CN118606925A - Host, password service management method, storage medium and program - Google Patents

Abstract

The embodiment of the present application provides a host, a cryptographic service management method, a storage medium and a program, wherein the host includes multiple virtual machines and a cryptographic module; the multiple virtual machines include at least one virtual cryptographic machine and at least one virtual business machine; wherein the virtual cryptographic machine runs the cryptographic service, and the virtual business machine runs the cryptographic application system; the virtual cryptographic machine is a secure virtual machine using a security protection mechanism, so that the cryptographic service runs in a trusted execution environment; the virtual business machine is a common virtual machine, so that the cryptographic application system runs in a general computing environment; the cryptographic module includes a number of virtual cryptographic modules corresponding to the at least one virtual cryptographic machine, and one virtual cryptographic module corresponds to one virtual cryptographic machine; the virtual cryptographic module provides key management and cryptographic operation support for the cryptographic service run by the corresponding virtual cryptographic machine. The embodiment of the present application can improve the performance of the cryptographic service and is conducive to the promotion and popularization of the cryptographic service.

Description

Host, password service management method, storage medium and program

Technical Field

The embodiments of the present application relate to the field of cryptographic technology, and specifically to a host, a cryptographic service management method, a storage medium, and a program.

Background Art

To ensure data security, using passwords to protect data has become a common requirement in many industries (such as finance, communications, etc.). As a service that provides data protection functions, cryptographic services can perform cryptographic operations on data to ensure the security and integrity of data during storage and use.

Given the importance of cryptographic services in ensuring data security, how to improve the performance of cryptographic services has become a technical problem that technical personnel in this field urgently need to solve.

Summary of the invention

In view of this, embodiments of the present application provide a host, a cryptographic service management method, a storage medium, and a program to improve the performance of cryptographic services.

To achieve the above objectives, the embodiments of the present application provide the following technical solutions.

In a first aspect, an embodiment of the present application provides a host, including: a plurality of virtual machines and a cryptographic module;

The multiple virtual machines include at least one virtual cryptographic machine and at least one virtual business machine; wherein the virtual cryptographic machine runs a cryptographic service, the virtual business machine runs a cryptographic application system, and the cryptographic application system uses the cryptographic service to perform cryptographic operations on the data to be operated by the cryptographic application system; the virtual cryptographic machine is a secure virtual machine using a security protection mechanism so that the cryptographic service runs in a trusted execution environment; the virtual business machine is a common virtual machine so that the cryptographic application system runs in a general computing environment;

The cryptographic module includes virtual cryptographic modules whose number corresponds to the at least one virtual cryptographic machine, and one virtual cryptographic module corresponds to one virtual cryptographic machine; the virtual cryptographic module provides key management and cryptographic operation support for the cryptographic service run by the corresponding virtual cryptographic machine.

In a second aspect, an embodiment of the present application provides a cryptographic service management method, the method is based on the host described in the first aspect above, the method is executed by a host management program, and the method includes:

Sending a virtual cryptographic module creation command to the cryptographic module to instruct the cryptographic module to create a virtual cryptographic module;

Starting the virtual cryptographic machine and after the virtual cryptographic machine is started, assigning the virtual cryptographic module created by the cryptographic module to the virtual cryptographic machine to establish a corresponding relationship between the virtual cryptographic machine and the virtual cryptographic module;

And, sending a virtual machine shutdown instruction to the virtual cryptographic machine to instruct the virtual cryptographic machine to shut down, and after the virtual cryptographic machine is shut down, sending a virtual cryptographic module destruction command to the cryptographic module to instruct the cryptographic module to destroy the virtual cryptographic module corresponding to the shut down virtual cryptographic machine.

In a third aspect, an embodiment of the present application provides a cryptographic service management method, the method is based on the host described in the first aspect above, the method is executed by a virtual cryptographic machine, and the method includes:

After the virtual cryptographic machine is started and the corresponding virtual cryptographic module is allocated, key management information is sent to the corresponding virtual cryptographic module so that the virtual cryptographic module stores the key of the cryptographic service;

And, obtaining a virtual machine shutdown instruction sent by a host management program, and sending a key export request to a virtual cryptographic module to request export of a key of a cryptographic service.

In a fourth aspect, an embodiment of the present application provides a cryptographic service management method, the method is based on the host described in the first aspect above, the method is executed by a virtual cryptographic module, and the method includes:

After the virtual cryptographic module is created and the corresponding virtual cryptographic machine is allocated, obtaining key management information sent by the corresponding virtual cryptographic machine, responding to the key management information, and saving the key of the cryptographic service;

And, obtaining a key export request sent by the corresponding virtual cryptographic machine, responding to the key export request, and exporting the key of the cryptographic service.

In a fifth aspect, an embodiment of the present application provides a storage medium, which stores computer instructions, and when the computer instructions are executed, the cryptographic service management method as described in the second aspect above is implemented, or the cryptographic service management method as described in the third aspect above is implemented, or the cryptographic service management method as described in the fourth aspect above is implemented.

In a sixth aspect, an embodiment of the present application provides a computer program product, which includes computer instructions, and when the computer instructions are executed, the cryptographic service management method as described in the second aspect above is implemented, or the cryptographic service management method as described in the third aspect above is implemented, or the cryptographic service management method as described in the fourth aspect above is implemented.

The embodiment of the present application can realize multiple virtual machines in the same host through virtualization technology; the secure virtual machine using the security protection mechanism among the multiple virtual machines can be used as a virtual cryptographic machine to realize at least one virtual cryptographic machine in the host, so that the cryptographic service of the virtual cryptographic machine can run in a trusted execution environment; the ordinary virtual machine without the security protection mechanism among the multiple virtual machines can be used as a virtual business machine to realize at least one virtual business machine in the host, so that the cryptographic application system of the virtual business machine can run in a general computing environment. The above settings can meet the computing environment requirements of the cryptographic service and the cryptographic application system, and the cryptographic application system and the cryptographic service can realize communication interaction through the virtual machine communication mechanism in the host, thereby avoiding the network bandwidth occupation caused by the cryptographic application system and the cryptographic service using network communication, improving the timeliness of the response of the cryptographic service to the cryptographic application system, and improving the performance of the cryptographic service. In other words, the cryptographic application system can access the cryptographic service in the same host without network communication, which can improve the performance of the cryptographic service.

At the same time, a cryptographic module can be implemented in the host, and the cryptographic module can include virtual cryptographic modules corresponding to the number of the at least one virtual cryptographic machine, and one virtual cryptographic module corresponds to one virtual cryptographic machine; thus, the virtual cryptographic module can provide key management and cryptographic operation support for the cryptographic service run by the corresponding virtual cryptographic machine. In other words, the virtual cryptographic machine implemented by the secure virtual machine and the corresponding virtual cryptographic module can jointly provide secure and reliable cryptographic services to ensure the security and reliability of the cryptographic services.

Therefore, the solution provided in the embodiment of the present application can improve the timeliness of the response of the cryptographic service to the cryptographic application system, improve the performance of the cryptographic service, and at the same time ensure the security and reliability of the cryptographic service; and, the cryptographic service and the cryptographic application system are in the same host, which can avoid setting up a dedicated physical host for the cryptographic service, can reduce the cost of the cryptographic service, and is conducive to the promotion and popularization of the cryptographic service.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

Figure 1 is an example diagram of the relationship between cryptographic services and cryptographic applications.

Figure 2 is a diagram showing an example of the distribution of cryptographic services and cryptographic applications.

FIG. 3 is an example diagram of a host provided in an embodiment of the present application.

FIG4 is a flowchart of a cryptographic service management method provided in an embodiment of the present application.

FIG5 is a flow chart of the operation of the cryptographic service provided in an embodiment of the present application.

FIG6 is another flow chart of the cryptographic service management method provided in an embodiment of the present application.

DETAILED DESCRIPTION

The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

As a service that provides data protection functions, the cryptographic service can be called by the cryptographic application system to perform cryptographic operations on the data of the cryptographic application system. For ease of understanding, FIG1 exemplarily shows an example diagram of the relationship between the cryptographic service and the cryptographic application. As shown in FIG1 , the cryptographic application system 110 is a system with data security requirements. Taking the software system as an example, the cryptographic application system is such as a cryptographic application program. The cryptographic service 120 is a service that provides data protection functions. The service can be in the form of a software service or a software service combined with a hardware service. The service form of the cryptographic service is not limited in the embodiment of the present application.

For example, the data of the cryptographic application system can be used as the data to be operated, and the data to be operated needs to rely on the cryptographic service to perform cryptographic operations, so as to ensure the data security requirements such as security and integrity of the data of the cryptographic application system during storage and use. For example, in combination with Figure 1, the cryptographic application system can transmit the data to be operated to the cryptographic service; thus, based on the data security requirements of the data to be operated, the cryptographic service can perform cryptographic operations for the data to be operated, and feed back the cryptographic operation results to the cryptographic application system.

