Data interaction method and device for cryptographic algorithm, equipment and medium

Abstract

The invention relates to the technical field of information security, in particular to a data interaction method and device for a cryptographic algorithm, equipment and a medium, and the method comprises the steps: obtaining a cryptographic operation request through a JavaScript API module; converting a character string corresponding to the password operation request into a byte array by using a data conversion module; according to the byte array, a target commercial cryptographic algorithm of an algorithm module is used for processing, a data conversion module is used for converting an initial processing result into a hexadecimal processing result so that the hexadecimal processing result can be conveniently returned through a JavaScript API module, a cryptographic algorithm of the algorithm module and the data conversion module compile a C language into a code capable of being called by a JavaScript language through a WebAssembly technology, and the code can be called by the JavaScript language. And an API interface is provided through the JavaScript language, so that the performance loss of a service system can be reduced, and the stability of the system is kept.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data interaction method, device, equipment and medium for a cryptographic algorithm. Background Art

[0002] Cryptographic algorithms are the basis for ensuring network communication and data security. Cryptographic algorithms that comply with commercial cryptographic specifications, including SM2 (elliptic curve public key cryptographic algorithm), SM3 (cryptographic hash function), SM4 (block cipher algorithm), SM9 (identity-based cryptographic algorithm), ZUC (sequence cipher algorithm), etc., are required to meet the requirements of cryptographic evaluation and security protection. A large number of application systems adopt B / S architecture (Browser / Server mode). On the client side of the application system, cryptographic algorithms are used through JavaScript language to complete security measures such as data encryption, identity authentication, and integrity protection.

[0003] However, using cryptographic algorithms to enable data security in the above manner has the following disadvantages: using JavaScript language to implement commercial cryptographic algorithms results in large file size, long loading time, and slow execution speed. In addition, using JavaScript language for data conversion has a large performance loss, and the use of cryptographic algorithms in application integration will affect business system performance. Using JavaScript language to implement commercial cryptographic algorithms, since JavaScript code is public, attackers can view, modify, and debug the cryptographic algorithm source code and obtain intermediate data of cryptographic operations, which poses a security risk.

[0004] In order to solve the above problems, the relevant technology adopts commercial cryptographic algorithms and is implemented in C / C++. It uses browser plug-ins and proxy services to provide JavaScript language API (Application Programming Interface) calls for the application system. It requires the installation of independent browser plug-ins, and the application system integration experience is poor. Communication forwarding is required between the browser plug-in and the proxy service, which results in certain performance loss, affecting the performance of the business system and causing poor system stability.

[0005] Therefore, how to reduce the performance loss of the business system and maintain the stability of the system has become a technical problem that needs to be solved urgently by technical personnel in this field. Summary of the invention

[0006] The purpose of this application is to provide a data interaction method, device, equipment and medium for a cryptographic algorithm, which can reduce business system performance loss and maintain system stability.

[0007] In a first aspect, a data interaction method of a cryptographic algorithm is provided, comprising:

[0008] Obtaining a cryptographic operation request through a JavaScript API module, wherein the cryptographic operation request is used to instruct to perform a corresponding operation on target data using a target commercial cryptographic algorithm;

[0009] The character string corresponding to the cryptographic operation request is converted into a byte array by using a data conversion module, wherein the data conversion module is obtained by converting a data conversion code in a C language form into a data conversion code in a WebAssembly form through a WebAssembly module;

[0010] According to the byte array, the target data is processed using the target commercial cryptographic algorithm of the algorithm module to obtain an initial processing result, wherein the algorithm module is obtained by converting various cryptographic algorithm codes in C language form into cryptographic algorithm codes in WebAssembly form through the WebAssembly module;

[0011] Using the data conversion module to convert the initial processing result into a hexadecimal processing result;

[0012] The processing result is returned through the JavaScript API module.

[0013] In a preferred example, the present application may be further configured as follows: before using the data conversion module to convert the character string corresponding to the cryptographic operation request into a byte array, the application may further include:

[0014] Parsing the cryptographic operation request to obtain a character string, the character string including: an operation type, data to be processed, and an algorithm identifier;

[0015] determining whether the string is valid;

[0016] When the character string is valid, the data conversion module is used to convert the character string into a byte array.

[0017] In a preferred example, the present application can be further configured as follows: according to the byte array, the target commercial cryptographic algorithm of the algorithm module is used to process the target data to obtain an initial processing result, including:

[0018] Generate a calculation request according to the byte array;

[0019] According to the operation request, the target data is processed using the target commercial cryptographic algorithm of the algorithm module corresponding to the algorithm identifier to obtain an initial processing result.

[0020] In a preferred example, the present application can be further configured to obtain a cryptographic operation request through a JavaScript API module, including any of the following:

[0021] Obtain cryptographic operation requests initiated by the web browser through the JavaScript API module;

[0022] Get the cryptographic operation request initiated by the mini program through the JavaScript API module;

[0023] Get the cryptographic operation request initiated by HTML5 through the JavaScript API module.

