Parameter library management method and device of safety equipment, equipment and storage medium

Abstract

The invention discloses a parameter library management method, device and equipment of safety equipment and a storage medium, and relates to the technical field of parameter management, and the method comprises the steps: randomly distributing an encryption key for a safety service business data flow according to a preset key table, and building a key storage address relation mapping table; storing an initial chain variable to a preset chain variable storage position in a distributed manner based on a first packet message of the security service business data flow, and establishing a chain variable storage address relation mapping table; encrypting a security service business data flow according to an encryption instruction, the key storage address relation mapping table and the chain variable storage address relation mapping table; and destroying a corresponding mapping relation in the key storage address relation mapping table and the chain variable storage address relation mapping table according to a destroying instruction. According to the method, the encryption key is randomly distributed, so that the confidentiality of the data is enhanced, the initial chain variables are stored in a distributed manner, the storage resources are fully utilized, and the read-write speed of the data is increased.

Description

Technical Field

[0001] The present application relates to the technical field of parameter management, and more specifically, to a parameter library management method, apparatus, device and storage medium for a security device. Background Art

[0002] Common call-based terminal protection security devices include USB password devices, PCIE password devices, etc. The common technical architecture of call-based terminal protection security devices is to deploy security service software on the user's terminal computer. The terminal user uses the software to call the security services provided on the security device. Common security services include information source authenticity, information integrity, information confidentiality, etc. The implementation of these security service functions is based on commercial secret SM2 / SM3 / SM4 and other cryptographic algorithms, and the core parameters required for the cryptographic algorithm to work include key, chain variable (IV), preset parameters (SBOX), etc.

[0003] All operations on the two parameters of key and chain variable are inseparable from the basic function of "search, find, match" (i.e., find the storage location of a certain parameter in the security device), so how to efficiently implement the "search, find, match" function is the key to ensure the efficiency of various operations on parameters. In terms of storage structure, existing call-based security devices store the key and chain variable IV in the RAM inside the FPGA chip, in the DDR chip outside the FPGA, or in the TCAM chip outside the FPGA.

[0004] However, if the key and link variables are stored in the RAM inside the FPGA chip or in the DDR outside the chip, a polling search method is generally used. This search method has an unstable processing delay, large fluctuations in processing performance, and uncontrollable processing. If the key and link variables are stored in the TCAM chip, the unique "input content output storage address" function of the TCAM chip is directly used, and the search efficiency is very high, but the cost of the TCAM chip is very high, so the overall solution cost is too high. Summary of the invention

[0005] In response to at least one defect or improvement need in the prior art, the present invention provides a parameter library management method, apparatus, device and storage medium for a security device, which are used to solve the problem in the prior art that when the security device stores keys and chain variables in the RAM inside the FPGA chip or in the DDR outside the chip, the processing delay is not fixed, the processing performance fluctuates greatly, the processing process is uncontrollable, and the cost is high when stored in the TCAM chip.

[0006] To achieve the above object, according to a first aspect of the present invention, a parameter library management method for a safety device is provided, comprising:

[0007] Randomly assign encryption keys to security service business data flows according to a preset key table, and establish a key storage address relationship mapping table;

[0008] Based on the first packet of the security service business data flow, the initial chain variables are distributedly stored in the preset chain variable storage location, and a chain variable storage address relationship mapping table is established;

[0009] Encrypting the security service business data stream according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table;

[0010] The corresponding mapping relationships in the key storage address relationship mapping table and the chain variable storage address relationship mapping table are destroyed according to the destruction instruction.

[0011] In a possible implementation, randomly allocating encryption keys to security service business data flows according to a preset key table, and establishing a key storage address relationship mapping table, further comprising:

[0012] According to the key configuration instruction, randomly select an encryption key from the preset key table and assign it to the security service business data flow;

[0013] Determine whether there is an idle key storage address in the preset key storage address;

[0014] If there is an idle key storage address, the encryption key is stored in the idle key storage address, and the corresponding key storage address is returned to establish a key storage address relationship mapping table.