It should be noted that based on different data security requirements, cryptographic services need to provide cryptographic operations that match the data security requirements. For example, cryptographic services can provide cryptographic operations such as encryption, decryption, generation and verification of digital signatures, and generation of timestamps. Therefore, based on the different types of cryptographic operations of cryptographic services, cryptographic services can have different types. Taking different types of cryptographic operations such as encryption, decryption, generation and verification of digital signatures, and generation of timestamps as examples, cryptographic services can include but are not limited to any of the following:

Encryption and decryption services; the encryption service encrypts data to ensure the confidentiality of the data during storage or transmission, and the decryption service restores the encrypted data to plain text;

Digital signature and verification services; the digital signature service can generate a digital signature of data to prove the integrity of the data and the identity of the data sender; the verification service can verify the digital signature of data to verify whether the data has been tampered with during transmission and whether the source of the data (such as the identity of the data sender) is reliable;

Timestamp service is used to provide a time stamp for data to prove the time point when the data exists.

Of course, the type of cryptographic service may depend on the specific data security requirements, and the above examples are only for illustration.

As an example, the data to be calculated by the cryptographic application system (such as a cryptographic application program) may be the business data of the cryptographic application system, and the business data may use one or more types of cryptographic services (such as business data requiring both encryption services and digital signature services, etc.) to meet the data security requirements of the business data. The types and quantity of cryptographic services used by the data to be calculated by the cryptographic application system (such as business data) can be configured according to actual conditions, and the embodiments of the present application are not limited.

Taking data encryption and decryption in the communications industry as an example, the cryptographic application system can be a communications application (such as a communications client program, etc.) that requires communication data encryption, and the cryptographic service can be an encryption service; thus, the communications application can use the encryption service to encrypt the communication data. For example, the encryption service can perform encryption operations on the communication data based on the key to achieve encrypted communication of the communication data.

Taking digital signatures and verification in the financial industry as an example, the cryptographic application system can be a financial application that needs to verify the authenticity of financial data, and the cryptographic service can be a digital signature service; thus, the financial application can use the digital signature service to sign the financial data. For example, the digital signature service can use a private key to generate a digital signature for the financial data, so that the verifier of the financial data can verify the authenticity of the financial data through the digital signature.

It can be seen that the cryptographic application system is the consumer (i.e. user) of the cryptographic service, and the cryptographic service involves sensitive information such as keys used for cryptographic operations, so the security of the cryptographic service itself needs to be guaranteed. Based on this, the cryptographic service can be run in a secure computing environment, thereby being separated from the general computing environment of the cryptographic application system to ensure that the cryptographic service is not affected by various potential security threats in the general computing environment.

For example, FIG2 shows a distribution diagram of a cryptographic service and cryptographic application. As shown in FIG2, the cryptographic application system runs in a business host 210. The business host can be regarded as a physical host running the cryptographic application system (such as a cryptographic application program), such as a physical server, a terminal, and other computers, and the business host is in a general computing environment. The general computing environment can be regarded as a computing system environment with a wide range of user access rights and standard network connection functions.

To separate the cryptographic service from the general computing environment of the cryptographic application system, the cryptographic service can be run in a dedicated cryptographic host 220, which can be regarded as a physical host running the cryptographic service, such as a physical server or other computer, and the cryptographic host is in a secure computing environment. A secure computing environment is a computing system environment specially designed and managed for processing sensitive data or performing confidential tasks, and has strict access control, security measures, and possible physical or logical isolation mechanisms to minimize security threats.

As shown in FIG2 , the cryptographic host is physically isolated from the general computing environment. For example, the cryptographic host and the business host are not in the same physical device or the same physical network, so attacks against the general computing environment will not directly affect the cryptographic host.

Furthermore, to achieve interaction between the cryptographic host and the service host, the cryptographic host and the service host can be securely accessed through a network so that the cryptographic application system can use the cryptographic service. For example, through a secure communication protocol and a network bridging device, secure access can be achieved between the cryptographic host and the service host through a network. The network referred to here can be, for example, a communication network such as the Internet or a VPN (Virtual Private Network) network.

As shown in FIG. 2 , the cryptographic host is divided into a hardware part and a software part. The hardware part mainly includes a CPU (Central Processing Unit), a network card, and a cryptographic module; the software part mainly includes a cryptographic service and an operating system.

The cryptographic module of the hardware part is mainly used to cooperate with the cryptographic service of the software part to realize cryptographic operations; as the core component of the cryptographic host to provide cryptographic services, the cryptographic module needs to have a high security level. For example, the cryptographic module needs to pass security qualification certification to ensure the security and reliability of the cryptographic module itself.

The CPU of the hardware part is mainly used to run and interpret program instructions. For example, the cryptographic service and operating system of the software part can run based on the CPU. The network card of the hardware part is mainly used for network communication. The network card can be provided with a network interface, so that the cryptographic host can communicate with the network through the network interface of the network card. Furthermore, the network card can be configured with a firewall and a traffic monitoring system to monitor all inbound and outbound network traffic, and the verified and authorized network communication can be transmitted to the cryptographic host through the network interface.

The cryptographic services in the software part are mainly cryptographic service programs, involving software suites that implement various cryptographic services (one or more types of cryptographic services). Based on the secure computing environment of the cryptographic host, the software installation and configuration of the cryptographic host need to have strict permission control, such as only authorized software can be installed and configured; in addition, the software installed on the cryptographic host needs to be strictly verified, such as the secure operating system and application of the cryptographic host need to be verified before they can be installed, to ensure that the software in the cryptographic host has no security vulnerabilities or malicious code.

The example method in Figure 2 physically isolates the general computing environment where the cryptographic host and the business host are located, so that the cryptographic host and the business host are not in the same physical device and the same physical network, which can reduce the impact of various potential security threats on the cryptographic service running on the cryptographic host in the general computing environment, thereby ensuring the security of the cryptographic service itself. However, the performance of the cryptographic service in this way needs to be improved, as shown in the following aspects:

The occupation of network bandwidth leads to the degradation of the performance of cryptographic services. Specifically, the cryptographic application system needs to access the cryptographic service through the network, which affects the response time of the cryptographic service and leads to the degradation of the performance of the cryptographic service. Furthermore, network delay and network instability may lead to communication delay between the cryptographic application system and the cryptographic service, resulting in the degradation of the performance of the cryptographic service. In addition, when the demand for the cryptographic application system to access the cryptographic service is high, it may occupy a large amount of network bandwidth and affect the traffic of other services in the network.

A dedicated cryptographic host needs to be set up, resulting in a high cost for providing cryptographic services; specifically, a cryptographic host needs to be specially deployed to run cryptographic services, which results in high equipment procurement and maintenance costs, affecting the promotion and popularization of cryptographic services.

Based on this, the embodiments of the present application provide an improved technical solution to enhance the performance of cryptographic services.

As an optional implementation, Figure 3 exemplarily shows an example diagram of a host provided in an embodiment of the present application. As shown in Figure 3, the host can virtualize multiple virtual machines through virtualization technology. For example, the processor (such as CPU) in the host can run virtualization software to virtualize multiple virtual machines; the multiple virtual machines may include at least one virtual cryptographic machine (Virtual Cryptographic Machine) 310 and at least one virtual business machine 320.

Among them, the virtual cryptographic machine 310 is a virtual machine running a cryptographic service in the host, and realizes functions similar to the cryptographic host; the number of virtual cryptographic machines can be at least one (one or more), and the number of virtual cryptographic machines can be configured according to actual conditions (for example, the number of virtual cryptographic machines can be dynamically created as needed), and the embodiments of the present application are not limited. The virtual business machine 320 is a virtual machine running a cryptographic application system in the host, and realizes functions similar to the business host; the number of virtual business machines can be at least one (one or more), and the number of virtual business machines can be configured according to actual conditions, and the embodiments of the present application are not limited.

It should be noted that, since the virtual machine is implemented by simulating a computer system, the virtual machine can install and run an operating system and program software. Accordingly, the virtual cryptographic machine can have a corresponding operating system and program software, and the program software of the virtual cryptographic machine can include a cryptographic service program, such as a software suite that implements various types of cryptographic services (one or more types of cryptographic services). Accordingly, the virtual business machine can have a corresponding operating system and program software, and the program software of the virtual business machine can include a cryptographic application program; for example, the cryptographic application program can be a business processing program, such as in the business processing process of the virtual business machine, the business data has data security requirements, so the cryptographic application program of the virtual business machine needs to call the cryptographic service of the virtual cryptographic machine to perform cryptographic operations.