[0024] In a preferred example, the present application can be further configured as follows:

[0025] Configure multiple pseudo functions corresponding to the JavaScript API module, where the pseudo functions are used to initiate cryptographic operation requests;

[0026] Use the WebAssembly module to convert the data conversion code in C language into the data conversion code in WebAssembly format to build a data conversion module;

[0027] The WebAssembly module is used to convert various cryptographic algorithm codes in C language into cryptographic algorithm codes in WebAssembly form to build a cryptographic algorithm module.

[0028] In a preferred example, the present application can be further configured as: each cryptographic algorithm conversion code in C language form includes at least one of the following:

[0029] SM2 conversion code in C language format, SM3 conversion code in C language format, SM4 conversion code in C language format, SM9 conversion code in C language format, and ZUC conversion code in C language format.

[0030] In a preferred example, the present application can be further configured as follows:

[0031] Get the task priority of the cryptographic operation request;

[0032] Target computing resources are allocated to the cryptographic operation request according to the task priority and the available computing resources in the computing resource pool.

[0033] In a second aspect, a data interaction device for a cryptographic algorithm is provided, comprising:

[0034] A data interaction module, used to obtain a cryptographic operation request through a JavaScript API module, wherein the cryptographic operation request is used to instruct to perform a corresponding operation on target data using a target commercial cryptographic algorithm;

[0035] A conversion module, used to convert the character string corresponding to the cryptographic operation request into a byte array by using a data conversion module, wherein the data conversion module is obtained by converting a data conversion code in a C language form into a data conversion code in a WebAssembly form by using a WebAssembly module;

[0036] A cryptographic operation module, used to process the target data according to the byte array using the target commercial cryptographic algorithm of the algorithm module to obtain an initial processing result, wherein the algorithm module is obtained by converting various cryptographic algorithm codes in C language form into cryptographic algorithm codes in WebAssembly form through the WebAssembly module;

[0037] The conversion module is further used to convert the initial processing result into a hexadecimal processing result by using the data conversion module;

[0038] The data interaction module is also used to return the processing result through the JavaScript API module.

[0039] In a third aspect, an electronic device is provided, including:

[0040] one or more processors;

[0041] Memory;

[0042] One or more applications, wherein one or more applications are stored in a memory and configured to be executed by one or more processors, and one or more programs are configured to: perform operations corresponding to the method shown in any possible implementation of the first aspect.

[0043] In a fourth aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded by a processor and executes the steps of the method shown in any possible implementation of the first aspect.

[0044] In a fifth aspect, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, operations corresponding to the method shown in any possible implementation manner in the first aspect are implemented.

[0045] In summary, the method provided by this application includes the following beneficial technical effects:

[0046] This application obtains a cryptographic operation request through a JavaScript API module; uses a data conversion module to convert the string corresponding to the cryptographic operation request into a byte array; uses the target commercial cryptographic algorithm of the algorithm module to process the target data according to the byte array to obtain an initial processing result; uses the data conversion module to convert the initial processing result into a hexadecimal processing result; and returns the processing result through a JavaScript API module. Among them, the cryptographic algorithm and data conversion module of the algorithm module are implemented using C / C++, hiding the implementation details of the cryptographic algorithm to prevent debugging and modification, avoiding the acquisition of intermediate data of cryptographic operations, and reducing security risks. Through WebAssembly technology, the C / C++ source code is compiled into glue code that can be called by the JavaScript language, and an API interface is provided through the JavaScript language. There is no need to install a plug-in. Compared with the related technology that requires communication forwarding between the browser plug-in and the proxy service, the system stability is higher, and the WebAssembly file size is small, which can reduce the performance loss of the business system.

[0047] In addition, the present application also provides a data interaction device, equipment and medium for a cryptographic algorithm, all of which have the above-mentioned beneficial technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions of the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 A schematic diagram of a scenario for applying a data interaction method for a cryptographic algorithm provided in an embodiment of the present application;

[0050] Figure 2 This is a flow chart of a data interaction method of a cryptographic algorithm provided in an embodiment of the present application;

[0051] Figure 3 This is a schematic diagram of an architecture provided by an embodiment of the present application;

[0052] Figure 4 It is a structural diagram of a data interaction device of a cryptographic algorithm provided in an embodiment of the present application;

[0053] Figure 5 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, a person skilled in the art may make non-creative modifications to the present embodiment as needed, but such modifications are protected by the patent law as long as they are within the scope of the present application.

[0055] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0056] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0057] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0058] At present, in environments such as Web browsers, applets (including: Alipay, WeChat, Baidu and other applets), HTML5 applications, etc., cryptographic algorithms are used to empower data. Commercial cryptographic algorithms are implemented in C / C++, and browser plug-ins plus proxy services are used to provide JavaScript language API calls for application systems. Independent browser plug-ins need to be installed, and the application system integration experience is poor. The browser and proxy service communication forwarding results in certain performance losses, which affects the performance of the business system. Forwarding will also affect the stability of the system.

