Softhsm储存安全数据性能整理

目标：存储百万条数据对象

测试方案一：总大小2GB，每个数据对象大小约512KB，总条数4096条；

测试方案一：总大小2GB，每个数据对象大小约256B，总条数8388608条；

测试环境：启动SQLite3

配置CMakeLists.txt，打开所有SQLite3相关宏开关

option(WITH_OBJECTSTORE_BACKEND_DB "Build with object store backend database (SQLite3)" ON)
option(WITH_MIGRATE "Build migration tool. Requires SQLit3." ON)
set(DEFAULT_OBJECTSTORE_BACKEND "db" CACHE STRING "Default storage backend for token objects")

修改配置文件，原始文件为softhms/src/lib/common/softhsm2.conf.5.in，构建完成后位于/etc/softhsm.conf，默认file改为db

directories.tokendir = @softhsmtokendir@
objectstore.backend = db
objectstore.umask = 0077

至此创建的token和各类对象将存储到配置路径下的sqlite3.db中

测试脚本：write_objects.sh

#!/bin/bash# SoftHSM 配置
SOFTHSM_MODULE="/home/ubuntu/Documents/HSM/20250106/SoftHSMv2_bgk/build/src/lib/libsofthsm2.so"  # SoftHSM 模块路径
TOKEN_DIR="/var/lib/softhsm/tokens/"              # Token 目录
SLOT=0                                           # Slot 编号
PIN="1234"                                       # Token PIN
LABEL_PREFIX="DataObject"                        # 数据对象标签前缀
DATA_SIZE=64                                     # 每个数据对象的大小（字节）# 检查 SoftHSM 模块是否存在
if [ ! -f "$SOFTHSM_MODULE" ]; thenecho "SoftHSM 模块未找到: $SOFTHSM_MODULE"exit 1
fi# 检查 Token 目录是否存在
if [ ! -d "$TOKEN_DIR" ]; thenecho "Token 目录未找到: $TOKEN_DIR"exit 1
fi# 初始化计数器
COUNTER=1
MAX_COUNT=10# 循环写入数据对象
while [ $COUNTER -le $MAX_COUNT ]; do# 生成随机数据DATA=$(openssl rand -hex $DATA_SIZE)# 生成唯一的标签和 IDLABEL="${LABEL_PREFIX}_${COUNTER}"ID=$(printf "%04x" $COUNTER)# 写入数据对象echo "$DATA" > /tmp/data.binSTART_TIME=$(date +%s%3N)./pkcs11-tool --module "$SOFTHSM_MODULE" --login --pin "$PIN" --write-object /tmp/data.bin --type data --id "$ID" --label "$LABEL"END_TIME=$(date +%s%3N)DIFF=$((END_TIME - START_TIME))DIFF=$((END_TIME - START_TIME))if [ $DIFF -lt 0 ]; thenDIFF=$((START_TIME - END_TIME))fiecho "Execute Time: ${DIFF} ms"# 检查是否成功if [ $? -eq 0 ]; thenecho "已写入数据对象: ID=$ID, 标签=$LABEL"elseecho "写入数据对象失败: ID=$ID, 标签=$LABEL"exit 1fi# 增加计数器COUNTER=$((COUNTER + 1))
doneecho "已完成写入 $MAX_COUNT 个数据对象。"