In an optional implementation, since the virtual cryptographic machine and the virtual business machine are located on the same host, in order to ensure the security of the cryptographic service running on the virtual cryptographic machine, the virtual cryptographic machine can be a secure virtual machine that uses a security protection mechanism, so that the cryptographic service can run in a trusted execution environment (Trusted Execution Environment, TEE), which can be regarded as a secure computing environment. In other words, the secure virtual machine can be regarded as a trusted execution environment, so that the cryptographic service is run in the secure virtual machine (in this case, the secure virtual machine running the cryptographic service can be regarded as a virtual cryptographic machine), which can ensure the security and trustworthiness of the cryptographic service.

As an optional implementation, the embodiment of the present application may adopt secure virtualization technology to implement a secure virtual machine in the host, so as to obtain one or more virtual cryptographic machines by running cryptographic services on one or more secure virtual machines. It should be noted that secure virtualization technology is a virtualization technology that can securely protect the memory space of a virtual machine. For example, secure virtualization technology assigns virtual machine keys to some or all virtual machines through a dedicated security device (such as a security processor), and different virtual machines have different virtual machine keys assigned; further, for virtual machines to which virtual machine keys are assigned, the memory space of the virtual machine can be encrypted and protected by the virtual machine key (for example, data written to the allocated memory space by the virtual machine can be encrypted and protected by the virtual machine key), and the memory space of different virtual machines can be encrypted by different virtual machine keys, and even the virtual machine manager cannot access the virtual machine key.

Therefore, under the secure virtualization technology, the secure virtual machine can be an encrypted virtual machine (an example of a secure virtual machine) whose memory space is encrypted using a virtual machine key, and accordingly, the memory space corresponding to the encrypted virtual machine can be regarded as an encrypted memory space; furthermore, by running cryptographic services on one or more encrypted virtual machines (an example of a secure virtual machine), one or more virtual cryptographic machines can be obtained.

It should be noted that the encrypted virtual machine can provide an isolated execution environment through memory space encryption and virtual machine key isolation, so it is considered a trusted execution environment. In other words, the secure virtualization technology creates a secure execution environment isolated from the external environment for the encrypted virtual machine by providing an independent virtual machine key for the encrypted virtual machine and encrypting the allocated memory space, which is considered a trusted execution environment. Therefore, the virtual cryptographic machine is implemented through the encrypted virtual machine (an example of a secure virtual machine), which can enable the cryptographic service to run in a trusted execution environment.

In contrast, a virtual business machine may be an ordinary virtual machine that does not use a security protection mechanism. For example, taking secure virtualization technology as an example, an ordinary virtual machine may be a virtual machine that does not have a virtual machine key, that is, the memory space of the ordinary virtual machine is not encrypted with the virtual machine key, and the memory space of the ordinary virtual machine stores data in plain text. Thus, by running a cryptographic application system (such as a cryptographic application program) on one or more ordinary virtual machines, one or more virtual business machines can be obtained.

Since the virtual business machine is implemented by an ordinary virtual machine without a security protection mechanism, the virtual business machine can be regarded as a general computing environment. That is to say, in the embodiment of the present application, the host internally distinguishes between the secure computing environment of the virtual cryptographic machine (such as a trusted execution environment) and the general computing environment of the virtual business machine, so as to adapt to the security and trust requirements of the cryptographic service (the cryptographic service runs on the virtual cryptographic machine) and the general computing requirements of the cryptographic application system (the cryptographic application system runs on the virtual business machine). In a further optional implementation, the host provided by the embodiment of the present application (running the virtual cryptographic machine and the virtual business machine) can be in a general computing environment, so that the host in the general computing environment can realize a secure virtual machine in a secure computing environment (such as a trusted execution environment) through the security protection mechanism of the virtual machine such as secure virtualization, and then run the cryptographic service as a virtual cryptographic machine through the secure virtual machine, and can isolate a secure computing environment adapted to the cryptographic service in the general computing environment.

It should be noted that the secure virtualization technology is only an optional implementation method for providing a security protection mechanism for a virtual machine (i.e., the secure virtualization technology is only an optional implementation method for implementing a secure virtual machine with a trusted execution environment). The embodiments of the present application may also use other security protection mechanisms to implement a secure virtual machine, and are not limited to the virtual machine memory space encryption mechanism of the secure virtualization technology. For example, through the physical isolation and logical isolation of the memory space of the secure virtual machine, the memory space of the secure virtual machine can only be accessed by the secure virtual machine, and ordinary virtual machines are not allowed to access it, thereby implementing a security protection mechanism for the secure virtual machine through data isolation protection in the memory space of the secure virtual machine.

In a further optional implementation, based on the security requirements of the virtual cryptographic machine, the embodiment of the present application needs to ensure that the software program running on the virtual cryptographic machine is safe and reliable. For example, the virtual cryptographic machine can use a secure boot method to ensure that the running software program is safe, reliable and not tampered with. Among them, for the virtual cryptographic machine, the secure boot method is a startup security mechanism of the virtual cryptographic machine, which is used to verify the integrity and credibility of the loaded software during the startup process of the virtual cryptographic machine, thereby ensuring that the software loaded by the virtual cryptographic machine is untampered and verified software from the start of the virtual cryptographic machine to the complete loading of the operating system.

In an optional implementation, the embodiment of the present application can realize the communication between the virtual business machine and the virtual cryptographic machine based on the virtual machine communication mechanism. For example, in conjunction with FIG3, the embodiment of the present application can realize the communication between the virtual business machine and the virtual cryptographic machine through the virtual network in the host. The virtual network can be a network inside the host that allows communication between virtual machines. For example, the virtual machines inside the host can be connected through a virtual switch, and communication between virtual machines can be realized.

In other possible implementations, the virtual business machine and the virtual cryptographic machine may also communicate through a shared memory space. For example, data transmitted from the virtual business machine to the virtual cryptographic machine may first be passed to the shared memory space and then obtained by the virtual cryptographic machine from the shared memory space; data transmitted by the virtual cryptographic machine may first be passed to the shared memory space and then obtained by the virtual business machine from the shared memory space.

It should be noted that the implementation method of the communication mechanism between the virtual business machine and the virtual cryptographic machine is not limited in the embodiments of the present application, and the possible communication mechanisms such as the virtual network and shared memory space described above are only exemplary descriptions.

It should be further explained that, when the virtual cryptographic machine is implemented as an encrypted virtual machine, the data stored in the corresponding encrypted memory space by the virtual cryptographic machine is a ciphertext encrypted with the virtual machine key. Thus, as an example, when the data to be calculated of the cryptographic application system is encrypted using the cryptographic service, the virtual cryptographic machine can use the key of the cryptographic service to encrypt the data to be calculated. If the encrypted data needs to be saved in the encrypted memory space corresponding to the virtual cryptographic machine, the encrypted data also needs to be encrypted with the virtual machine key of the virtual cryptographic machine, and then saved in the encrypted memory space corresponding to the virtual cryptographic machine; further, if the virtual cryptographic machine reads data from the corresponding encrypted memory space and transmits it to the virtual business machine, the embodiment of the present application uses the virtual machine key corresponding to the virtual cryptographic machine to decrypt the data in the encrypted memory space of the virtual cryptographic machine to obtain data encrypted with the key of the cryptographic service (i.e., the result of the data to be calculated being encrypted by the cryptographic service), and then transmits it to the virtual business machine.

It can be seen that when the virtual cryptographic machine is implemented as an encryption virtual machine, the key of the cryptographic service running the virtual cryptographic machine is used to perform cryptographic operations such as encrypting the data of the cryptographic application system; while the virtual machine key of the virtual cryptographic machine is used to encrypt the data saved by the virtual cryptographic machine to the corresponding encrypted memory space and decrypt the data read from the corresponding encrypted memory space. In other words, the key of the cryptographic service running the virtual cryptographic machine and the key of the virtual machine corresponding to the virtual cryptographic machine are not the same in terms of the processing objects.

Continuing to refer to FIG. 3 , in addition to multiple virtual machines, the host also includes a cryptographic module (Crypto Module, CM) 330; the cryptographic module can be a hardware unit in the host that cooperates with the cryptographic service to implement cryptographic operations. In a possible implementation, the cryptographic module can be, for example, a cryptographic coprocessor. It should be noted that the cryptographic coprocessor is a dedicated hardware device designed to perform cryptographic operations such as encryption, decryption, and generation of digital signatures to improve the security and efficiency of performing cryptographic operations on data; for example, the cryptographic coprocessor can be in the form of a physical chip built into the host.

In the embodiment of the present application, at least one virtual cryptographic module (VCM) 331 can be implemented inside the cryptographic module, and the virtual cryptographic module 331 can be used for key management and cryptographic operations. Among them, the key management performed by the virtual cryptographic module includes key generation, key import, key storage, ciphertext and key export, etc.; the cryptographic operations performed by the virtual cryptographic module include encryption, decryption, generation and verification of digital signatures, generation of timestamps, etc.