[0059] In order to solve the above problems, an embodiment of the present application is a data interaction method of a cryptographic algorithm based on WebAssembly provided by an identification system. The data interaction method of the cryptographic algorithm involves the field of information security, and in particular, involves implementation scenarios of commercial cryptographic algorithms such as Web browsers, applets (including: Alipay, WeChat, Baidu, etc. applets), and HTML5.

[0060] In order to better understand and illustrate the solutions of the embodiments of the present application, some technical terms involved in the embodiments of the present application are briefly explained below.

[0061] WebAssembly (Wasm for short) is a binary instruction set format for the Web. It provides an efficient, secure and portable runtime environment that enables programs written in low-level source languages ​​​​such as C, C++ and Rust to run at speeds close to native applications after compilation.

[0062] C language is a widely used computer programming language. Known for its efficiency, flexibility and portability, C language has become the preferred programming language for many system-level software and applications.

[0063] Commercial cryptographic algorithms refer to technologies that can realize the encryption, decryption and authentication functions of commercial cryptographic algorithms. These technologies include cryptographic algorithm programming technology and implementation technology of cryptographic algorithm chips and encryption cards. SM2 is a public key cryptographic algorithm based on elliptic curves. It is used to replace the RSA algorithm in commercial cryptographic systems. It supports digital signatures, key exchange and encryption. SM3 is a cryptographic hash function standard, which is mainly used for digital signatures and verification, message authentication code generation and verification, random number generation, etc. It is a basic technology for information security in the fields of electronic signature cryptographic systems, computer security login systems, computer security communication systems, digital certificates, network security infrastructure, secure cloud computing platforms and big data. SM4 is a block algorithm with a block length and key length of 128 bits. The encryption algorithm and key expansion algorithm both use a 32-round nonlinear iterative structure. SM9 is an identification cryptographic algorithm, which is suitable for the security and confidentiality of various emerging applications of Internet applications, such as cloud-based cryptographic services, email security, smart terminal protection, Internet of Things security, cloud storage security, etc. ZUC is a stream cipher algorithm that uses a structure that combines a nonlinear feedback shift register (NFSR) and a linear feedback shift register (LFSR). Through complex nonlinear and linear operations, it generates a key stream with high randomness and unpredictability. This structure makes the ZUC algorithm highly secure.

[0064] In order to better understand the solution provided by the embodiment of the present application, in one embodiment, please refer to Figure 1 , Figure 1A schematic diagram of a scenario for the application of a data interaction method for a cryptographic algorithm provided in an embodiment of the present application, wherein the data interaction method for the cryptographic algorithm can be applied to a data interaction system for a cryptographic algorithm based on WebAssembly, wherein the data supervision system includes an electronic device and a terminal device, wherein the terminal device can initiate a cryptographic operation request and obtain a processing result corresponding to the request. Among them, the terminal device includes but is not limited to: mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), mobile terminals such as vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, and the like. The electronic device can implement the data interaction method for the cryptographic algorithm, wherein the electronic device can be a smart password key.

[0065] The terminal device provides a user interface for the Web application, where the user can enter or select target data and select the target commercial cryptographic algorithm and corresponding operation to be used. The electronic device provides the background logic of the Web application. When the user triggers a cryptographic operation, the action of the user interface will be passed to the background logic for processing. After the processing is completed, the result will be returned to the user interface for display or further processing.

[0066] It is understandable that the above is only an example and is not limited to this embodiment.

[0067] The present application embodiment provides a data interaction method of a cryptographic algorithm, such as Figure 2 As shown, the method provided in the embodiment of the present application can be executed by an electronic device, and the method includes: S101-S105, wherein:

[0068] S101, obtaining a cryptographic operation request through a JavaScript API module, where the cryptographic operation request is used to instruct to perform a corresponding operation on target data using a target commercial cryptographic algorithm;

[0069] The JavaScript API module represents a collection of application program interfaces written in JavaScript, which allow developers to interact with the underlying layer.

[0070] The cryptographic operation request is used to instruct encryption, decryption or other cryptography-related operations on specific data.

[0071] In the application environment, when a user needs to execute a cryptographic operation request (such as encrypting data for secure data transmission, or decrypting data to verify data integrity) through a client device equipped with a web browser, applet, or HTML5, the JavaScript API module will be called. The electronic device receives the cryptographic operation request from the client device through the JavaScript API module. The request contains the data to be processed (target data) and the algorithm to be used (target commercial cryptographic algorithm), as well as the specific operation type (such as key pair operation, encryption operation, decryption operation, signature operation, signature verification operation, summary operation, etc.). The electronic device can use the underlying cryptographic library to perform the corresponding cryptographic operation according to the content of the request. The cryptographic operation corresponding to the cryptographic operation request should be a commercial cryptographic operation, which includes but is not limited to: SM2, SM3, SM4, SM9, ZUC and other cryptographic operations.