[0015] In a possible implementation manner, determining whether there is an idle key storage address in the preset key storage address further includes:

[0016] If there is no free key storage address in the preset key storage address, wait for a first preset time and then determine whether there is a free key storage address in the preset key storage address;

[0017] If there is an idle key storage address after waiting for the first preset time, the encryption key is stored in the idle key storage address, and the corresponding key storage address is returned to establish a key storage address relationship mapping table;

[0018] If there is no idle key storage address after waiting for the first preset time, a key configuration failure message is returned.

[0019] In a possible implementation, the initial chain variables are distributedly stored in a preset chain variable storage location based on the first packet message of the security service business data flow, and a chain variable storage address relationship mapping table is established, including:

[0020] Extracting a data flow number and an initial chain variable from the first packet of the security service business data flow;

[0021] Determine whether there is an idle chain variable storage address in the preset chain variable storage address associated with the cryptographic algorithm corresponding to the data stream number;

[0022] If there is an idle link variable storage address, the initial link variable is stored in the idle link variable storage address, and the corresponding link variable storage address is returned to establish a link variable storage address relationship mapping table.

[0023] In a possible implementation, determining whether there is an idle key storage address in the preset chain variable storage address further includes:

[0024] If there is no idle link variable storage address in the preset link variable storage address, wait for a second preset time and then determine whether there is an idle link variable storage address in the preset link variable storage address;

[0025] If there is an idle link variable storage address after waiting for the second preset time, the initial link variable is stored in the idle link variable storage address, and the corresponding link variable storage address is returned to establish a link variable storage address relationship mapping table;

[0026] If there is no idle link variable storage address after waiting for the second preset time, a link variable configuration failure message is returned.

[0027] In one possible implementation, configuring an encryption key and a chain variable for a cryptographic algorithm according to an encryption instruction, a key storage address relationship mapping table, and a chain variable storage address relationship mapping table includes:

[0028] Determine the cryptographic algorithm corresponding to the security service business data flow according to the data flow number;

[0029] Obtain the key and the chain variable from the key storage address relationship mapping table and the chain variable storage address relationship mapping table based on the data stream number;

[0030] Configure key and chain variables to a cryptographic algorithm.

[0031] In a possible implementation, destroying corresponding mapping relationships in a key storage address relationship mapping table and a chain variable storage address relationship mapping table according to a destruction instruction includes:

[0032] According to the destruction instruction, the key to be destroyed is searched from the key storage address relationship mapping table, and the key to be destroyed and the corresponding mapping relationship are destroyed;

[0033] According to the destruction instruction, the chain variable to be destroyed is searched from the chain variable storage address relationship mapping table, and the chain variable to be destroyed and the corresponding mapping relationship are destroyed.

[0034] According to a second aspect of the present invention, there is also provided a parameter library management device for a safety device, comprising:

[0035] A key mapping module, which is configured to randomly assign encryption keys to security service business data flows according to a preset key table and establish a key storage address relationship mapping table;

[0036] A chain variable mapping module, which is configured to distribute and store the initial chain variables to a preset chain variable storage location based on the first packet message of the security service business data flow, and establish a chain variable storage address relationship mapping table;

[0037] A parameter configuration module configured to encrypt a security service business data stream according to an encryption instruction, a key storage address relationship mapping table, and a chain variable storage address relationship mapping table;

[0038] A parameter destruction module is configured to destroy corresponding mapping relationships in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to a destruction instruction.

[0039] According to a third aspect of the present invention, there is also provided a parameter library management device for a safety device, which includes at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the computer program is executed by the processing unit, the processing unit executes the steps of any of the above-mentioned parameter library management methods for safety devices.

[0040] According to a fourth aspect of the present invention, there is also provided a storage medium storing a computer program executable by an access authentication device, wherein when the computer program runs on the access authentication device, the access authentication device executes the steps of any of the above-mentioned parameter library management methods for security devices.

