptographic device. After the first cryptographic device completes key creation or obtains a key synchronization instruction, relevant information about the key is sent to the third cryptographic device.

[0121] As another example, the scope of key synchronization can be determined by a key synchronization instruction. The management device can generate a key synchronization instruction based on the need for key synchronization. The key synchronization instruction includes a first key index. The key synchronization instruction can also include a cryptographic device identifier of a third cryptographic device. Based on the key synchronization instruction, the first cryptographic device can synchronize the first key corresponding to the first key index to the cryptographic device corresponding to the cryptographic device identifier, i.e., the third cryptographic device. The following describes a key backup method using the first cryptographic device and the first key as an example.

[0122] In some scenarios, the fourth cryptographic device needs to obtain a key from the management system. For example, the fourth cryptographic device is one of the cryptographic devices in the first business system. When the backup conditions for the first key corresponding to the first key index are met, the fourth cryptographic device sends a key request instruction to the management system.

[0123] The backup condition is a condition that requires the fourth cryptographic device to obtain the first key corresponding to the first key index from the management system. As an example, the backup condition is that the fourth cryptographic device determines that the first key corresponding to the first key index is not stored locally. For example, when the business system uses the fourth cryptographic device to call the first key corresponding to the first key index, the fourth cryptographic device determines that the first key corresponding to the first key index is not stored locally, satisfying the backup condition for the first key corresponding to the first key index. As another example, the backup condition is that the fourth cryptographic device is the cryptographic device to which the first key corresponding to the first key index is to be backed up. For example, the fourth cryptographic device is a newly added cryptographic device to the business system. The first key corresponding to the first key index managed by the failed cryptographic device needs to be backed up to the fourth cryptographic device.

[0124] If the backup condition for the first key corresponding to the first key index is met, the fourth cryptographic device sends a key request instruction including the first key index to the management system. Based on the key request instruction, the management system obtains the first key corresponding to the first key index and sends the first key corresponding to the first key index to the fourth cryptographic device. The fourth cryptographic device obtains and stores the first key corresponding to the first key index, completing the backup of the first key corresponding to the first key index.

[0125] It should be noted that the key synchronization and key backup are performed in units of keys, which can achieve more accurate key synchronization and key backup and avoid resource waste.

[0126] Both key synchronization and key backup involve the transmission of keys between cryptographic devices. In some implementations, the cryptographic device is a physical functional device that is virtualized. The cryptographic device may include multiple virtual functional devices. Keys also need to be transmitted between different virtual functional devices belonging to the same cryptographic device.

[0127] The cryptographic device establishes a corresponding attribution index for the key. The attribution index indicates the association between the key and the virtual function device. This allows the attribution index to be used to identify the virtual function device that can use the key. This eliminates the need to store the same key in different virtual function devices, conserving key storage space, improving key management efficiency, and reducing space costs.

[0128] In one possible implementation, the attribution index is a binary string. The number of characters in the attribution index is consistent with the number of virtual function devices included in the cryptographic device. Each character of the attribution index is used to indicate whether the key belongs to the virtual function device corresponding to the character. For example, the cryptographic device includes 8 virtual function devices. The attribution index of the key is: 10010010. Each character of the attribution index is used to indicate whether the key belongs to the virtual function device corresponding to the character. The character value of "1" is used to indicate that the key belongs to the virtual function device corresponding to the character. The character value of "0" is used to indicate that the key does not belong to the virtual function device corresponding to the character. As shown in Table 1, taking the attribution index of the key as 10010010 as an example, each character of the attribution index from the first to the last digit corresponds to the virtual function devices from virtual function device 0 to virtual function device 7.

[0129] Table 1

[0130] The key can be used by virtual function device 0, virtual function device 3, and virtual function device 6. The key cannot be used by virtual function device 1, virtual function device 2, virtual function device 4, virtual function device 5, and virtual function device 7.