测试性能（数据块大小512KB，初始数据库为空，连续存入100次，性能衰减非常严重）：

Created Data Object:
Data object 2label:          'DataObject_1'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=426447c3de082349;token=SQLite3Token;object=DataObject_1;type=data
Execute Time: 15 ms
已写入数据对象: ID=0001, 标签=DataObject_1
Created Data Object:
Data object 2label:          'DataObject_2'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=426447c3de082349;token=SQLite3Token;object=DataObject_2;type=data
Execute Time: 17 ms
已写入数据对象: ID=0002, 标签=DataObject_2
Created Data Object:
Data object 2label:          'DataObject_3'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=426447c3de082349;token=SQLite3Token;object=DataObject_3;type=data
Execute Time: 17 ms
已写入数据对象: ID=0003, 标签=DataObject_3
...
...
...
Created Data Object:
Data object 2label:          'DataObject_98'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=426447c3de082349;token=SQLite3Token;object=DataObject_98;type=data
Execute Time: 224 ms
已写入数据对象: ID=0062, 标签=DataObject_98
Created Data Object:
Data object 2label:          'DataObject_99'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=426447c3de082349;token=SQLite3Token;object=DataObject_99;type=data
Execute Time: 233 ms
已写入数据对象: ID=0063, 标签=DataObject_99
Created Data Object:
Data object 2label:          'DataObject_100'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=426447c3de082349;token=SQLite3Token;object=DataObject_100;type=data
Execute Time: 216 ms
已写入数据对象: ID=0064, 标签=DataObject_100
已完成写入 100 个数据对象。

测试性能（数据块大小256Bytes，初始数据库为空，连续存入100次，性能衰减不明显）：

Created Data Object:
Data object 2label:          'DataObject_1'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=b53fedf69561dfeb;token=SQLite3Token;object=DataObject_1;type=data
Execute Time: 15 ms
已写入数据对象: ID=0001, 标签=DataObject_1
Using slot 0 with a present token (0x1561dfeb)
Created Data Object:
Data object 2label:          'DataObject_2'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=b53fedf69561dfeb;token=SQLite3Token;object=DataObject_2;type=data
Execute Time: 14 ms
已写入数据对象: ID=0002, 标签=DataObject_2
Using slot 0 with a present token (0x1561dfeb)
Created Data Object:
Data object 2label:          'DataObject_3'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=b53fedf69561dfeb;token=SQLite3Token;object=DataObject_3;type=data
Execute Time: 14 ms
已写入数据对象: ID=0003, 标签=DataObject_3
...
...
...
Created Data Object:
Data object 2label:          'DataObject_998'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=b53fedf69561dfeb;token=SQLite3Token;object=DataObject_998;type=data
Execute Time: 18 ms
已写入数据对象: ID=03e6, 标签=DataObject_998
Using slot 0 with a present token (0x1561dfeb)
Created Data Object:
Data object 2label:          'DataObject_999'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=b53fedf69561dfeb;token=SQLite3Token;object=DataObject_999;type=data
Execute Time: 15 ms
已写入数据对象: ID=03e7, 标签=DataObject_999
Using slot 0 with a present token (0x1561dfeb)
Created Data Object:
Data object 2label:          'DataObject_1000'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=b53fedf69561dfeb;token=SQLite3Token;object=DataObject_1000;type=data
Execute Time: 16 ms
已写入数据对象: ID=03e8, 标签=DataObject_1000
已完成写入 1000 个数据对象。

交叉测试（构造初始数据库为200MB，再存入小数据块，测试存储性能）：

Using slot 0 with a present token (0x47b89b8b)
Created Data Object:
Data object 2label:          'DataObject_1'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=4c32252ac7b89b8b;token=SQLite3Token;object=DataObject_1;type=data
Execute Time: 64 ms
已写入数据对象: ID=0001, 标签=DataObject_1
Using slot 0 with a present token (0x47b89b8b)
Created Data Object:
Data object 2label:          'DataObject_2'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=4c32252ac7b89b8b;token=SQLite3Token;object=DataObject_2;type=data
Execute Time: 82 ms
已写入数据对象: ID=0002, 标签=DataObject_2
...
...
...
Using slot 0 with a present token (0x47b89b8b)
Created Data Object:
Data object 2label:          'DataObject_19'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=4c32252ac7b89b8b;token=SQLite3Token;object=DataObject_19;type=data
Execute Time: 594 ms
已写入数据对象: ID=0013, 标签=DataObject_19
Using slot 0 with a present token (0x47b89b8b)
Created Data Object:
Data object 2label:          'DataObject_20'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=4c32252ac7b89b8b;token=SQLite3Token;object=DataObject_20;type=data
Execute Time: 627 ms
已写入数据对象: ID=0014, 标签=DataObject_20
已完成写入 20 个数据对象。