[0041] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects compared with the prior art:

[0042] The present invention provides a parameter library management method for a security device. The method randomly allocates encryption keys to security service business data streams through a preset key table. This method effectively prevents the reuse of keys and reduces the risk of key cracking. A key storage address relationship mapping table and a chain variable storage address relationship mapping table are established to facilitate rapid positioning and access to keys or chain variables when needed. The initial chain variables are distributedly stored in preset chain variable storage locations, which can make full use of storage resources and improve the reading and writing speed of data. At the same time, distributed storage also enhances the fault tolerance of data. Even if some storage locations fail, it will not cause complete loss of data. When an encryption instruction is triggered, the required keys and chain variables can be quickly located through the key storage address relationship mapping table and the chain variable storage address relationship mapping table, thereby realizing rapid encryption of security service business data streams. When a key or chain variable is no longer needed, it can be deleted from the mapping table in time to release the corresponding storage space, which is convenient for maintenance and expansion. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A schematic diagram of a flow chart of an embodiment of a parameter library management method for a safety device provided by the present invention;

[0045] Figure 2 The present invention provides Figure 1 A schematic flow chart of an embodiment of step S101;

[0046] Figure 3 The present invention provides Figure 2 A schematic diagram of a flow chart of an embodiment of step S202;

[0047] Figure 4 The present invention provides Figure 1 A schematic diagram of a flow chart of an embodiment of step S102;

[0048] Figure 5 The present invention provides Figure 4 A schematic diagram of a flow chart of an embodiment of step S402;

[0049] Figure 6 The present invention provides Figure 1 A schematic flow chart of an embodiment of step S103;

[0050] Figure 7A schematic diagram of the structure of an embodiment of a parameter library management device for a safety device provided by the present invention;

[0051] Figure 8 A schematic diagram of the structure of a parameter library management device for a security device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0053] The terms "first", "second", "third", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0054] The present invention provides a parameter library management method, apparatus, device and storage medium for a safety device, which are described below respectively.

[0055] See also Figure 1 , Figure 1 A flow chart of an embodiment of a parameter library management method for a safety device provided by the present invention. In a specific embodiment of the present invention, a parameter library management method for a safety device is disclosed, including:

[0056] S101, randomly assigning encryption keys to security service business data flows according to a preset key table, and establishing a key storage address relationship mapping table;

[0057] S102, based on the first packet of the security service business data flow, the initial chain variables are distributedly stored in a preset chain variable storage location, and a chain variable storage address relationship mapping table is established;

[0058] S103, encrypting the security service business data stream according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table;

[0059] S104. Destroy corresponding mapping relationships in the key storage address relationship mapping table and the link variable storage address relationship mapping table according to the destruction instruction.

[0060] In the above embodiment, firstly, a preset key table is prepared in advance, in which multiple keys that can be used for encryption are stored. A unique encryption key is randomly assigned to each incoming security service business data stream according to the preset key table, ensuring that each data stream can obtain personalized encryption protection, greatly enhancing the security of the data. Then, a key storage address relationship mapping table is established, which records in detail the corresponding relationship between each encryption key and its storage location. The key storage address relationship mapping table provides a convenient query path for subsequent key management and encryption operations.

[0061] For the first packet of the security service business data flow, the initial chain variables contained in it will be distributedly stored in the preset chain variable storage location. There is a corresponding relationship between the cryptographic algorithm and the initial chain variable. Usually, one cryptographic algorithm can correspond to multiple initial chain variables. The distributed storage strategy not only improves the fault tolerance and availability of data, but also reduces the risk of single point failure through decentralized storage. At the same time, a chain variable storage address relationship mapping table is constructed to record the corresponding relationship between each chain variable and its storage location. The chain variable storage address relationship mapping table provides strong support for efficient retrieval and management of chain variables.

