A cryptographic operation method, comprising: receiving a cryptographic operation request initiated by a business system, the cryptographic operation request carrying data to be operated; determining a target security module responding to the cryptographic operation request, the target security module being one of a primary security module or at least one secondary security module, and wherein each of the primary security module and the at least one secondary security module independently generates its own master key; obtaining a working key ciphertext corresponding to the target security module, the working key ciphertext being obtained in the following way in advance: with a target public key generated by a secondary security module, among the at least one secondary security module, in advance as input, calling the primary security module to generate a working key for the business system, and obtaining the following returned by the primary security module: a working key ciphertext encrypted by a master key generated by the primary security module, and a working key ciphertext encrypted by the target public key of the secondary security module; with the working key ciphertext encrypted by the target public key of the secondary security module as input, calling the secondary security module to obtain the following returned by the secondary security module: a working key ciphertext encrypted by a master key generated by the secondary security module after decrypting the input working key ciphertext with a target private key; and with the working key ciphertext and the data to be operated as input, calling the target security module to obtain an operation result returned by the target security module and send the operation result to the business system, the operation result being obtained in a way that the target security module uses the stored master key to decrypt the working key ciphertext to obtain a working key, and then the data to be operated is encrypted with the working key obtained by decryption. receiving a cryptographic operation request initiated by a business system, the cryptographic operation request carrying data to be operated; determining a target security module responding to the cryptographic operation request, the target security module being one of a primary security module or at least one secondary security module, and wherein each of the primary security module and the at least one secondary security module independently generates its own master key; obtaining a working key ciphertext corresponding to the target security module, the working key ciphertext being obtained in the following way in advance: with a target public key generated by a secondary security module, among the at least one secondary security module, in advance as input, calling the primary security module to generate a working key for the business system, and obtaining the following returned by the primary security module: a working key ciphertext encrypted by a master key generated by the primary security module, and a working key ciphertext encrypted by the target public key of the secondary security module; with the working key ciphertext encrypted by the target public key of the secondary security module as input, calling the secondary security module to obtain the following returned by the secondary security module: a working key ciphertext encrypted by a master key generated by the secondary security module after decrypting the input working key ciphertext with a target private key; and with the working key ciphertext and the data to be operated as input, calling the target security module to obtain an operation result returned by the target security module and send the operation result to the business system, the operation result being obtained in a way that the target security module uses the stored master key to decrypt the working key ciphertext to obtain a working key, and then the data to be operated is encrypted with the working key obtained by decryption. with a target public key generated by a secondary security module, among the at least one secondary security module, in advance as input, calling the primary security module to generate a working key for the business system, and obtaining the following returned by the primary security module: a working key ciphertext encrypted by a master key generated by the primary security module, and a working key ciphertext encrypted by the target public key of the secondary security module; with the working key ciphertext encrypted by the target public key of the secondary security module as input, calling the secondary security module to obtain the following returned by the secondary security module: a working key ciphertext encrypted by a master key generated by the secondary security module after decrypting the input working key ciphertext with a target private key; and with the working key ciphertext and the data to be operated as input, calling the target security module to obtain an operation result returned by the target security module and send the operation result to the business system, the operation result being obtained in a way that the target security module uses the stored master key to decrypt the working key ciphertext to obtain a working key, and then the data to be operated is encrypted with the working key obtained by decryption.