前置条件：构造10MB数据块，连续存入20次，获得196MB的初始数据库大小

ubuntu@ubuntu-vm:/var/lib/softhsm/tokens/30378c01-c782-32c2-4c32-252ac7b89b8b$ ls -lh
total 196M
-rw------- 1 ubuntu ubuntu 196M  2月 11 17:28 sqlite3.db
ubuntu@ubuntu-vm:/var/lib/softhsm/tokens/30378c01-c782-32c2-4c32-252ac7b89b8b$

测试性能（构造初始数据库为196MB，数据块大小256Bytes，连续存入3次，性能衰减明显）：

Using slot 0 with a present token (0x47b89b8b)
Created Data Object:
Data object 2label:          'DataObject_1'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=4c32252ac7b89b8b;token=SQLite3Token;object=DataObject_1;type=data
Execute Time: 607 ms
已写入数据对象: ID=0001, 标签=DataObject_1
Using slot 0 with a present token (0x47b89b8b)
Created Data Object:
Data object 2label:          'DataObject_2'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=4c32252ac7b89b8b;token=SQLite3Token;object=DataObject_2;type=data
Execute Time: 607 ms
已写入数据对象: ID=0002, 标签=DataObject_2
Using slot 0 with a present token (0x47b89b8b)
Created Data Object:
Data object 2label:          'DataObject_3'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=4c32252ac7b89b8b;token=SQLite3Token;object=DataObject_3;type=data
Execute Time: 596 ms
已写入数据对象: ID=0003, 标签=DataObject_3
已完成写入 3 个数据对象。

测试脚本：read_objects.sh

#!/bin/bash# SoftHSM 配置
SOFTHSM_MODULE="/home/ubuntu/Documents/HSM/20250106/SoftHSMv2_bgk/build/src/lib/libsofthsm2.so"  # SoftHSM 模块路径
TOKEN_DIR="/var/lib/softhsm/tokens/"              # Token 目录
SLOT=0                                           # Slot 编号
PIN="1234"                                       # Token PIN
LABEL_PREFIX="DataObject"                        # 数据对象标签前缀
DATA_SIZE=128                                # 每个数据对象的大小（字节）# 检查 SoftHSM 模块是否存在
if [ ! -f "$SOFTHSM_MODULE" ]; thenecho "SoftHSM 模块未找到: $SOFTHSM_MODULE"exit 1
fi# 检查 Token 目录是否存在
if [ ! -d "$TOKEN_DIR" ]; thenecho "Token 目录未找到: $TOKEN_DIR"exit 1
fi# 初始化计数器
COUNTER=1
MAX_COUNT=1# 循环写入数据对象
while [ $COUNTER -le $MAX_COUNT ]; do# 生成随机数据# DATA=$(openssl rand -hex $DATA_SIZE)# 生成唯一的标签和 ID# LABEL="${LABEL_PREFIX}_${COUNTER}"# ID=$(printf "%04x" $COUNTER)# 写入数据对象# echo "$DATA" > /tmp/data.binSTART_TIME=$(date +%s%3N)./pkcs11-tool --module "$SOFTHSM_MODULE" --login --pin "$PIN" --read-object --type data --label "DataObject_1" > /dev/nullEND_TIME=$(date +%s%3N)DIFF=$((END_TIME - START_TIME))DIFF=$((END_TIME - START_TIME))if [ $DIFF -lt 0 ]; thenDIFF=$((START_TIME - END_TIME))fiecho "Execute Time: ${DIFF} ms"# 检查是否成功if [ $? -eq 0 ]; thenecho "read数据对象: ID=$ID, 标签=$LABEL"elseecho "read数据对象失败: ID=$ID, 标签=$LABEL"exit 1fi# 增加计数器COUNTER=$((COUNTER + 1))
doneecho "已完成read $MAX_COUNT 个数据对象。"