[0072] Furthermore, because the use of cryptographic algorithms that comply with commercial cryptographic specifications, including SM2, SM3, SM4, SM9, ZUC and other cryptographic algorithms, can meet the requirements of secret evaluation and security protection; therefore, it is also necessary to verify whether the target commercial cryptographic algorithm corresponding to the cryptographic operation request is a cryptographic algorithm that complies with the commercial cryptographic specifications, and to ensure that the cryptographic algorithms used in electronic devices are based on commercial cryptographic specifications, providing standard algorithms such as SM2, SM3, SM4, SM9, ZUC, etc., to meet the compliance requirements of application system secret evaluation and security protection cryptographic algorithms.

[0073] Furthermore, obtaining cryptographic operation requests through the JavaScript API module includes any of the following: obtaining cryptographic operation requests initiated by a Web browser through the JavaScript API module; obtaining cryptographic operation requests initiated by a small program through the JavaScript API module; obtaining cryptographic operation requests initiated by HTML5 through the JavaScript API module. For application systems running in Web browsers, small programs, HTML5 applications, etc., algorithms such as SM2, SM3, SM4, SM9, and ZUC that comply with commercial cryptographic specifications are implemented, methods and systems that meet the requirements of application system cryptographic evaluation and compliance of security cryptographic algorithms are provided, and a systematic commercial cryptographic operation JavaScript API module is provided.

[0074] S102. Convert the character string corresponding to the cryptographic operation request into a byte array using a data conversion module, where the data conversion module is obtained by converting a data conversion code in a C language format into a data conversion code in a WebAssembly format using a WebAssembly module;

[0075] In the embodiment of the present application, the data conversion module is updated from the original JavaScript code to the C language data conversion code, hiding the implementation details of the cryptographic algorithm, preventing debugging and modification, avoiding the acquisition of the intermediate data of the cryptographic operation, and reducing security risks. At the same time, the WebAssembly module is used to convert the C language data conversion code into the WebAssembly form of data conversion code, so that the C / C++ source code can be compiled into a code that can be called by the JavaScript language through the WebAssembly technology, and the application system is provided with an API through the JavaScript language, providing the application system with commercial cryptographic algorithm capabilities in the operating environment of Web browsers, applets, HTML5 applications, etc., and the application does not need to install plug-ins, the application system has a good integration experience, and the system stability is high.

[0076] Since cryptographic algorithms generally require input and output data to be provided in a specific format (such as a byte array), in the embodiment of the present application, the character string and hexadecimal string corresponding to the cryptographic operation request input by the JavaScript API are converted into a byte array, and the converted byte array is used as a parameter to initiate a commercial cryptographic algorithm operation request, so as to perform a cryptographic operation based on the algorithm operation request.

[0077] S103. According to the byte array, the target data is processed using the target commercial cryptographic algorithm of the algorithm module to obtain an initial processing result, where the algorithm module is obtained by converting various cryptographic algorithm codes in the form of C language into cryptographic algorithm codes in the form of WebAssembly through the WebAssembly module;

[0078] In the embodiment of the present application, multiple commercial cryptographic algorithms of the algorithm module use cryptographic algorithm codes in the form of C language, hiding the implementation details of the cryptographic algorithm, preventing debugging and modification, avoiding the acquisition of intermediate data of cryptographic operations, and reducing security risks. The WebAssembly module is used to convert each cryptographic algorithm code in the form of C language into a cryptographic algorithm code in the form of WebAssembly. The application does not need to install plug-ins, the application system integration experience is better, and the system stability is higher.

[0079] The algorithm module includes multiple cryptographic algorithms, processes the target data according to the target commercial cryptographic algorithm in the request, and obtains an initial processing result, the data type of which is a byte array; and then performs conversion processing through step S104.

[0080] S104, using a data conversion module to convert the initial processing result into a hexadecimal processing result;

[0081] S105. Return the processing result through the JavaScript API module.

[0082] The initial processing result outputted by S103 is converted into hexadecimal string data and returned to the JavaScript API module; the JavaScript API module returns the processing result returned by process S104 to the application system to complete the commercial cryptographic operation.

[0083] In the embodiments of the present application, commercial cryptographic algorithms and data conversions are implemented using C / C++ to hide the implementation details of the cryptographic algorithms, prevent debugging and modification, avoid obtaining intermediate data of cryptographic operations, and reduce security risks; through WebAssembly technology, the C / C++ source code is compiled into glue code that can be called by JavaScript language, and an API is provided to the application system through JavaScript language to provide commercial cryptographic algorithm capabilities for the application system in operating environments such as Web browsers, applets, and HTML5 applications. The application does not need to install plug-ins, the application system integration experience is good, and the system stability is high; the commercial cryptographic algorithms and data conversions implemented using C / C++ source code through WebAssembly technology can be close to the execution speed of native code in operating environments such as Web browsers, applets, and HTML5 applications. Compared with JavaScript code, WebAssembly files are smaller in size, can provide faster loading time and execution performance, and the performance is improved by about 3 times, thereby improving the business performance of applications after integrating and using cryptographic algorithms.