[0062] The parameters of the cryptographic algorithm include keys and chain variables. When the encryption instruction is triggered, the security service business data stream will be encrypted according to the key storage address relationship mapping table and the chain variable storage address relationship mapping table. The encryption process will strictly follow the preset encryption algorithm and protocol to ensure the security of data during transmission and storage. The encrypted data stream will be securely transmitted to the target location or stored in a secure storage medium for subsequent use or analysis. It is understandable that when decryption is required, it is also necessary to obtain the key, chain variable and cryptographic algorithm, and perform the inverse operation on the encrypted data to achieve decryption.

[0063] When the data flow processing task is completed, or according to a specific destruction instruction, the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table will be destroyed in time, which is crucial to prevent the leakage of sensitive information. It ensures that it is difficult to track the storage location of the encryption key or chain variable through the mapping table. While destroying the mapping relationship, a series of security cleanup operations will be performed, including clearing temporary files, releasing memory resources, etc., to ensure cleanliness and security.

[0064] Compared with the prior art, the parameter library management method of a security device provided in this embodiment randomly assigns encryption keys to security service business data streams through a preset key table. This method effectively prevents the reuse of keys and reduces the risk of key cracking. A key storage address relationship mapping table and a chain variable storage address relationship mapping table are established to facilitate rapid positioning and access to keys or chain variables when needed. The initial chain variables are distributedly stored in the preset chain variable storage locations, which can make full use of storage resources and improve the reading and writing speed of data. At the same time, distributed storage also enhances the fault tolerance of data. Even if some storage locations fail, it will not cause complete loss of data. When the encryption instruction is triggered, the required keys and chain variables can be quickly located through the key storage address relationship mapping table and the chain variable storage address relationship mapping table, thereby realizing rapid encryption of security service business data streams. When a key or chain variable is no longer needed, it can be deleted from the mapping table in time to release the corresponding storage space, which is convenient for maintenance and expansion.

[0065] See also Figure 2 , Figure 2 The present invention provides Figure 1 In some embodiments of the present invention, the encryption key is randomly assigned to the security service business data flow according to the preset key table, and a key storage address relationship mapping table is established, which also includes:

[0066] S201, randomly selecting an encryption key from a preset key table according to a key configuration instruction and assigning it to a security service business data flow;

[0067] S202, determining whether there is an idle key storage address in the preset key storage address;

[0068] S203: If there is an idle key storage address, the encryption key is stored in the idle key storage address, and the corresponding key storage address is returned to establish a key storage address relationship mapping table.

[0069] In the above embodiment, when the security device is powered on, multiple key storage addresses are written. The key storage addresses have storage space, which can be used to store the keys to be used, and have address information. The key storage addresses can be found through the address information and the corresponding keys can be obtained.

[0070] When a new security service business data stream needs to be encrypted, an encryption key is randomly selected from the preset key table and assigned to the data stream according to the received key configuration instruction, thereby ensuring that a different key is used for each data transmission, thereby increasing the security of the data. When selecting a key, a random algorithm or a pseudo-random number generator can be used to ensure the randomness and unpredictability of the selection.

[0071] After allocating the encryption key, you need to check whether there is any free storage location in the preset key storage address to ensure that there is enough space to store the newly allocated key to avoid key conflicts or storage overflow problems. You can quickly determine which addresses are free by querying the key storage address relationship mapping table.

[0072] If an idle key storage address is found, the encryption key is stored in one of the idle addresses. After the storage is completed, the key storage address relationship mapping table needs to be updated to record the correspondence between the newly allocated key and its storage address, which is crucial for subsequent key management and decryption operations. At the same time, an entry containing the key identifier and storage address can be generated and added to the mapping table so that the key can be quickly retrieved when needed.

[0073] It is understandable that in order to further improve security, the encryption key of the assigned address can be updated, replaced or deleted regularly or according to specific conditions (such as the number of times the key is used, the time period, etc.). When updating the key, it is necessary to ensure the safe allocation and storage of the new key, and update the key storage address relationship mapping table to reflect the latest key status.