It should be noted that the virtual cryptographic module can perform at least one type of cryptographic operation (one type or multiple types of cryptographic operations). The type of cryptographic operation can refer to the description in the corresponding part of the previous text and will not be expanded here; the key form managed by the virtual cryptographic module can correspond to the type of cryptographic operation supported by the key, including but not limited to the keys corresponding to encryption and decryption, the private keys and public keys corresponding to digital signatures and verification, etc.

As an optional implementation, the number of virtual cryptographic modules implemented inside the cryptographic module can correspond to the number of virtual cryptographic machines, so that one virtual cryptographic module can be assigned to one virtual cryptographic machine, that is, one virtual cryptographic machine corresponds to one virtual cryptographic module, so that the virtual cryptographic module can provide key management and cryptographic operation support for the cryptographic services of the corresponding virtual cryptographic machine.

In an optional implementation, the virtual cryptographic module can be regarded as a logical unit virtualized and created inside the cryptographic module. For example, a virtual cryptographic module can be created inside the cryptographic module in a software-defined manner, and each virtual cryptographic module can independently perform key management and cryptographic operations. The virtual cryptographic module created inside the cryptographic module can use the hardware resources of the cryptographic module to implement the functions of the virtual cryptographic module.

It can be seen that the host provided in the embodiment of the present application may include multiple virtual machines and cryptographic modules; the multiple virtual machines include at least one virtual cryptographic machine and at least one virtual business machine; wherein the virtual cryptographic machine runs a cryptographic service, the virtual business machine runs a cryptographic application system, and the cryptographic application system uses the cryptographic service to perform cryptographic operations on the data to be operated by the cryptographic application system; and the virtual cryptographic machine is a secure virtual machine that adopts a security protection mechanism, so that the cryptographic service runs in a trusted execution environment; the virtual business machine is an ordinary virtual machine, so that the cryptographic application system runs in a general computing environment; the cryptographic module includes a number of virtual cryptographic modules corresponding to the at least one virtual cryptographic machine, and one virtual cryptographic module corresponds to one virtual cryptographic machine; thereby, the virtual cryptographic module can provide key management and cryptographic operation support for the cryptographic service run by the corresponding virtual cryptographic machine.

The embodiment of the present application can realize multiple virtual machines in the same host through virtualization technology; the secure virtual machine using the security protection mechanism among the multiple virtual machines can be used as a virtual cryptographic machine to realize at least one virtual cryptographic machine in the host, so that the cryptographic service of the virtual cryptographic machine can run in a trusted execution environment; the ordinary virtual machine without the security protection mechanism among the multiple virtual machines can be used as a virtual business machine to realize at least one virtual business machine in the host, so that the cryptographic application system of the virtual business machine can run in a general computing environment. The above settings can meet the computing environment requirements of the cryptographic service and the cryptographic application system, and the cryptographic application system and the cryptographic service can realize communication interaction through the virtual machine communication mechanism in the host, thereby avoiding the network bandwidth occupation caused by the cryptographic application system and the cryptographic service using network communication, improving the timeliness of the response of the cryptographic service to the cryptographic application system, and improving the performance of the cryptographic service. In other words, the cryptographic application system can access the cryptographic service in the same host without network communication, which can improve the performance of the cryptographic service.

At the same time, a cryptographic module can be implemented in the host, and the cryptographic module can include virtual cryptographic modules corresponding to the number of the at least one virtual cryptographic machine, and one virtual cryptographic module corresponds to one virtual cryptographic machine; thus, the virtual cryptographic module can provide key management and cryptographic operation support for the cryptographic service run by the corresponding virtual cryptographic machine. In other words, the virtual cryptographic machine implemented by the secure virtual machine and the corresponding virtual cryptographic module can jointly provide secure and reliable cryptographic services to ensure the security and reliability of the cryptographic services.

Therefore, the solution provided in the embodiment of the present application can improve the timeliness of the response of the cryptographic service to the cryptographic application system, improve the performance of the cryptographic service, and at the same time ensure the security and reliability of the cryptographic service; and, the cryptographic service and the cryptographic application system are in the same host, which can avoid setting up a dedicated physical host for the cryptographic service, can reduce the cost of the cryptographic service, and is conducive to the promotion and popularization of the cryptographic service.

In a further optional implementation, from the hardware level of the host, the virtual machine is mainly implemented by running virtualization software through a processor (such as a CPU), so at the hardware level, the host mainly includes a processor and a cryptographic module; wherein the processor can run multiple virtual machines, and the multiple virtual machines can include at least one virtual cryptographic machine and at least one virtual business machine described above.

As an optional implementation, based on one virtual cryptographic module being assigned to one virtual cryptographic machine (i.e., one virtual cryptographic module corresponds to one virtual cryptographic machine), the virtual cryptographic module provides key management and cryptographic operation support for the assigned virtual cryptographic machine. Therefore, to further ensure the security of the keys of the cryptographic services run by each virtual cryptographic machine, the virtual cryptographic modules within the cryptographic module can be isolated from each other to ensure that the keys of the cryptographic services stored in one virtual cryptographic module cannot be accessed by other virtual cryptographic modules.

In an optional implementation, the embodiment of the present application can deploy an independent virtual environment for each virtual cryptographic module created inside the cryptographic module to achieve mutual isolation between the virtual cryptographic modules inside the cryptographic module. In an optional implementation, the embodiment of the present application can also configure an independent key storage area for each virtual cryptographic module inside the cryptographic module, and through the physical isolation and/or logical isolation of the key storage area of the virtual cryptographic module, ensure that the key storage area can only be accessed by the configured virtual cryptographic module, and cannot be accessed by other virtual cryptographic modules.

In an optional implementation, the virtual cryptographic machine can access the corresponding virtual cryptographic module through a communication channel to use the key management and cryptographic operation functions of the virtual cryptographic module. For example, there are multiple communication channels between multiple virtual cryptographic machines and multiple virtual cryptographic modules, and one communication channel is used for communication between a virtual cryptographic machine and the corresponding virtual cryptographic module. For example, the communication channel between the virtual cryptographic machine and the virtual cryptographic module can be a logically implemented communication channel, for example, multiple communication channels can share the same hardware resources, but are logically isolated (that is, multiple communication channels are logically isolated).

In an optional implementation, in order to ensure the communication security between the virtual cryptographic machine and the corresponding virtual cryptographic module, the virtual cryptographic module can access the corresponding virtual cryptographic module through a communication channel using a secure communication mechanism, and the communication channel using a secure communication mechanism can be regarded as a secure communication channel. The secure communication mechanism used by the secure communication channel is, for example, a data encryption protection mechanism, etc. Taking the data encryption protection mechanism as an example, the data transmitted through the communication channel can be encrypted and decrypted using the key of the communication channel (different communication channels can have different keys), so that the data transmitted through the communication channel between the virtual cryptographic machine and the corresponding virtual cryptographic module can be encrypted using the key of the communication channel.

In further optional implementations, the secure communication mechanism of the communication channel may also include, for example, a data integrity protection mechanism, an identity verification mechanism for both communicating parties, and the like. For example, the data integrity protection mechanism may be, for example, a data integrity verification mechanism based on a message authentication code such as HMAC (Hash-Based Message Authentication Code) to ensure that the data has not been tampered with during the transmission process of the communication channel. For example, the identity verification mechanism for both communicating parties may verify whether the data receiver and the data sender of the communication channel are the corresponding virtual cryptographic machine and virtual cryptographic module to ensure that the virtual cryptographic module will not respond to access by other virtual cryptographic machines (virtual cryptographic machines corresponding to non-virtual cryptographic modules). Of course, the secure communication mechanism of the communication channel may also have other possible implementation mechanisms, and is not limited to the above example description.

Based on the host architecture provided by the embodiment of the present application, the embodiment of the present application can provide a cryptographic service management method to manage the life cycle of the virtual cryptographic module and the virtual cryptographic machine, and further securely protect the data to be calculated in the cryptographic application system.

It should be noted that the steps performed by each device module in the method content described below and the optional implementation methods of the steps can be regarded as the corresponding functions of each device module, so that the functional content of each device module in the host architecture provided by the embodiment of the present application can be referenced to each other with the method content described below.

As an optional implementation, FIG4 exemplarily shows an optional flow chart of the cryptographic service management method provided in an embodiment of the present application. Referring to FIG4 , the method flow may include the following steps.

In step S410, the host management program sends a virtual cryptographic module creation command to the cryptographic module.

The host hypervisor may be a virtualization hypervisor of the host, such as a virtual machine manager (VMM). The host hypervisor (such as a virtual machine manager) may run on a processor.

As an optional implementation, before, during, or after the virtual cryptographic machine is started, the host management program may send a virtual cryptographic module creation command to the cryptographic module to instruct the cryptographic module to create a virtual cryptographic module. Optionally, for any virtual cryptographic machine, the host management program may send a virtual cryptographic module creation command to the cryptographic module so that each virtual cryptographic machine may have a correspondingly created virtual cryptographic module.