[0084] It can be seen that in the embodiment of the present application, a cryptographic operation request is obtained through a JavaScript API module; a character string corresponding to the cryptographic operation request is converted into a byte array using a data conversion module; according to the byte array, the target data is processed using the target commercial cryptographic algorithm of the algorithm module to obtain an initial processing result; the initial processing result is converted into a hexadecimal processing result using a data conversion module; and the processing result is returned through a JavaScript API module. Among them, the cryptographic algorithm and data conversion module of the algorithm module are implemented using C / C++, hiding the implementation details of the cryptographic algorithm, preventing debugging and modification, avoiding the acquisition of intermediate data of cryptographic operations, and reducing security risks. Moreover, through WebAssembly technology, the C / C++ source code is compiled into glue code that can be called by the JavaScript language, and an API interface is provided through the JavaScript language, without the need to install a plug-in. Compared with the related technology that requires communication forwarding between the browser plug-in and the proxy service, the system stability is higher, and the WebAssembly file size is smaller, which can reduce the performance loss of the business system.

[0085] A possible implementation of the embodiment of the present application also includes:

[0086] Configure multiple pseudo functions corresponding to the JavaScript API module, which are used to initiate cryptographic operation requests;

[0087] Use the WebAssembly module to convert the data conversion code in C language into the data conversion code in WebAssembly format to build a data conversion module;

[0088] The WebAssembly module is used to convert various cryptographic algorithm codes in C language into cryptographic algorithm codes in WebAssembly form to build a cryptographic algorithm module.

[0089] For details, see Figure 3 The architecture provided in the embodiment of the present application mainly includes four modules:

[0090] JavaScript API module: Provides JavaScript APIs corresponding to commercial cryptographic algorithms SM2, SM3, SM4, SM9, and ZUC, processes requests and returns for commercial cryptographic operations, and provides commercial cryptographic algorithm capabilities for application systems in operating environments such as Web browsers, applets, and HTML5 applications.

[0091] WebAssembly module: The Emscripten compiler is used to compile and instantiate the C / C++ implementation codes of the data conversion module and the commercial cryptographic algorithm module into WebAssembly codes, which are then provided to the JavaScript API module for use.

[0092] Data conversion module: Through the data conversion module, the data type conversion between the JavaScript API module and the WebAssembly module is completed at the C / C++ language implementation layer, including: conversion between byte arrays, strings, and hexadecimal strings.

[0093] Commercial cryptographic algorithm module: According to the commercial cryptographic algorithm specification, the commercial cryptographic algorithm is implemented in C / C++ language. The conversion codes of each cryptographic algorithm in C language include at least one of the following: SM2 conversion code in C language, SM3 conversion code in C language, SM4 conversion code in C language, SM9 conversion code in C language, and ZUC conversion code in C language.

[0094] The API pseudo function definition is as follows:

[0095] A) The pseudo function for generating SM2 / SM9 key pair is defined as:

[0096] generateKeyPair(

[0097] name,

[0098] algorithm,

[0099] keyPair )

[0101] Input parameters:

[0102] name: key pair name.

[0103] algorithm: algorithm identifier, supports SM2 and SM9 algorithms.

[0104] Output parameters:

[0105] keyPair : Returns a key pair object.

[0106] B) The SM2 / SM9 encryption operation pseudo function is defined as:

[0107] asymEncrypt (

[0108] publicKey,

[0109] plainText,

[0110] cipherText )

[0112] Input parameters:

[0113] publicKey: public key object.

[0114] plainText: data to be encrypted.

[0115] Output parameters:

[0116] cipherText: The returned ciphertext data.

[0117] C) The SM2 / SM9 decryption operation pseudo function is defined as:

[0118] asymDecrypt (

[0119] privateKey,

[0120] cipherText,

[0121] plainText )

[0123] Input parameters:

[0124] privateKey: private key object.

[0125] cipherText: data to be decrypted.

[0126] Output parameters:

[0127] plainText: The returned plaintext data.

[0128] D) The SM2 / SM9 signature operation pseudo function is defined as:

[0129] sign(

[0130] privateKey,

[0131] data,

[0132] signature )

[0134] Input parameters:

[0135] publicKey: public key object.

[0136] data: data to be signed.

[0137] Output parameters:

[0138] signature: The returned signature value.

[0139] E) The SM2 / SM9 signature verification pseudo function is defined as:

[0140] verify(

[0141] publicKey,

[0142] data,

[0143] signature

[0144] Result )

[0146] Input parameters:

[0147] publicKey: public key object.

[0148] data: data whose signature is to be verified.

[0149] signature: The signature value of the signature to be verified.

[0150] Output parameters:

[0151] result: The result of signature verification.