[0131] In addition, the attribution index can be adjusted based on the distribution of the key in the virtual function devices included in the cryptographic device. The embodiment of the present application does not limit the manner of adjusting the distribution of the key in the virtual function devices included in the cryptographic device.

[0132] As an example, the business system can use key operation instructions to adjust the distribution of keys in the virtual function devices included in the cryptographic device. Taking the first business system as an example, refer to Figure 6, which is a flowchart of a key processing provided by an embodiment of the present application. The first business system generates a first key operation instruction based on the key processing requirements of the processing business. The first business system sends the first key operation instruction to the management system. The management system generates a second key operation instruction based on the first key operation instruction. The management system sends the second key operation instruction to the first cryptographic device. The first cryptographic device processes the first key based on the second key operation instruction, and updates the attribution index of the first key according to the distribution of the first key in the virtual function devices.

[0133] As another example, the management system can generate a key adjustment instruction based on management needs. The key adjustment instruction is used to instruct adjustment of key distribution across virtual function devices. For example, the key adjustment instruction includes a first key index, adjustment operation information, and an identifier of the virtual function device. The adjustment operation information is synchronization. The management system sends the key adjustment instruction to the first cryptographic device. Based on the key adjustment instruction, the first cryptographic device can copy the key corresponding to the first key index to the virtual function device indicated by the identifier of the virtual function device.

[0134] The first cryptographic device updates the first key's belonging index based on the adjusted key distribution across the virtual function devices included in the cryptographic device. For example, if the key's belonging index is 10010010, for example, if the key is synchronized from virtual function device 0 to virtual function device 1, the key's belonging index is correspondingly adjusted to 11010010. For another example, if the key is deleted from virtual function device 0, the key's belonging index is correspondingly adjusted to 00010010.

[0135] The attribution index can be used to dynamically map the association between the key and the virtual function device, and avoid storing the same key in different virtual function devices, thereby reducing the space occupied by the key and saving costs.

[0136] Based on the key processing method provided in the embodiments of this application, as shown in Figure 7 , this embodiment of the application also provides a schematic structural diagram of a key processing device 700. This key processing device 700 can implement the functions of a management system. The key processing device 700 is applied to the management system. The management system is connected to the business system. The management system manages cryptographic devices based on key indexes.

[0137] Figure 7 is a schematic diagram of the structure of a key processing device provided in an embodiment of the present application. Key processing device 700 includes an acquisition module 701 and a sending module 702. The functions of key processing device 700 are described in detail in the relevant description of the embodiment shown in Figure 5. Acquisition module 701 is used to implement steps S503 and S508 of the embodiment shown in Figure 5; sending module 702 is used to implement step S504 of the embodiment shown in Figure 5.

[0138] Specifically, the acquisition module 701 is configured to acquire a first key operation instruction sent by a first business system in a business system, where the first key operation instruction includes first key information and a first operation type;

[0139] a sending module 702 configured to send a second key operation instruction to the first cryptographic device based on the first key information, where the second key operation instruction includes a first key index and a first operation type, where the first key index is an index of the first key corresponding to the first key information, and the second key operation instruction is used to instruct the first cryptographic device to perform an operation of the first operation type on the first key;

[0140] The acquisition module 701 is further configured to acquire a first key operation result fed back by the first cryptographic device.

[0141] In some possible implementations, the acquisition module 701 is further configured to acquire a third key operation instruction sent by a second business system in the business system, where the third key operation instruction includes the second key information and the second operation type;

[0142] The sending module 702 is further configured to send a fourth key operation instruction to the second cryptographic device based on the second key information, where the fourth key operation instruction includes a second key index and a second operation type, where the second key index is an index of the second key corresponding to the second key information, and the fourth key operation instruction is used to instruct the second cryptographic device to perform an operation of the second operation type on the second key;

[0143] The acquisition module 701 is further configured to acquire a second key operation result fed back by a second cryptographic device.