In step S411, the cryptographic module creates a virtual cryptographic module.

In the initial state, there is no virtual cryptographic module inside the cryptographic module (that is, the internal initial state of the cryptographic module is empty). As the host management program sends a virtual cryptographic module creation command to the cryptographic module, the cryptographic module can create a virtual cryptographic module internally accordingly. As the number of virtual cryptographic module creation commands increases (correspondingly, the number of virtual cryptographic machines that the host needs to start increases), the number of virtual cryptographic modules created inside the cryptographic module increases accordingly, so as to achieve one virtual cryptographic machine corresponding to one virtual cryptographic module.

After receiving the virtual cryptographic module creation command sent by the host management program, the cryptographic module can respond to the virtual cryptographic module creation command and create a virtual cryptographic module internally. In an optional implementation, the cryptographic module can create a virtual cryptographic module by virtualization internally and configure hardware resources (such as storage resources such as key storage areas, computing resources for cryptographic operations, etc.) for the created virtual cryptographic module.

As an example, the cryptographic module may create a logical partition corresponding to the virtual cryptographic module, and configure hardware resources such as computing resources and key storage areas for the logical partition corresponding to the virtual cryptographic module, so that the virtual cryptographic module can independently perform key management and cryptographic operation tasks.

In an optional implementation, based on the isolation between different virtual cryptographic modules, when creating a virtual cryptographic module, the cryptographic module can deploy an independent virtual environment for the created virtual cryptographic module, so that the created virtual cryptographic module has an isolated and secure operating space. For example, an independent logical partition can be configured for the virtual cryptographic module, and the logical partitions of different virtual cryptographic modules are different; for another example, a sandbox environment can be configured for the virtual cryptographic module, so that the virtual cryptographic module can safely perform key management and cryptographic operations in the sandbox environment. That is to say, in a possible implementation, the cryptographic module can create a virtual cryptographic module through logical isolation and resource management, and different virtual cryptographic modules are isolated from each other.

As an optional implementation, after the cryptographic module creates the virtual cryptographic module, if the virtual cryptographic machine to which the virtual cryptographic module needs to be assigned has been started, the host management program can assign the virtual cryptographic module to the virtual cryptographic machine to establish a corresponding relationship between the virtual cryptographic module and the virtual cryptographic machine. Optionally, after creating the virtual cryptographic module, the cryptographic module can feedback a virtual cryptographic module creation completion response to the host management program so that the host management program can perform the allocation and binding between the virtual cryptographic module and the virtual cryptographic machine; optionally, the virtual cryptographic module creation completion response is a response information, which, in addition to carrying a notification that the virtual cryptographic module has been created, can also carry information about the created virtual cryptographic module, such as identification information of the virtual cryptographic module.

Furthermore, the host management program can configure the communication channel between the virtual cryptographic module and the virtual cryptographic machine to be in a connected state, for example, allocate a communication channel to the virtual cryptographic machine and the corresponding virtual cryptographic module, and configure the communication channel to be in a connected state, so that the virtual cryptographic machine and the corresponding virtual cryptographic module can communicate through the communication channel.

As an optional implementation, after the cryptographic module creates the virtual cryptographic module, if the virtual cryptographic machine to which the virtual cryptographic module is to be assigned has not yet started, the host management program can assign the virtual cryptographic module to the virtual cryptographic machine after the virtual cryptographic machine is started, so as to establish a corresponding relationship between the virtual cryptographic module and the virtual cryptographic machine. The following process takes the creation of a virtual cryptographic module before the virtual cryptographic machine is started as an example to illustrate the process.

In step S412, the host hypervisor starts the virtual cryptographic machine.

In an optional implementation, the host management program can start the virtual cryptographic machine through the virtual cryptographic machine startup process. The virtual cryptographic machine startup process can be regarded as a process of various stages from the allocation of hardware resources of the virtual cryptographic machine to the loading of the operating system, including but not limited to the allocation of hardware resources (such as processor resources, memory resources, etc.) for the virtual cryptographic machine, loading the configuration file of the virtual cryptographic machine, loading the operating system and application of the virtual cryptographic machine, etc. Based on the fact that the virtual cryptographic machine is a secure virtual machine using a security protection mechanism, during the startup process of the virtual cryptographic machine, a security protection mechanism can also be configured for the virtual cryptographic machine; for example, taking the secure virtualization technology as an example, the host management program can notify the host's dedicated security device (such as a security processor) to allocate a virtual machine key to the virtual cryptographic machine, etc.

Furthermore, in order to ensure the security of the virtual cryptographic machine startup process, the embodiment of the present application can start the software environment of the virtual cryptographic machine through a secure startup method to ensure that the software loaded during the startup of the virtual cryptographic machine is trusted software. Furthermore, the embodiment of the present application can also use a disk encryption function to protect the confidentiality of the disk image of the virtual cryptographic machine, thereby ensuring that the data of the virtual cryptographic machine is not stolen from the outside; wherein, the disk image of the virtual cryptographic machine contains the operating system, application program, and other sensitive data of the virtual cryptographic machine, and the use of the disk encryption function to protect the disk image of the virtual cryptographic machine can ensure that the data of the virtual cryptographic machine on the disk cannot be correctly read without decryption. Accordingly, when the virtual cryptographic machine is started, the disk image of the virtual cryptographic machine can be decrypted to load the disk data such as the operating system and application program of the virtual cryptographic machine.

In an optional implementation, the secure boot mechanism of the virtual cipher machine and disk encryption are used in combination to provide comprehensive security protection for the virtual cipher machine, that is, the secure boot mechanism ensures the security of the virtual cipher machine during the boot process and can prevent the execution of malicious code; the disk encryption function protects the security of the static data of the virtual cipher machine on the disk.

After the virtual cryptographic machine is started, the host management program can assign the virtual cryptographic module created by the cryptographic module to the virtual cryptographic machine to establish a corresponding relationship between the virtual cryptographic machine and the virtual cryptographic module, that is, to achieve the binding of the virtual cryptographic machine and the virtual cryptographic module. That is, before the virtual cryptographic machine is started, in the case of creating a virtual cryptographic module, the host management program can send a virtual cryptographic module creation command to the cryptographic module before the virtual cryptographic machine is started, and then after the virtual cryptographic machine is started, the virtual cryptographic module created corresponding to the virtual cryptographic module creation command can be assigned to the started virtual cryptographic machine to establish a corresponding relationship between the virtual cryptographic machine and the virtual cryptographic module.

As an optional implementation example, after the cryptographic module responds to the host management program's virtual cryptographic module creation command and creates the virtual cryptographic module, it can feed back the identification information of the created virtual cryptographic module to the host management program, so that the host management program can record the identification information of the virtual cryptographic module created corresponding to the virtual cryptographic module creation command; further, after the host management program starts the virtual cryptographic machine, it can establish a correspondence between the identification information of the virtual cryptographic machine and the identification information of the virtual cryptographic module, and then feed back the correspondence to the started virtual cryptographic machine, so that the virtual cryptographic machine can know the assigned virtual cryptographic module, and realize the binding of the virtual cryptographic machine and the virtual cryptographic module. Furthermore, the host management program can connect the communication channel between the virtual cryptographic machine and the corresponding virtual cryptographic module, so that the virtual cryptographic machine can communicate with the corresponding virtual cryptographic module through the communication channel.

It should be noted that creating a virtual cryptographic module before the virtual cryptographic machine is started is only an optional implementation example. The embodiment of the present application can also support creating a virtual cryptographic module when the virtual cryptographic machine is started or after it is started. And since the virtual cryptographic machine has been started after the virtual cryptographic module is created, the created virtual cryptographic module can be directly assigned to the virtual cryptographic machine.

In step S413, the virtual cryptographic machine sends key management information to the virtual cryptographic module so that the virtual cryptographic module saves the key of the cryptographic service.

In step S414, the virtual cryptographic module responds to the key management information and saves the key of the cryptographic service.

After the communication channel between the virtual cryptographic machine and the corresponding virtual cryptographic module is connected, the virtual cryptographic machine can save the key for the cryptographic service inside the virtual cryptographic module through the key management function of the virtual cryptographic module. In an optional implementation, the virtual cryptographic machine can import the key for the cryptographic service into the virtual cryptographic module through the key import function of the key management, so that the virtual cryptographic module saves the key for the cryptographic service. In other optional implementations, the virtual cryptographic machine can request the virtual cryptographic module to generate the key for the cryptographic service through the key generation function of the key management, so that the virtual cryptographic module saves the key for the cryptographic service.

In an optional implementation, based on whether the virtual cryptographic machine stores keys of cryptographic services that have been used historically, the virtual cryptographic machine may choose whether to use a key import function or a key generation function to store keys of cryptographic services inside the virtual cryptographic module.