[0152] F), the summary operation pseudo function is defined as:

[0153] digst(

[0154] algorithm,

[0155] publicKey,

[0156] data,

[0157] digstData )

[0159] Input parameters:

[0160] algorithm: algorithm identifier, supports SM3 and SM2 processing algorithms.

[0161] publicKey: public key object.

[0162] data: data to be digested.

[0163] Output parameters:

[0164] digstData: The returned digest operation result.

[0165] G), SM4 / ZUC encryption operation pseudo function is defined as:

[0166] symmEncrypt (

[0167] secretKey,

[0168] plainText,

[0169] cipherText )

[0171] Input parameters:

[0172] secretKey: secret key object.

[0173] plainText: data to be encrypted.

[0174] Output parameters:

[0175] cipherText: The returned ciphertext data.

[0176] H), SM4 / ZUC decryption operation pseudo function is defined as:

[0177] symmDecrypt (

[0178] secretKey,

[0179] cipherText,

[0180] plainText )

[0182] Input parameters:

[0183] secretKey: secret key object.

[0184] cipherText: data to be decrypted.

[0185] Output parameters:

[0186] plainText: The returned plaintext data.

[0187] Among them, the cryptographic algorithm and data conversion module of the algorithm module are implemented in C / C++, which hides the implementation details of the cryptographic algorithm, prevents debugging and modification, avoids the acquisition of intermediate data of cryptographic operations, and reduces security risks. Through WebAssembly technology, the C / C++ source code is compiled into glue code that can be called by JavaScript language, and an API interface is provided through JavaScript language. There is no need to install plug-ins. Compared with the related technology that requires communication forwarding between browser plug-ins and proxy services, the system stability is higher, and the WebAssembly file size is smaller, which can reduce the performance loss of the business system.

[0188] A possible implementation of the embodiment of the present application includes, before using the data conversion module to convert the character string corresponding to the cryptographic operation request into a byte array, further comprising:

[0189] Parse the cryptographic operation request to obtain a character string, which includes: operation type, data to be processed, and algorithm identifier;

[0190] Determine if the string is valid;

[0191] When the string is valid, the data conversion module is used to convert the string into a byte array.

[0192] In an embodiment of the present application, the cryptographic operation request is parsed, and the request can be split and interpreted to extract the key information therein as a string. The operation type in the string indicates the type of cryptographic operation, such as key pair operation, encryption operation, decryption operation, signature operation, signature verification operation, summary operation, etc. The data to be processed refers to the data that needs to be cryptographically operated, which may be plain text, ciphertext or a message to be signed. The algorithm identifier refers to the identifier of the target commercial cryptographic algorithm used to perform the cryptographic operation. The validity of the string is then determined to determine whether the request is compliant. The specific determination process includes at least one of the following: verifying whether the operation type is in the list supported by the target commercial cryptographic algorithm, whether the data to be processed meets specific format requirements (such as Base64 encoding), whether the algorithm identifier exists in the predefined algorithm list, whether the incoming string is empty, and whether the length of the incoming string is correct.

[0193] When it is determined that the string is valid, the data conversion module is used to convert the string into a byte array; when it is determined that the string is invalid, a warning message is generated and returned to prompt the user.

[0194] It can be seen that in the embodiment of the present application, the cryptographic operation request is parsed to extract key information, and the key information is combined into a character string, and the validity of the character string is checked to ensure the accuracy and completeness of the input information, and to screen out those requests that do not meet the requirements, thereby avoiding the execution of invalid cryptographic operations.

[0195] A possible implementation of the embodiment of the present application is to process the target data using the target commercial cryptographic algorithm of the algorithm module according to the byte array to obtain an initial processing result, including:

[0196] Generate operation request based on byte array;

[0197] According to the operation request, the target data is processed using the target commercial cryptographic algorithm of the algorithm module corresponding to the algorithm identifier to obtain an initial processing result.

[0198] The byte array is repackaged into an operation request that can control the algorithm module to perform algorithm processing; so that when the algorithm module receives the operation request, the target commercial encryption algorithm corresponding to the algorithm identifier of the algorithm module can process the target data to obtain an initial processing result.

[0199] A possible implementation of the embodiment of the present application also includes:

[0200] Get the task priority of the cryptographic operation request;

[0201] Target computing resources are allocated to cryptographic operation requests based on task priority and available computing resources in the computing resource pool.

[0202] A computing resource pool refers to a collection of multiple computing units. A computing unit can be a hardware resource such as a CPU, GPU, or FPGA, which is used to perform computing tasks such as cryptographic operations. Available computing resources refer to computing units that are not currently occupied in the computing resource pool and can be used to process new tasks. Target computing resources refer to specific computing units allocated to cryptographic operation requests based on task priority and available computing resources.

[0203] In cryptographic computing services, multiple requests may be received at the same time, and the priorities and required computing resources of these requests may be different. The electronic device allocates appropriate target computing resources to each request based on the priority and the available computing resources in the computing resource pool.