读安全数据的性能（基于以上已有的196MB的数据库，读取小的数据块，128-256Bytes）：

ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$ ./read_objects.sh 
Using slot 0 with a present token (0x47b89b8b)
e4d4dac6f0903e57f7cf925cbb8ad5980452e60358311ac1b139b880d16ba8a96f65dce59ec21cab8658daf567374e10302815253998afe3c606e3c41decc7d6dc4008030dfa15c1d1e356443c43166d17a280ad1e4324d203b0f893f634750838a79cec18bf88bc9ec87867d86bf67a7d8c9d36a223839bbbb92704acd558ee
Execute Time: 1067 ms
read数据对象: ID=, 标签=
已完成read 1 个数据对象。
ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$ ./read_objects.sh 
Using slot 0 with a present token (0x47b89b8b)
e4d4dac6f0903e57f7cf925cbb8ad5980452e60358311ac1b139b880d16ba8a96f65dce59ec21cab8658daf567374e10302815253998afe3c606e3c41decc7d6dc4008030dfa15c1d1e356443c43166d17a280ad1e4324d203b0f893f634750838a79cec18bf88bc9ec87867d86bf67a7d8c9d36a223839bbbb92704acd558ee
Execute Time: 1064 ms
read数据对象: ID=, 标签=
已完成read 1 个数据对象。
ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$ ./read_objects.sh 
Using slot 0 with a present token (0x47b89b8b)
e4d4dac6f0903e57f7cf925cbb8ad5980452e60358311ac1b139b880d16ba8a96f65dce59ec21cab8658daf567374e10302815253998afe3c606e3c41decc7d6dc4008030dfa15c1d1e356443c43166d17a280ad1e4324d203b0f893f634750838a79cec18bf88bc9ec87867d86bf67a7d8c9d36a223839bbbb92704acd558ee
Execute Time: 1061 ms
read数据对象: ID=, 标签=
已完成read 1 个数据对象。

结论：Softhsm使用数据库SQLite3存储数据对象的性能与sqlite3.db数据库的大小成反比，与数据条目数量不敏感，不符合数据库插入数据时间相对恒定的规律。

测试环境二：使用本地文件存储形式

option(WITH_OBJECTSTORE_BACKEND_DB "Build with object store backend database (SQLite3)" ON)
option(WITH_MIGRATE "Build migration tool. Requires SQLit3." ON)
set(DEFAULT_OBJECTSTORE_BACKEND "file" CACHE STRING "Default storage backend for token objects")

directories.tokendir = @softhsmtokendir@
objectstore.backend = file
objectstore.umask = 0077

测试性能（构造10MB数据块，连续存入20次，性能衰减不明显）：

Using slot 0 with a present token (0x3bacd06c)
Created Data Object:
Data object 2label:          'DataObject_1'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=f0691d4b3bacd06c;token=FileToken;object=DataObject_SMALL_1;type=data
Execute Time: 47 ms
已写入数据对象: ID=0001, 标签=DataObject_1
Using slot 0 with a present token (0x3bacd06c)
Created Data Object:
Data object 2label:          'DataObject_SMALL_2'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=f0691d4b3bacd06c;token=FileToken;object=DataObject_SMALL_2;type=data
Execute Time: 66 ms
已写入数据对象: ID=0002, 标签=DataObject_2
...
...
...
Using slot 0 with a present token (0x3bacd06c)
Created Data Object:
Data object 2label:          'DataObject_SMALL_19'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=f0691d4b3bacd06c;token=FileToken;object=DataObject_SMALL_19;type=data
Execute Time: 158 ms
已写入数据对象: ID=0013, 标签=DataObject_19
Using slot 0 with a present token (0x3bacd06c)
Created Data Object:
Data object 2label:          'DataObject_SMALL_20'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=f0691d4b3bacd06c;token=FileToken;object=DataObject_SMALL_20;type=data
Execute Time: 188 ms
已写入数据对象: ID=0014, 标签=DataObject_20
已完成写入 20 个数据对象。