Optionally, the virtual cryptographic machine can determine whether the key of the cryptographic service is saved in the file system of the virtual cryptographic machine. If the key of the cryptographic service is saved in the file system of the virtual cryptographic machine, it means that the virtual cryptographic machine has been run in the past, and the virtual cryptographic machine has used the historically assigned virtual cryptographic module to perform key management of the cryptographic service. For example, the virtual cryptographic machine has used the historically assigned virtual cryptographic module to generate the key of the cryptographic service, and the generated key of the cryptographic service is saved in the file system of the virtual cryptographic machine (for example, before the virtual cryptographic machine is historically closed, the key of the cryptographic service generated by the historically assigned virtual cryptographic module is saved in the file system of the virtual cryptographic machine); thus, the virtual cryptographic machine can read the key of the cryptographic service from the file system of the virtual cryptographic machine, and import the key of the cryptographic service into the virtual cryptographic module; at this time, the key management information sent by the virtual cryptographic machine to the virtual cryptographic module may be key import information, carrying the key of the cryptographic service.

In a further optional implementation, in order to ensure the security of the key of the cryptographic service, the key of the cryptographic service can be encrypted using a preset virtual cryptographic module built-in key when it is saved. That is, the virtual cryptographic module built-in key can be a key for encrypting and decrypting the key of the cryptographic service, and is used to ensure the security of the key of the cryptographic service when it is saved in the file system of the virtual cryptographic machine. For example, the virtual cryptographic module built-in key can be pre-set, and the virtual cryptographic module built-in keys of multiple virtual cryptographic modules can be kept unified.

Correspondingly, the virtual cryptographic machine can import the key of the cryptographic service encrypted by using the preset virtual cryptographic module built-in key into the virtual cryptographic module; at this time, the key management information sent by the virtual cryptographic machine to the virtual cryptographic module can be key import information, carrying the encrypted key of the cryptographic service; further, the virtual cryptographic module can respond to the key import information of the virtual cryptographic machine, use the preset virtual cryptographic module built-in key, decrypt the imported encrypted key of the cryptographic service, thereby obtaining the decrypted key of the cryptographic service, and save it inside the virtual cryptographic module, such as in the key storage area of the virtual cryptographic module.

In an optional implementation, if the key of the cryptographic service is not stored in the file system of the virtual cryptographic machine, the virtual cryptographic machine may request the virtual cryptographic module to generate the key of the cryptographic service. At this time, the key management information sent by the virtual cryptographic machine to the virtual cryptographic module may be a key generation request information for requesting the virtual cryptographic module to generate the key of the cryptographic service. Optionally, the virtual cryptographic module may generate the key of the cryptographic service using a key generation algorithm; for example, the virtual cryptographic module may generate the key of the cryptographic service using a random number. For example, the key of the cryptographic service may be a symmetric key, such as a randomly generated fixed-length bit string; for example, the key of the cryptographic service may be an asymmetric key, such as a pair of keys consisting of a private key and a public key of the cryptographic service.

In other possible implementations, the embodiments of the present application may also support saving the key of the cryptographic service in the virtual cryptographic module by requesting the virtual cryptographic module to generate the key of the cryptographic service each time the virtual cryptographic machine is started and a corresponding relationship is established with the virtual cryptographic module.

In other possible implementations, the embodiments of the present application may also support updating the cryptographic service key, such as updating the cryptographic service key periodically or under the control of an administrator. For example, when the usage time of the cryptographic service key reaches a preset time, the virtual cryptographic machine may request the virtual cryptographic module to regenerate the cryptographic service key to update the cryptographic service key.

In step S415, the virtual cryptographic machine starts the cryptographic service.

In step S416, the virtual cryptographic machine runs the cryptographic service.

After the virtual cryptographic module saves the key of the cryptographic service, the virtual cryptographic machine can start the cryptographic service, thereby running the cryptographic service; further, the cryptographic service of the virtual cryptographic machine can be called by the cryptographic application system of the virtual business machine. For example, during the operation of the cryptographic service, the cryptographic application system of the virtual business machine can send the data to be calculated to the cryptographic service of the virtual cryptographic machine, so that the virtual cryptographic machine can send the data to be calculated to the corresponding virtual cryptographic module; further, the virtual cryptographic module can use the key of the cryptographic service to perform cryptographic calculations on the data to be calculated, and feed back the cryptographic calculation results to the virtual cryptographic machine; the cryptographic service of the virtual cryptographic machine can feed back the cryptographic calculation results to the cryptographic application system of the virtual business machine to meet the data security requirements of the cryptographic application system for the data to be calculated.

As an optional implementation, FIG5 exemplarily shows an optional flow chart of the operation of the cryptographic service provided in an embodiment of the present application. Referring to FIG5 , the flow may include the following steps.

In step S510, the virtual business machine sends a cryptographic application request to the virtual cryptographic machine, and the cryptographic application request carries data to be calculated.

In an optional implementation, when the cryptographic application system of the virtual business machine has data security requirements for business data (such as encryption, decryption, digital signature and other data security requirements), it can use the business data as data to be calculated and send a cryptographic application request to the cryptographic service of the virtual cryptographic machine to request that cryptographic operations corresponding to the data security requirements be performed on the data to be calculated.

In step S511, the virtual cryptographic machine sends a cryptographic operation request to the virtual cryptographic module, and the cryptographic operation request carries data to be operated.

After obtaining the cryptographic application request of the virtual business machine, the virtual cryptographic machine can use the corresponding virtual cryptographic module to perform cryptographic operations on the data to be operated; thus, the virtual cryptographic machine can generate a cryptographic operation request for performing cryptographic operations on the data to be operated, and send it to the corresponding virtual cryptographic module. In an optional implementation, the cryptographic operation request can also indicate the type of cryptographic operation (the type of cryptographic operation is compatible with the data security requirements of the data to be operated), so that the virtual cryptographic module can use the corresponding type of cryptographic operation to perform cryptographic operations on the data to be operated.

In step S512, the virtual cryptographic module uses the key of the cryptographic service to perform cryptographic operations on the operation data to obtain a cryptographic operation result.

In step S513, the virtual cryptographic module feeds back the cryptographic operation result to the virtual cryptographic machine.

After obtaining the cryptographic operation request of the virtual cryptographic machine, the virtual cryptographic module can use the cryptographic service key stored in the virtual cryptographic module to perform cryptographic operations on the data to be operated, and feed back the cryptographic operation results to the virtual cryptographic machine. In an optional implementation, the virtual cryptographic module can use the cryptographic operation type corresponding to the data security requirements of the data to be operated and the cryptographic service key to perform cryptographic operations on the data to be operated, thereby obtaining a cryptographic operation result that meets the data security requirements of the data to be operated.

The adaptation correspondence between the types of cryptographic operations, the types of cryptographic services and the data security requirements can be referred to the description in the corresponding part of the previous text and will not be expanded here.

In step S514, the virtual cryptographic machine sends the cryptographic operation result to the virtual business machine.

After obtaining the cryptographic operation result of the corresponding virtual cryptographic module, the virtual cryptographic machine can send the cryptographic operation result to the virtual business machine to complete the processing response of the cryptographic application system of the virtual business machine when calling the cryptographic service of the virtual cryptographic machine.

In a further optional implementation, the embodiment of the present application also provides a cryptographic service management solution when the virtual cryptographic machine is turned off. Optionally, FIG6 exemplarily shows another optional flow chart of the cryptographic service management method provided by the embodiment of the present application. Referring to FIG6 , the method flow may include the following steps.

In step S610, the host hypervisor sends a virtual machine shutdown instruction to the virtual cryptographic machine.

When the virtual cryptographic machine needs to be shut down, the host management program can send a virtual machine shutdown instruction to the virtual cryptographic machine to control the virtual cryptographic machine to shut down. In an optional implementation, the shutdown of the virtual cryptographic machine can be actively triggered by the administrator or triggered by an automated script; for example, the administrator can shut down the virtual cryptographic machine through the virtual machine management interface, so that the host management program can respond to the administrator's shutdown operation on the virtual cryptographic machine, generate a virtual machine shutdown instruction and send it to the virtual cryptographic machine; for another example, the shutdown of the virtual cryptographic machine can be automatically executed according to a specific strategy or trigger condition, such as the shutdown condition of the virtual cryptographic machine can be defined in the automated script, so that when the shutdown condition of the virtual cryptographic machine is met, the host management program can generate a virtual machine shutdown instruction and send it to the virtual cryptographic machine.

In step S611, the virtual cryptographic machine sends a key export request to the virtual cryptographic module to request export of the key of the cryptographic service.

In step S612, the virtual cryptographic module sends the exported cryptographic service key to the virtual cryptographic machine.

In step S613, the virtual cryptographic module clears the stored cryptographic service key.