[0204] In some embodiments, after receiving a cryptographic operation request, the electronic device obtains the task priority; queries the available computing resources in the computing resource pool, including the number and status of various types of computing resources; and allocates target computing resources to the request based on the task priority and available computing resources.

[0205] By obtaining the task priority of the cryptographic operation request and allocating target computing resources to the request based on the priority and the available computing resources in the computing resource pool, the cryptographic operation service can process multiple requests more efficiently, ensuring that high-priority requests are processed first, while making full use of computing resources to improve resource utilization and service response speed.

[0206] In summary, the solution provided by the embodiments of the present application can solve the following technical problems:

[0207] According to commercial encryption specifications, standard algorithms such as SM2, SM3, SM4, SM9, and ZUC are provided to meet the requirements of application system encryption evaluation and security encryption algorithm compliance;

[0208] Commercial cryptographic algorithms and data conversion are implemented in C / C++, which hides the implementation details of cryptographic algorithms, prevents them from being debugged and modified, and prevents the intermediate data of cryptographic operations from being obtained, thus reducing security risks.

[0209] Through WebAssembly technology, C / C++ source code is compiled into glue code that can be called by JavaScript language. Through JavaScript language, API is provided to application system, providing commercial cryptographic algorithm capabilities for application system in operating environments such as Web browsers, applets, and HTML5 applications. Applications do not need to install plug-ins, and the application system integration experience is better and the system stability is higher.

[0210] Commercial cryptographic algorithms and data conversions implemented using C / C++ source code through WebAssembly technology can be executed at speeds close to native code in operating environments such as Web browsers, applets, and HTML5 applications. Compared with JavaScript code, WebAssembly files are smaller in size and can provide faster loading time and execution performance, with performance improved by about 3 times, thereby improving business performance after application integration using cryptographic algorithms.

[0211] The following is an introduction to a data interaction device for a cryptographic algorithm provided in an embodiment of the present application. The device described below and the method described above can be referred to each other. The device 200 of this embodiment is set in an electronic device. Figure 4 , Figure 4 It is a structural block diagram of a device of one embodiment of the present application, comprising:

[0212] The data interaction module 210 is used to obtain a cryptographic operation request through the JavaScript API module, where the cryptographic operation request is used to indicate that a corresponding operation is performed on the target data using a target commercial cryptographic algorithm;

[0213] The conversion module 220 is used to convert the character string corresponding to the cryptographic operation request into a byte array by using the data conversion module, where the data conversion module is obtained by converting the data conversion code in the C language form into the data conversion code in the WebAssembly form by using the WebAssembly module;

[0214] The cryptographic operation module 230 is used to process the target data according to the byte array using the target commercial cryptographic algorithm of the algorithm module to obtain an initial processing result, wherein the algorithm module is obtained by converting each cryptographic algorithm code in the C language form into a cryptographic algorithm code in the WebAssembly form through the WebAssembly module;

[0215] The conversion module 220 is further used to convert the initial processing result into a hexadecimal processing result using the data conversion module;

[0216] The data interaction module 210 is also used to return the processing result through the JavaScript API module.

[0217] In one achievable manner, the present invention further includes:

[0218] A parsing module is used to parse the cryptographic operation request to obtain a character string, which includes: operation type, data to be processed and algorithm identification;

[0219] The validity determination module is used to determine whether the string is valid; when the string is valid, the conversion module 220 is triggered so that the conversion module 220 executes the data conversion module to convert the string into a byte array.

[0220] In one achievable manner, the cryptographic operation module 230 is specifically used for:

[0221] Generate operation request based on byte array;

[0222] According to the operation request, the target data is processed using the target commercial cryptographic algorithm of the algorithm module corresponding to the algorithm identifier to obtain an initial processing result.

[0223] In one achievable manner, the data interaction module 210 is used to:

[0224] Obtain cryptographic operation requests initiated by the web browser through the JavaScript API module;

[0225] Get the cryptographic operation request initiated by the mini program through the JavaScript API module;

[0226] Get the cryptographic operation request initiated by HTML5 through the JavaScript API module.

[0227] In one achievable manner, the present invention further includes:

[0228] Configuration module, used to configure multiple pseudo functions corresponding to the JavaScript API module, and the pseudo functions are used to initiate cryptographic operation requests;

[0229] A WebAssembly processing module, which is used to convert the data conversion code in the C language form into the data conversion code in the WebAssembly form by using the WebAssembly module, and build a data conversion module;

[0230] The WebAssembly module is used to convert various cryptographic algorithm codes in C language into cryptographic algorithm codes in WebAssembly form to build a cryptographic algorithm module.

[0231] In one achievable manner, each cryptographic algorithm conversion code in C language includes at least one of the following:

[0232] SM2 conversion code in C language format, SM3 conversion code in C language format, SM4 conversion code in C language format, SM9 conversion code in C language format, and ZUC conversion code in C language format.