[0144] In some possible implementations, the apparatus further includes:

[0145] The updating module 703 is configured to update the key management information of the key index according to the first key operation result. The key management information includes one or more of the following: key ID, key algorithm name, key type, and key version.

[0146] In some possible implementations, the first operation type includes one or more of the following:

[0147] Create type, query type, update type, delete type.

[0148] In some possible implementations, the first operation type is a create type, and the apparatus further includes:

[0149] The recording module 704 is configured to record the generated first key index into the key management information of the key index.

[0150] In some possible implementations, the sending module 702 is further configured to send a key synchronization instruction to the first cryptographic device, where the key synchronization instruction includes a first key index, and the key synchronization instruction is configured to synchronize the first key corresponding to the first key index to the third cryptographic device.

[0151] In some possible implementations, the obtaining module 701 is further configured to obtain a key backup instruction of a fourth cryptographic device, where the key backup instruction includes the first key index;

[0152] The acquisition module 701 is further configured to acquire a first key corresponding to a first key index from a first cryptographic device;

[0153] The sending module 702 is further configured to send the first key to the fourth cryptographic device.

[0154] In some possible implementations, the cryptographic device is a physical functional device, the cryptographic device includes multiple virtual functional devices, and the multiple keys corresponding to the key index are associated with the multiple virtual functional devices through the belonging index.

[0155] In some possible implementations, the sending module 702 is further used to send a key adjustment instruction to the first cryptographic device, where the key adjustment instruction is used to instruct the first cryptographic device to adjust the distribution of the first key in the virtual function device of the first cryptographic device and update the attribution index associated with the first key.

[0156] In actual applications, the acquisition module 701, sending module 702, update module 703, and recording module 704 can be implemented via software or hardware. For example, the implementation of acquisition module 701 will be described below using acquisition module 701 as an example. Similarly, the implementation of sending module 702, update module 703, and recording module 704 can refer to the implementation of acquisition module 701.

[0157] The acquisition module 701, as an example of a software functional unit, may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, the acquisition module 701 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0158] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0159] As an example of a hardware functional unit, acquisition module 701 may include at least one computing device, such as a server. Alternatively, acquisition module 701 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0160] The multiple computing devices included in acquisition module 701 can be distributed in the same region or in different regions. The multiple computing devices included in acquisition module 701 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in acquisition module 701 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, GALs, and other computing devices.

[0161] It should be noted that, in the embodiment of the present application, the division and functional description of each module in the acquisition module 701, the sending module 702, the update module 703 and the recording module 704 are only used as an example.

[0162] In other embodiments, the acquisition module 701 can be used to execute any step in the key processing method, the sending module 702 can be used to execute any step in the key processing method, the update module 703 can be used to execute any step in the key processing method, and the recording module 704 can be used to execute any step in the key processing method. The steps that the acquisition module 701, the sending module 702, the update module 703, and the recording module 704 are responsible for implementing can be specified as needed. The full functionality of the key processing device is achieved by having the acquisition module 701, the sending module 702, the update module 703, and the recording module 704 respectively implement different steps in the key processing method.

[0163] In the embodiment shown in FIG. 7 , the acquisition module 701, the sending module 702, the update module 703, and the recording module 704 can be software configured on a computing device or a computing device cluster. By running this software on the computing device or computing device cluster, the computing device or computing device cluster can implement the functions of the aforementioned apparatus. The following describes in detail the apparatuses involved in the code review process from the perspective of hardware implementation.

[0164] This application also provides a computing device 800. As shown in Figure 8, computing device 800 includes a bus 802, a processor 804, a memory 806, and a communication interface 808. Processor 804, memory 806, and communication interface 808 communicate with each other via bus 802. Computing device 800 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 800.

[0165] Bus 802 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG8 illustrates a single bus line, but this does not imply a single bus or type of bus. Bus 802 may include a path for transmitting information between various components of computing device 800 (e.g., memory 806, processor 804, and communication interface 808).