When the virtual cryptographic machine needs to be shut down (for example, the virtual cryptographic machine obtains the virtual machine shutdown instruction of the host management program, which is deemed that the virtual cryptographic machine needs to be shut down), the embodiment of the present application can export the key of the cryptographic service stored in the virtual cryptographic module from the virtual cryptographic module corresponding to the virtual cryptographic machine, and save it to the file system of the virtual cryptographic machine. In an optional implementation, when exporting the key of the cryptographic service, the virtual cryptographic module can respond to the key export request of the virtual cryptographic machine, use the preset virtual cryptographic module built-in key to encrypt the key of the cryptographic service, and thus export the encrypted key of the cryptographic service; that is, the key of the cryptographic service exported by the virtual cryptographic module is the encrypted key of the cryptographic service, and the key of the cryptographic service is encrypted using the preset virtual cryptographic module built-in key. By encrypting the key of the cryptographic service and then exporting it, the security of the key of the cryptographic service when it is stored in the file system of the virtual cryptographic machine can be guaranteed.

Correspondingly, after sending a key export request to the corresponding virtual cryptographic module, the virtual cryptographic machine can obtain the key of the cryptographic service exported by the corresponding virtual cryptographic module, and the key of the cryptographic service exported by the virtual cryptographic module is the encrypted key of the cryptographic service; thus, the virtual cryptographic machine can save the encrypted key of the cryptographic service exported by the corresponding virtual cryptographic module in the file system of the virtual cryptographic machine. Then, the virtual cryptographic machine can exit.

After exporting the key of the cryptographic service, the virtual cryptographic module can clear the key of the cryptographic service stored inside the virtual cryptographic module, so that when the virtual cryptographic module is destroyed subsequently, the key of the cryptographic service of the virtual cryptographic machine corresponding to the virtual cryptographic module is not retained inside the cryptographic module, thereby further ensuring the security of the key of the cryptographic service.

In step S614, the virtual cryptographic machine saves the exported cryptographic service key in the file system of the virtual cryptographic machine.

Optionally, the key of the cryptographic service stored in the file system of the virtual cryptographic machine may be an encrypted key of the cryptographic service; the key of the cryptographic service is encrypted using a preset virtual cryptographic module built-in key.

In step S615, the virtual cryptographic machine exits.

After the key of the cryptographic service is exported from the virtual cryptographic module (encrypted using the virtual cryptographic module's built-in key) and saved to the file system of the virtual cryptographic machine, the virtual cryptographic machine can exit to close the virtual cryptographic machine. The virtual cryptographic machine exit may involve stages such as resource recovery of the virtual cryptographic machine (such as recovery of hardware resources such as processor resources and memory resources of the virtual cryptographic machine) and state update (updating the state of the virtual cryptographic machine to a closed state), thereby terminating the operation of the virtual cryptographic machine and completing the closing of the virtual cryptographic machine.

In a further optional implementation, after the virtual cryptographic machine is shut down, the communication channel between the virtual cryptographic machine and the corresponding virtual cryptographic module can be disconnected until the virtual cryptographic machine (i.e., the currently shut down virtual cryptographic machine) is restarted and the corresponding virtual cryptographic module is assigned to the virtual cryptographic machine, and then the communication channel between the virtual cryptographic machine and the virtual cryptographic module is restored. By disconnecting the communication channel between the virtual cryptographic machine and the corresponding virtual cryptographic module, it is possible to prevent the virtual cryptographic module from being accessed by other virtual cryptographic machines after the virtual cryptographic machine is shut down and before the virtual cryptographic module is destroyed.

In step S616, the host management program sends a virtual cryptographic module destruction command to the cryptographic module.

In step S617, the cryptographic module destroys the virtual cryptographic module.

After the virtual cryptographic machine is shut down (more specifically, the virtual cryptographic machine is shut down and the communication channel between the virtual cryptographic machine and the virtual cryptographic module is disconnected), the host management program may send a virtual cryptographic module destruction command to the cryptographic module to instruct the cryptographic module to destroy the virtual cryptographic module corresponding to the currently shut down virtual cryptographic machine. For example, the virtual cryptographic module destruction command may carry identification information of the virtual cryptographic module to be destroyed, and the virtual cryptographic module to be destroyed is the virtual cryptographic module corresponding to the currently shut down virtual cryptographic machine, so that the cryptographic module can destroy the virtual cryptographic module corresponding to the currently shut down virtual cryptographic machine.

In an optional implementation, the cryptographic module may destroy the virtual cryptographic module by reclaiming the hardware resources of the virtual cryptographic module and clearing the logical partition of the virtual cryptographic module.

It should be noted that in the cryptographic service management method described above, the interaction between the virtual cryptographic machine and the virtual cryptographic module is achieved through a communication channel, which may be a secure communication channel using a secure communication mechanism; the interaction between the virtual cryptographic machine and the virtual business machine is achieved through a virtual machine communication mechanism (such as a virtual network). For the relevant contents about the communication channel and the virtual machine communication mechanism, please refer to the description of the corresponding part above.

The solution provided by the embodiment of the present application can realize the cryptographic service and the cryptographic application system in the same host, which can avoid setting up a special physical host for the cryptographic service, can reduce the cost of the cryptographic service, and is conducive to the promotion and popularization of the cryptographic service. In addition, the cryptographic service runs on a virtual cryptographic machine, which is a secure virtual machine using a security protection mechanism; the cryptographic application system runs on a virtual business machine, which is an ordinary virtual machine; thus, the embodiment of the present application can meet the computing environment requirements of the cryptographic service and the cryptographic application system, and the cryptographic application system and the cryptographic service can realize communication interaction through the virtual machine communication mechanism in the host, improve the timeliness of the response of the cryptographic service to the cryptographic application system, and improve the performance of the cryptographic service. In addition, the virtual cryptographic machine and the corresponding virtual cryptographic module can jointly provide a secure and reliable cryptographic service to ensure the security and reliability of the cryptographic service. It can be seen that the solution provided by the embodiment of the present application can improve the performance of the cryptographic service and is conducive to the promotion and popularization of the cryptographic service.

In a further optional implementation, the functions of the host management program, the virtual cryptographic machine, and the virtual cryptographic module can be configured by software, for example, the relevant functions of the host management program, the virtual cryptographic machine, and the virtual cryptographic module in the cryptographic service management solution are configured by software instructions. The embodiment of the present application further provides a storage medium. The storage medium can store computer instructions, and when the computer instructions are executed, the cryptographic service management method performed by the host management program as provided in the embodiment of the present application, or the cryptographic service management method performed by the virtual cryptographic machine as provided in the embodiment of the present application, or the cryptographic service management method performed by the virtual cryptographic module as provided in the embodiment of the present application is implemented.

In a further optional implementation, the embodiment of the present application also provides a computer program product, which includes computer instructions, which, when executed, implement a cryptographic service management method executed by a host management program as provided in the embodiment of the present application, or a cryptographic service management method executed by a virtual cryptographic machine as provided in the embodiment of the present application, or a cryptographic service management method executed by a virtual cryptographic module as provided in the embodiment of the present application.

The above describes multiple implementation schemes provided by the embodiments of the present application. The various optional methods introduced in each implementation scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible implementation schemes, which can all be considered as implementation schemes disclosed and open in the embodiments of the present application.

Although the embodiments of the present application are disclosed above, the present application is not limited thereto. Any person skilled in the art may make various changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be subject to the scope defined by the claims.

Claims (19)

1. A host computer, which comprises a host computer, characterized by comprising the following steps: a plurality of virtual machines and a password module;

The virtual machines comprise at least one virtual password machine and at least one virtual service machine; the virtual password machine runs password service, the virtual business machine runs password application system, and the password application system uses the password service to execute password operation for data to be operated of the password application system; the virtual password machine is a safe virtual machine adopting a safe protection mechanism, so that the password service runs in a trusted execution environment; the virtual service machine is a common virtual machine, so that the password application system operates in a general computing environment;

The password modules comprise virtual password modules, the number of which corresponds to that of the at least one virtual password machine, and one virtual password module corresponds to one virtual password machine; the virtual password module provides key management and password operation support for password service operated by the corresponding virtual password machine.

2. The host of claim 1, further comprising: a host management program;

The host management program is used for sending a virtual password module creation command to the password module so as to instruct the password module to create the virtual password module; after the virtual password machine is started, the virtual password module created by the password module is distributed to the virtual password machine so as to establish the corresponding relation between the virtual password machine and the virtual password module; and after the virtual cipher machine is closed, sending a virtual cipher module destroying command to the cipher module to instruct the cipher module to destroy the virtual cipher module corresponding to the closed virtual cipher machine.

3. The host of claim 2, wherein the virtual cryptographic machine is configured to send key management information to a corresponding virtual cryptographic module after the virtual cryptographic machine is started and the corresponding virtual cryptographic module is assigned, so that the virtual cryptographic module stores a key of a cryptographic service;

And when the virtual cryptographic machine needs to be shut down, sending a key derivation request to a virtual cryptographic module to request derivation of a key of a cryptographic service.