[0074] See also Figure 3 , Figure 3 The present invention provides Figure 2 In some embodiments of the present invention, determining whether there is an idle key storage address in the preset key storage address further includes:

[0075] S301, if there is no idle key storage address in the preset key storage address, wait for a first preset time and then determine whether there is an idle key storage address in the preset key storage address;

[0076] S302: If there is an idle key storage address after waiting for the first preset time, the encryption key is stored in the idle key storage address, and the corresponding key storage address is returned to establish a key storage address relationship mapping table;

[0077] S303: If there is no idle key storage address after waiting for the first preset time, a key configuration failure message is returned.

[0078] In the above embodiment, when a request for allocating an encryption key to a security service business data stream is required, first check whether there is an idle storage location in the preset key storage address. If it is found in the preliminary judgment that there is no idle key storage address in the preset key storage address, generally a failure message will not be returned immediately, but a preset time period, i.e., a first preset time, will be waited for. This time period can be configured according to the actual operation situation and business needs, and is intended to provide a certain buffer time so that the key release or recovery operation that may be in progress can be completed, thereby releasing an idle key storage address. As a preferred embodiment, the first preset time in the present invention is set to 3 seconds, and can also be set according to actual needs.

[0079] After waiting for the first preset time, the idle state of the preset key storage address is checked again. If there is an idle key storage address at this time, the encryption key is stored in one of the idle addresses, and an entry including the key identifier and the storage address is generated and added to the key storage address relationship mapping table, thereby ensuring the secure storage and fast retrieval of the encryption key.

[0080] If after waiting for the first preset time, it is still found that there is no free key storage address in the preset key storage address, it means that the current key storage resource is already saturated and encryption keys cannot be allocated for new security service business data flows. In this case, a key configuration failure message will be returned to the service or module requesting key allocation. This message can contain some additional information, such as the cause of the failure, recommended solutions, etc., to help developers or operation and maintenance personnel quickly locate the problem and take corresponding measures.

[0081] See also Figure 4 , Figure 4 The present invention provides Figure 1 In some embodiments of the present invention, the initial chain variables are distributedly stored in a preset chain variable storage location based on the first packet message of the security service business data flow, and a chain variable storage address relationship mapping table is established, including:

[0082] S401, extracting a data flow number and an initial chain variable from the first packet of the security service business data flow;

[0083] S402, determining whether there is an idle chain variable storage address in the preset chain variable storage address associated with the cryptographic algorithm corresponding to the data stream number;

[0084] S403: If there is an idle link variable storage address, the initial link variable is stored in the idle link variable storage address, and the corresponding link variable storage address is returned to establish a link variable storage address relationship mapping table.

[0085] In the above embodiment, it is necessary to maintain a preset chain variable storage area, which is used to store the initial chain variables of each security service business data flow. These chain variables are usually associated with a specific cryptographic algorithm and are used for verification and tracking during the processing of the data flow. At the same time, it is also necessary to maintain a chain variable storage address relationship mapping table, which is used to record the corresponding relationship between each chain variable and its storage address.

[0086] When the first packet of the security service business data flow arrives, the data flow number and initial chain variable are first extracted from the message. The data flow number is an identifier used to uniquely identify each data flow, and the initial chain variable is the initial state information required when the data flow starts processing.

[0087] Next, it is necessary to determine whether there is an idle storage location in the preset chain variable storage address associated with the cryptographic algorithm corresponding to the data stream number, in order to ensure that there is enough space to store the new chain variable and avoid storage conflicts or overflows.

[0088] If an idle link variable storage address is found, the initial link variable is stored in one of the idle addresses. After the storage is completed, the link variable storage address relationship mapping table needs to be updated to record the corresponding relationship between the newly stored link variable and its storage address, which is crucial for subsequent link variable retrieval and management. At the same time, an entry containing the data flow number, link variable identifier and storage address can be generated and added to the mapping table so that the link variable can be quickly retrieved when needed.