[0166] The processor 804 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0167] The memory 806 may include volatile memory, such as random access memory (RAM). The processor 804 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0168] Memory 806 stores executable program code, and processor 804 executes the executable program code to implement the functions of the aforementioned acquisition module 701, sending module 702, update module 703, and recording module 704, thereby implementing the key processing method. In other words, memory 806 stores instructions for executing the key processing method.

[0169] The communication interface 808 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 800 and other devices or a communication network.

[0170] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0171] As shown in Figure 9, the computing device cluster includes at least one computing device 800. The memory 806 in one or more computing devices 800 in the computing device cluster may store the same instructions for executing the key processing method.

[0172] It should be noted that the memory 806 in different computing devices 800 in the computing device cluster can store different instructions, each for executing a portion of the functions of the key processing apparatus. In other words, the instructions stored in the memory 806 in different computing devices 800 can implement the functions of one or more of the acquisition module 701, the sending module 702, the update module 703, and the recording module 704.

[0173] In some possible implementations, one or more computing devices in a computing device cluster may be connected via a network. The network may be a wide area network (WAN) or a local area network (LAN), among others. FIG. 10 illustrates a possible implementation. As shown in FIG. 10 , two computing devices 800A and 800B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 806 in the computing device 800A stores instructions for executing the functions of the acquisition module 701. Simultaneously, the memory 806 in the computing device 800B stores instructions for executing the functions of the sending module 702, the updating module 703, and the recording module 704.

[0174] The connection method between the computing device clusters shown in Figure 10 can be that considering that the acquisition module 701 in the key processing method provided in this application needs to interact with the user a lot, it is considered to entrust the functions implemented by the sending module 702, the update module 703 and the recording module 704 to the computing device 800B for execution.

[0175] It should be understood that the functionality of the computing device 800A shown in FIG10 may also be implemented by multiple computing devices 800. Similarly, the functionality of the computing device 800B may also be implemented by multiple computing devices 800.

[0176] The present application also provides a computer program product comprising instructions. The computer program product may be software or a program product comprising instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the key processing method.

[0177] The present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the key processing method.

[0178] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A key processing method, the method is applied to a management system, the management system is connected to a business system, the management system manages a cryptographic device according to a key index, the method comprising: Acquire a first key operation instruction sent by a first business system in the business system, where the first key operation instruction includes first key information and a first operation type; Sending a second key operation instruction to a first cryptographic device according to the first key information, where the second key operation instruction includes a first key index and the first operation type, where the first key index is an index of the first key corresponding to the first key information, and the second key operation instruction is used to instruct the first cryptographic device to perform an operation of the first operation type on the first key; Obtain a first key operation result fed back by the first cryptographic device.

2. The method according to claim 1, characterized in that The method comprises: Acquire a third key operation instruction sent by a second business system in the business system, where the third key operation instruction includes second key information and a second operation type; sending, according to the second key information, a fourth key operation instruction to the second cryptographic device, the fourth key operation instruction including a second key index and the second operation type, the second key index being an index of the second key corresponding to the second key information, and the fourth key operation instruction being used to instruct the second cryptographic device to perform an operation of the second operation type on the second key; Obtain a second key operation result fed back by the second cryptographic device.

3. The method according to claim 1 or 2, characterized in that: After obtaining the first key operation result fed back by the first cryptographic device, the method further includes: According to the first key operation result, the key management information of the key index is updated, and the key management information includes one or more of the following: key ID, key algorithm name, key type, and key version.

4. The method according to any one of claims 1 to 3, characterized in that: The first operation type includes one or more of the following: Create type, query type, update type, delete type.

5. The method according to any one of claims 1 to 4, characterized in that: The first operation type is the creation type, and after obtaining the first key operation result fed back by the first cryptographic device, the method further includes: The generated first key index is recorded in the key management information of the key index.