前置条件：构造10MB数据块，连续存入20次，在token目录下获得20个数据块文件

测试性能（数据块大小256Bytes，存入3次，性能衰减不明显，存入时间>=历史存入时间）：

Using slot 0 with a present token (0x3bacd06c)
Created Data Object:
Data object 2label:          'DataObject_1'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=f0691d4b3bacd06c;token=FileToken;object=DataObject_1;type=data
Execute Time: 145 ms
已写入数据对象: ID=0001, 标签=DataObject_1
Using slot 0 with a present token (0x3bacd06c)
Created Data Object:
Data object 2label:          'DataObject_2'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=f0691d4b3bacd06c;token=FileToken;object=DataObject_2;type=data
Execute Time: 143 ms
已写入数据对象: ID=0002, 标签=DataObject_2
Using slot 0 with a present token (0x3bacd06c)
Created Data Object:
Data object 2label:          'DataObject_3'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=f0691d4b3bacd06c;token=FileToken;object=DataObject_3;type=data
Execute Time: 148 ms
已写入数据对象: ID=0003, 标签=DataObject_3
已完成写入 3 个数据对象。

测试性能（读一块数据，块大小5MBytes，读取性能良好）：

ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$ ./read_objects.sh 
Using slot 0 with a present token (0x2ed47981)
Execute Time: 146 ms
read数据对象: ID=, 标签=
已完成read 1 个数据对象。
ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$ 
ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$ ./read_objects.sh 
Using slot 0 with a present token (0x2ed47981)
Execute Time: 145 ms
read数据对象: ID=, 标签=
已完成read 1 个数据对象。
ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$

测试性能（清零token，块大小256Bytes，连续存入1000次，存入性能良好）：

Using slot 0 with a present token (0x37a524)
Created Data Object:
Data object 2label:          'DataObject_1'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=70e3fbdc8037a524;token=FileToken;object=DataObject_1;type=data
Execute Time: 7 ms
已写入数据对象: ID=0001, 标签=DataObject_1
Using slot 0 with a present token (0x37a524)
Created Data Object:
Data object 2label:          'DataObject_2'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=70e3fbdc8037a524;token=FileToken;object=DataObject_2;type=data
Execute Time: 7 ms
已写入数据对象: ID=0002, 标签=DataObject_2
...
...
...
Using slot 0 with a present token (0x37a524)
Created Data Object:
Data object 2label:          'DataObject_999'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=70e3fbdc8037a524;token=FileToken;object=DataObject_999;type=data
Execute Time: 65 ms
已写入数据对象: ID=03e7, 标签=DataObject_999
Using slot 0 with a present token (0x37a524)
Created Data Object:
Data object 2label:          'DataObject_1000'application:    ''app_id:         <empty>flags:           modifiableuri:            pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=70e3fbdc8037a524;token=FileToken;object=DataObject_1000;type=data
Execute Time: 70 ms
已写入数据对象: ID=03e8, 标签=DataObject_1000
已完成写入 1000 个数据对象。

测试性能（读一块数据大小256Bytes，读取性能不好）：

ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$ ./read_objects.sh 
Using slot 0 with a present token (0x37a524)
Execute Time: 2472 ms
read数据对象: ID=, 标签=
已完成read 1 个数据对象。
ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$ 
ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$ ./read_objects.sh 
Using slot 0 with a present token (0x37a524)
515ed5b327f7468aece868f8db398dc0607ed2d466adfdac066965e0b4bc6ab2210273e0fb4bdc380eb5d0c13d705815f7e5640952ef305b5228adb71077ba5bba576e6cc0b671e14fca598bc9a0bed0f817d66f0d7ee20cb07a2a2b66df7455b473c364621ebc89078563d88661b085bf853f623fefa2ed16088a30ddd1714a
Execute Time: 2440 ms
read数据对象: ID=, 标签=
已完成read 1 个数据对象。
ubuntu@ubuntu-vm:~/Documents/HSM/20250106/OpenSC/out/bin$

结论：Softhsm使用本地文件系统存储数据对象的写入性能较数据库有明显优势，读本地数据的性能和数据条目数量相关性强，条目数量大时读性能差。