4. The host of claim 3, wherein the virtual cryptographic machine configured to send key management information to a corresponding virtual cryptographic module to cause the virtual cryptographic module to store a key for a cryptographic service comprises:

judging whether a file system of the virtual cipher machine stores a cipher key of the cipher service or not;

if the file system of the virtual cipher machine stores the cipher service cipher key, sending cipher key import information to the corresponding virtual cipher module, wherein the cipher key import information carries the cipher service cipher key stored in the file system of the virtual cipher machine;

and if the key of the password service is not stored in the file system of the virtual password machine, sending key generation request information to the corresponding virtual password module so as to request the virtual password module to generate the key of the password service.

5. The host of claim 4, wherein the cryptographic services stored in the file system of the virtual cryptographic machine have keys of: a key of the encrypted cryptographic service; the key of the encrypted password service is encrypted by adopting a preset built-in key of a virtual password module;

the virtual cryptographic machine is configured to send key import information to a corresponding virtual cryptographic module, where the key import information carries a key of a cryptographic service stored in a file system of the virtual cryptographic machine, and the key includes:

transmitting key import information to the corresponding virtual cryptographic module, wherein the key import information carries the key of the encrypted cryptographic service;

The virtual cipher module is used for responding to the key import information, decrypting the imported key of the encrypted cipher service by using the built-in key of the virtual cipher module, and storing the decrypted key of the cipher service.

6. The host of claim 5, wherein the virtual cryptographic module is further configured to encrypt a key of the stored cryptographic service using a key built in the virtual cryptographic module in response to the key derivation request, and derive a key of the encrypted cryptographic service; and after deriving the key of the encrypted cryptographic service, clearing the stored key of the cryptographic service;

The key of the encrypted password service derived by the virtual password module is stored in a file system corresponding to the virtual password machine.

7. The host of claim 3, wherein the virtual cryptographic machine is further configured to initiate and run a cryptographic service after the corresponding virtual cryptographic module holds a key for the cryptographic service;

In the process of running the password service, acquiring a password application request sent by the virtual service machine, wherein the password application request carries data to be operated of a password application system of the virtual service machine; sending a password operation request to a corresponding virtual password module, wherein the password operation request carries the data to be operated; obtaining a password operation result fed back by the corresponding virtual password module, and feeding back the password operation result to the virtual service machine;

The virtual cryptographic module is used for responding to a cryptographic operation request sent by a corresponding virtual cryptographic machine, and executing cryptographic operation on the data to be operated by utilizing a key of a cryptographic service to obtain a cryptographic operation result; and feeding the password operation result back to the corresponding virtual password machine.

8. The host of claim 2, wherein the at least one virtual cryptographic machine is a plurality of virtual cryptographic machines, the plurality of virtual cryptographic machines and the plurality of virtual cryptographic modules having a plurality of communication channels therebetween, one communication channel being for communication between one virtual cryptographic machine and a corresponding virtual cryptographic module; the communication channels adopt a safe communication mechanism, and a plurality of communication channels are mutually isolated;

the communication channel between the virtual cipher machine and the corresponding virtual cipher module is communicated when the virtual cipher module is distributed to the virtual cipher machine, and is disconnected after the virtual cipher machine is closed and before the virtual cipher module is destroyed;

the password module is internally provided with a plurality of virtual password modules which are mutually isolated; and the virtual password machine and the virtual service machine are communicated through a virtual machine communication mechanism.

9. The host of any one of claims 1-8, wherein the secure virtual machine comprises an encrypted virtual machine, a memory space of the encrypted virtual machine is encrypted with a virtual machine key of the encrypted virtual machine, and virtual machine keys of different encrypted virtual machines are different; the common virtual machine is a virtual machine without a virtual machine key.

10. A cryptographic service management method, wherein the method is based on the host of any one of claims 1-9, the method being performed by a host hypervisor, the method comprising:

sending a virtual cryptographic module creation command to the cryptographic module to instruct the cryptographic module to create a virtual cryptographic module;

Starting a virtual password machine, and after the virtual password machine is started, distributing the virtual password module created by the password module to the virtual password machine so as to establish the corresponding relation between the virtual password machine and the virtual password module;

and sending a virtual machine closing instruction to the virtual cipher machine to instruct the virtual cipher machine to close, and sending a virtual cipher module destroying command to the cipher module after the virtual cipher machine is closed to instruct the cipher module to destroy the virtual cipher module corresponding to the closed virtual cipher machine.

11. A cryptographic service management method, wherein the method is based on the host of any one of claims 1-9, the method being performed by a virtual cryptographic machine, the method comprising:

after the virtual cipher machine is started and the corresponding virtual cipher module is distributed, key management information is sent to the corresponding virtual cipher module so that the virtual cipher module can store the cipher key of the cipher service;

And obtaining a virtual machine closing instruction sent by the host management program, and sending a key export request to the virtual cryptographic module to request export of a key of the cryptographic service.

12. The method of claim 11, wherein the sending key management information to the corresponding virtual cryptographic module to cause the virtual cryptographic module to store the key of the cryptographic service comprises:

judging whether a file system of the virtual cipher machine stores a cipher key of the cipher service or not;

if the file system of the virtual cipher machine stores the cipher service cipher key, sending cipher key import information to the corresponding virtual cipher module, wherein the cipher key import information carries the cipher service cipher key stored in the file system of the virtual cipher machine;

and if the key of the password service is not stored in the file system of the virtual password machine, sending key generation request information to the corresponding virtual password module so as to request the virtual password module to generate the key of the password service.

13. The method of claim 12, wherein the cryptographic services stored in the file system of the virtual cryptographic machine have keys of: a key of the encrypted cryptographic service; the key of the encrypted password service is encrypted by adopting a preset built-in key of a virtual password module;

the sending the key import information to the corresponding virtual cryptographic module, where the key import information carries a cryptographic service key stored in a file system of the virtual cryptographic machine, and the key includes:

transmitting key import information to the corresponding virtual cryptographic module, wherein the key import information carries the key of the encrypted cryptographic service;

The key of the cipher service derived by the virtual cipher module is as follows: a key of the encrypted cryptographic service; the method further comprises the steps of:

Storing the key of the encrypted password service derived by the corresponding virtual password module in a file system of the virtual password machine;

and exiting the virtual crypto machine.

14. The method of claim 11, wherein the method further comprises:

starting and running the password service after the corresponding virtual password module stores the secret key of the password service;

In the process of running the password service, acquiring a password application request sent by the virtual service machine, wherein the password application request carries data to be operated of a password application system of the virtual service machine; sending a password operation request to a corresponding virtual password module, wherein the password operation request carries the data to be operated; and obtaining a password operation result fed back by the corresponding virtual password module, and feeding back the password operation result to the virtual service machine.

15. A cryptographic service management method, wherein the method is based on the host of any one of claims 1-9, the method being performed by a virtual cryptographic module, the method comprising:

After the virtual password module is created and the corresponding virtual password machine is distributed, key management information sent by the corresponding virtual password machine is obtained, the key management information is responded, and the key of the password service is saved;

And obtaining a key derivation request sent by the corresponding virtual cipher machine, and responding to the key derivation request to derive a key of the cipher service.

16. The method of claim 15, wherein the maintaining the key of the cryptographic service in response to the key management information comprises:

responding to key import information sent by a corresponding virtual cipher machine, decrypting a key of the encrypted cipher service carried by the key import information by using a preset built-in key of a virtual cipher module, and storing the key of the decrypted cipher service;

Or responding to the key generation request information sent by the corresponding virtual cipher machine, generating and storing the key of the cipher service;

said deriving a key for the cryptographic service in response to said key derivation request comprising:

Responding to a key export request sent by a corresponding virtual cipher machine, encrypting the saved key of the cipher service by using the built-in key of the virtual cipher module, and exporting the key of the encrypted cipher service; the derived key of the encrypted password service is stored in a file system corresponding to the virtual password machine;

the method further comprises the steps of:

after deriving the key of the encrypted cryptographic service, the stored key of the cryptographic service is cleared.

17. The method of claim 15, wherein the method further comprises:

Acquiring a password operation request sent by a corresponding virtual password machine, wherein the password operation request carries data to be operated of a password application system of a virtual service machine;

Performing a cryptographic operation on the data to be operated by using a key of a cryptographic service to obtain a cryptographic operation result;

And feeding the password operation result back to the corresponding virtual password machine.

18. A storage medium storing computer instructions which, when executed, implement the cryptographic service management method of claim 10, or the cryptographic service management method of any one of claims 11-14, or the cryptographic service management method of any one of claims 15-17.

19. A computer program product comprising computer instructions which, when executed, implement the cryptographic service management method of claim 10, or the cryptographic service management method of any one of claims 11-14, or the cryptographic service management method of any one of claims 15-17.