6. The method according to claim 1, characterized in that The method comprises: A key synchronization instruction is sent to the first cryptographic device, where the key synchronization instruction includes the first key index, and the key synchronization instruction is used to synchronize the first key corresponding to the first key index to a third cryptographic device.

7. The method according to claim 1, characterized in that The method comprises: Obtaining a key backup instruction of a fourth cryptographic device, wherein the key backup instruction includes the first key index; Obtaining a first key corresponding to the first key index from the first cryptographic device; The first key is sent to the fourth cryptographic device.

8. The method according to any one of claims 1 to 7, characterized in that: The cryptographic device is a physical functional device, and the cryptographic device includes a plurality of virtual functional devices. The plurality of keys corresponding to the key index are associated with the plurality of virtual functional devices through a belonging index.

9. The method according to any one of claims 1 to 8, characterized in that: The method comprises: A key adjustment instruction is sent to the first cryptographic device, where the key adjustment instruction is used to instruct the first cryptographic device to adjust the distribution of the first key in the virtual function devices of the first cryptographic device and update the belonging index associated with the first key.

10. A key processing device, the device is applied to a management system, the management system is connected to a business system, the management system manages a cryptographic device according to a key index, the device comprising: An acquisition module, configured to acquire a first key operation instruction sent by a first business system in the business system, wherein the first key operation instruction includes first key information and a first operation type; a sending module, configured to send a second key operation instruction to a first cryptographic device according to the first key information, where the second key operation instruction includes a first key index and the first operation type, where the first key index is an index of the first key corresponding to the first key information, and the second key operation instruction is used to instruct the first cryptographic device to perform an operation of the first operation type on the first key; The acquisition module is further used to obtain the first key operation result fed back by the first cryptographic device.

11. The device according to claim 10, characterized in that The acquisition module is further used to acquire a third key operation instruction sent by the second business system in the business system, wherein the third key operation instruction includes second key information and a second operation type; The sending module is further used to send a fourth key operation instruction to the second cryptographic device according to the second key information, the fourth key operation instruction including a second key index and the second operation type, the second key index being an index of the second key corresponding to the second key information, and the fourth key operation instruction being used to instruct the second cryptographic device to perform an operation of the second operation type on the second key; The acquisition module is further used to obtain the second key operation result fed back by the second cryptographic device.

12. The device according to claim 10 or 11, characterized in that The device also includes: An update module is used to update the key management information of the key index according to the first key operation result, and the key management information includes one or more of the following: key ID, key algorithm name, key type, and key version.

13. The device according to any one of claims 10 to 12, characterized in that The first operation type includes one or more of the following: Create type, query type, update type, delete type.

14. The device according to any one of claims 10 to 13, characterized in that The first operation type is the creation type, and the device further includes: A recording module is used to record the generated first key index into the key management information of the key index.

15. The device according to claim 10, characterized in that The sending module is further used to send a key synchronization instruction to the first cryptographic device, where the key synchronization instruction includes the first key index, and the key synchronization instruction is used to synchronize the first key corresponding to the first key index to a third cryptographic device.

16. The device according to claim 10, characterized in that The acquisition module is further used to acquire a key backup instruction of a fourth cryptographic device, wherein the key backup instruction includes the first key index; The acquisition module is further used to acquire the first key corresponding to the first key index from the first cryptographic device; The sending module is further used to send the first key to the fourth cryptographic device.

17. The device according to any one of claims 10 to 16, characterized in that The cryptographic device is a physical functional device, and the cryptographic device includes a plurality of virtual functional devices. The plurality of keys corresponding to the key index are associated with the plurality of virtual functional devices through a belonging index.

18. The device according to any one of claims 10 to 17, characterized in that The sending module is further used to send a key adjustment instruction to the first cryptographic device, where the key adjustment instruction is used to instruct the first cryptographic device to adjust the distribution of the first key in the virtual function devices of the first cryptographic device and update the belonging index associated with the first key.

19. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 9.

20. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 9.

21. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 9.

Images