Recently, Guotai Haitong Securities, SmartX, Hygon, and Koal Software jointly launched a solution for building a cryptographic enterprise cloud. Based on the existing HCT (Hygon Cryptographic Technology) high-availability (HA) solution, this joint solution can meet higher enterprise demands for cryptographic compliance, commercial cryptography renovation, and cloud-based workload security.
The solution combines the high-availability infrastructure capabilities of SmartX ECP, the chip-native cryptographic capabilities of Hygon CPUs, and Koal Software’s cryptographic service platform. It enables users in critical industries, including finance, government, healthcare, and energy, to rapidly build an integrated cloud platform featuring centralized key management, local hardware-based cryptographic processing, and high-availability protection.
This enables organizations to meet commercial cryptography compliance requirements while delivering high-performance, highly available, scalable, and auditable cryptographic services for business systems.
The initiative draws on practical exploration conducted by Guotai Haitong Securities in commercial financial cryptography.
Launching Background
As digital transformation accelerates, more business systems are migrating to cloud platforms. However, traditional deployments of cryptographic solutions center on standalone devices, which are increasingly showing their limitations in cloud environments, including complex network paths, centralized cryptographic processing bottlenecks, low resource utilization, siloed operations and management, high expansion costs, and limited HA capabilities. These constraints make it difficult to meet the performance, elasticity, and continuity requirements of cloud-based workloads.
To address these challenges, Guotai Haitong Securities, SmartX, Hygon, and Koal Software have jointly developed a cryptographic solution for enterprise clouds. Based on Guotai Haitong’s business scenarios, the solution leverages SMTX OS to build a high-performance, highly available, and scalable IaaS foundation. The built-in cryptographic acceleration (HCT-CAE) and trusted key management (HCT-TKM) capabilities of Hygon CPUs are securely passed through to business VMs, while Koal Software’s cryptographic service platform is deployed as an ECP cluster with HA protection.
This enables unified management and governance of cryptographic services, helping users build a cryptograph-enabled enterprise cloud that integrates cloud IaaS, cryptographic service governance, native chip-level cryptographic capabilities, and local cryptographic computing close to business workloads.
Solution Details
The joint solution is built around three core pillars: chip-native cryptographic capabilities, centralized key management, and node-local cryptographic processing.
It delivers an innovative architecture that combines centralized key management with distributed cryptographic processing on local HCT, achieving compliance while delivering high-performance, highly available cryptographic services.
- Hardware Layer: The solution is built on HCT-enabled servers powered by Hygon processors. Each physical node provides HCT capabilities, enabling hardware acceleration and security isolation for higher-layer cryptographic services while leveraging the CPUs’ built-in cryptographic coprocessor (CCP) and TKM capabilities.
- Cloud Platform Layer: Centered on SmartX ECP, this layer builds an HA resource pool that hosts both business systems and Koal Software’s cryptographic service platform. It also securely passes HCT capabilities through to the service platform and business VMs.
- Cryptographic Service Layer: Centered on Koal Software’s cryptographic service platform, this layer is deployed in a HA cluster to manage keys throughout their lifecycle and provide centralized governance of cryptographic services. It provides business systems with encryption and decryption, digital signing and verification, timestamping, key management, SSL offload using China’s commercial cryptography algorithms, certificate services, random-number generation, and related functions.
- Business Application Layer: Business systems not running on SmartX ECP can connect directly to the cryptographic service platform through APIs. Systems and VMs running on the platform can either invoke standard cryptographic services through APIs or use keys provisioned or authorized by the service platform to perform distributed hardware-accelerated encryption and decryption, SSL offload, and related operations on local HCT.
The joint solution architecture
Solution Value
- Commercial Cryptography Compliance: Deploying the cryptographic service platform within the cloud environment enables lifecycle key management and centralized governance of cryptographic services. The solution helps organizations meet commercial cryptography security compliance requirements for key management, cryptographic service invocation, audit logging, and administrative controls.
- High-Performance Cryptographic Services: The solution runs high-frequency cryptographic services on local HCT at each node, keeping processing close to workloads. This reduces remote cryptographic service calls and network transmission overhead and significantly improves performance for data encryption and decryption, link encryption, SSL offload, and east-west traffic protection.
- High Availability for Business Continuity: The solution extends HA across the cryptographic service platform, cloud platform, and chip-level cryptographic layer. Koal Software’s platform provides control-plane HA, while SmartX ECP delivers node-level HA, resource scheduling, and cross-node migration. Hygon HCT capabilities remain available when a node fails or a workload is migrated, avoiding single-point bottlenecks and ensuring continuous business operations.
- Elastic Scalability: As business nodes are added, Hygon HCT’s chip-level cryptographic processing capacity scales with compute resources. Cryptographic service capacity and cloud platform resources can therefore scale together, supporting distributed architectures and providing stable capacity for continued business growth.
Conclusion
To date, the joint solution has been deployed for a mission-critical workload at Guotai Haitong Securities. It has helped the firm meet commercial cryptography application security compliance requirements while improving cryptographic service performance and business continuity in high-concurrency, low-latency scenarios.
Looking ahead, SmartX will continue partnering with Guotai Haitong Securities, Hygon and Koal Software to drive joint solution innovation and accumulate industry best practices.
More Resources
SmartX & Hygon Debut Joint Solution for Chip-Native Encryption and Virtualization HA
Unveiling SmartX ECP 6.3 Upgrades in Availability: Expanding HA to SR-IOV, vGPU, and HCT-Enabled VMs
