Abstract: The CaaS ( cryptography as a service ) is a hotspot in cryptography research. Different form traditional solution, we must support implements cryptography in virtualization environment and cloud architecture with a virtualization boundary, we must implements the features such as  horizontal exptend, flexible computing,resource sharing and on-demand service. So,we usually design crypto computing resource pool to implements cryptographic functions, through pooled cryptographic computing,resource sharing,resource scheduling and key management,resource management,operation and maintenance provide cryptographic ability for cloud architecture business system,this is the essential about CaaS.In this paper,we analyze unikernel operation system technology,cpu secure enhance technology and para- virtualization technology in recently years,propose a new design about design large-scale cryptographic computing resource pool.It use cpu secure enhance technology and unikernel implements large-scale crypto-ablity supporting,use para-virtualization implements virtual-crypto-moudle, use unikernel implents crpto-ablity encapsulation、arrange and cascade in virtualization environment.

Key words: Cloud Computing, Cryptography, Virtualization, Cryptographic Computing Resouce Pool , Cloud-based cryptographic service

摘要： 云密码服务是近年来密码学研究和产业发展的热点，与传统密码方案不同，云密码服务需要支持在虚拟化环境、云架构系统、虚拟化边界中使用，同时需要满足云计算的易于水平扩展、弹性计算、资源共享、按需服务的要求。而传统密码设备的静态部署、静态配置的方式显然无法满足这样的要求。因此在云密码服务中，通常设计密码计算资源池实现密码功能，通过密码计算能力池化、共享、调度以及配套的密钥管理、密码资源管理、运营维护等机制为云架构的应用系统提供密码能力支撑，这也是是云密码服务研究的关键。本文分析了近年来微内核操作系统、CPU安全增强技术、基于virtio的半虚拟化技术等多种新技术在密码方面的应用场景，提出了一种构建大型密码计算资源池的云密码服务技术新思路，借助CPU安全技术和微内核操作系统实现软件密码计算单元以实现大规模、易于水平扩展的密码计算能力供应，借助半虚拟化实现虚拟密码模块，将密码资源池的能力映射到虚拟空间，最后借助微内核操作系统技术，实现虚拟化环境中密码能力的封装、编排与串接。

关键词: 云计算, 密码技术, 虚拟化, 密码计算资源池, 云密码服务