[0233] In one achievable manner, the present invention further includes:

[0234] The computing power allocation module is used to obtain the task priority of the cryptographic operation request; and allocate target computing power resources to the cryptographic operation request according to the task priority and the available computing power resources in the computing power resource pool.

[0235] An electronic device is provided in an embodiment of the present application, such as Figure 5 As shown, Figure 5 The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0236] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0237] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0238] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0239] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0240] Figure 5 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0241] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0242] An embodiment of the present application provides a computer program product, including a computer program, which implements the corresponding contents of the aforementioned method embodiment when the computer program is executed by a processor.

[0243] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0244] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data interaction method for a cryptographic algorithm, characterized in that: include: Obtaining a cryptographic operation request through a JavaScript API module, wherein the cryptographic operation request is used to instruct to perform a corresponding operation on target data using a target commercial cryptographic algorithm; The character string corresponding to the cryptographic operation request is converted into a byte array by using a data conversion module, wherein the data conversion module is obtained by converting a data conversion code in a C language form into a data conversion code in a WebAssembly form through a WebAssembly module; According to the byte array, the target data is processed using the target commercial cryptographic algorithm of the algorithm module to obtain an initial processing result, wherein the algorithm module is obtained by converting various cryptographic algorithm codes in C language form into cryptographic algorithm codes in WebAssembly form through the WebAssembly module; Using the data conversion module to convert the initial processing result into a hexadecimal processing result; The processing result is returned through the JavaScript API module.

2. The data interaction method of the cryptographic algorithm according to claim 1, characterized in that: Before using the data conversion module to convert the character string corresponding to the cryptographic operation request into a byte array, the method further includes: Parsing the cryptographic operation request to obtain a character string, the character string including: an operation type, data to be processed, and an algorithm identifier; determining whether the string is valid; When the character string is valid, the data conversion module is used to convert the character string into a byte array.

3. The data interaction method of the cryptographic algorithm according to claim 2, characterized in that: According to the byte array, the target data is processed using the target commercial cryptographic algorithm of the algorithm module to obtain an initial processing result, including: Generate a calculation request according to the byte array; According to the operation request, the target data is processed using the target commercial cryptographic algorithm of the algorithm module corresponding to the algorithm identifier to obtain an initial processing result.

4. The data interaction method of the cryptographic algorithm according to claim 1, characterized in that: Obtain cryptographic operation requests through the JavaScript API module, including any of the following: Obtain cryptographic operation requests initiated by the web browser through the JavaScript API module; Get the cryptographic operation request initiated by the mini program through the JavaScript API module; Get the cryptographic operation request initiated by HTML5 through the JavaScript API module.

5. The data interaction method of the cryptographic algorithm according to claim 1, characterized in that: Also includes: Configure multiple pseudo functions corresponding to the JavaScript API module, where the pseudo functions are used to initiate cryptographic operation requests; Use the WebAssembly module to convert the data conversion code in C language into the data conversion code in WebAssembly format to build a data conversion module; The WebAssembly module is used to convert various cryptographic algorithm codes in C language into cryptographic algorithm codes in WebAssembly form to build a cryptographic algorithm module.

6. The data interaction method of the cryptographic algorithm according to claim 5, characterized in that: The conversion codes of various cryptographic algorithms in C language include at least one of the following: SM2 conversion code in C language format, SM3 conversion code in C language format, SM4 conversion code in C language format, SM9 conversion code in C language format, and ZUC conversion code in C language format.

7. The data interaction method of the cryptographic algorithm according to claim 1, characterized in that: Also includes: Get the task priority of the cryptographic operation request; Target computing resources are allocated to the cryptographic operation request according to the task priority and the available computing resources in the computing resource pool.

8. A data interaction device for a cryptographic algorithm, characterized in that: include: A data interaction module, used to obtain a cryptographic operation request through a JavaScript API module, wherein the cryptographic operation request is used to instruct to perform a corresponding operation on target data using a target commercial cryptographic algorithm; A conversion module, used to convert the character string corresponding to the cryptographic operation request into a byte array by using a data conversion module, wherein the data conversion module is obtained by converting a data conversion code in a C language form into a data conversion code in a WebAssembly form by using a WebAssembly module; A cryptographic operation module, used to process the target data according to the byte array using the target commercial cryptographic algorithm of the algorithm module to obtain an initial processing result, wherein the algorithm module is obtained by converting various cryptographic algorithm codes in C language form into cryptographic algorithm codes in WebAssembly form through the WebAssembly module; The conversion module is further used to convert the initial processing result into a hexadecimal processing result by using the data conversion module; The data interaction module is also used to return the processing result through the JavaScript API module.

9. An electronic device, characterized in that: include: one or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to: execute the steps of the data interaction method of the cryptographic algorithm according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded by the processor and executes the steps of the data interaction method of the cryptographic algorithm according to any one of claims 1 to 7.

Images