[0089] See also Figure 5 , Figure 5 The present invention provides Figure 4 In some embodiments of the present invention, determining whether there is an idle key storage address in the preset chain variable storage address further includes:

[0090] S501: If there is no idle link variable storage address in the preset link variable storage address, wait for a second preset time and then determine whether there is an idle link variable storage address in the preset link variable storage address;

[0091] S502: If there is an idle link variable storage address after waiting for the second preset time, the initial link variable is stored in the idle link variable storage address, and the corresponding link variable storage address is returned to establish a link variable storage address relationship mapping table;

[0092] S503: If there is no idle link variable storage address after waiting for the second preset time, a link variable configuration failure message is returned.

[0093] In the above embodiment, after receiving the security service business data stream, the idle state of the preset link variable storage address will be checked first. If it is found that there is no idle link variable storage address at this time, failure will not be returned immediately, but a more flexible processing mechanism will be adopted. Specifically, it is necessary to wait for a preset time period, that is, the second preset time, so that the link variable release or recovery operation that may be in progress can be completed, thereby releasing the idle link variable storage address. After waiting for the second preset time, the idle state of the preset link variable storage address will be checked again to confirm whether there is an idle link variable storage address released during the waiting period. As a preferred embodiment, the second preset time in the present invention is also set to 3 seconds, and can also be set according to actual needs.

[0094] If there is an idle chain variable storage address at this time, the initial chain variable extracted from the first packet of the security service business data flow will be stored in one of the idle addresses. After the storage is completed, an entry containing the chain variable identifier and storage address will be generated and added to the chain variable storage address relationship mapping table, ensuring the safe storage and fast retrieval of the chain variable. At the same time, the corresponding chain variable storage address will be returned to the requester so that the chain variable can be correctly referenced in the subsequent data processing or verification process.

[0095] If after waiting for the second preset time, it is still found that there is no free storage address in the preset chain variable storage address, it means that the current chain variable storage resources are already saturated and chain variables can no longer be allocated for new security service business data flows. In this case, a message indicating that the chain variable configuration failed will be returned to the service or module requesting the chain variable allocation. This message can contain some additional information, such as the cause of the failure, recommended solutions, etc., to help developers or operation and maintenance personnel quickly locate the problem and take corresponding measures.

[0096] See also Figure 6 , Figure 6 The present invention provides Figure 1 In some embodiments of the present invention, the encryption key and the chain variable are configured for the cryptographic algorithm according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table, including:

[0097] S601, determining the cryptographic algorithm corresponding to the security service business data flow according to the data flow number;

[0098] S602, obtaining a key and a link variable from a key storage address relationship mapping table and a link variable storage address relationship mapping table based on a data stream number;

[0099] S603: Configure the key and chain variables to the cryptographic algorithm.

[0100] Please refer to Table 1, which is a configuration table of data stream numbers, cryptographic algorithms and their corresponding relationships. In the above embodiment, it is necessary to maintain a database or configuration table containing data stream numbers, cryptographic algorithms and their corresponding relationships. This table is used to quickly determine which cryptographic algorithm should be used for processing when receiving a data stream. At the same time, a key storage address relationship mapping table and a chain variable storage address relationship mapping table are also maintained. These two tables record the storage address information of the encryption key and the chain variable, respectively.

[0101] Table 1

[0102]

[0103] When an encryption instruction is received, the data stream number is first extracted from the instruction. Then, the corresponding cryptographic algorithm is looked up in the cryptographic algorithm configuration table based on the data stream number. This ensures that the most appropriate cryptographic algorithm can be selected for each data stream for processing.

[0104] After the cryptographic algorithm is determined, the next step is to obtain the required encryption key and chain variable from the key storage address relationship mapping table and the chain variable storage address relationship mapping table. Specifically, based on the data stream number, the key storage address and chain variable storage address associated with the data stream number are searched in these two mapping tables. Then, the actual values ​​of the encryption key and chain variable are read from the found storage addresses.

[0105] After obtaining the encryption key and chain variables, they will be configured to the previously determined cryptographic algorithm. This step usually involves passing the key and chain variables as parameters to the implementation function or module of the cryptographic algorithm for use in subsequent data processing. After the configuration is completed, you can start using the configured cryptographic algorithm to encrypt the security service business data flow.

[0106] In some embodiments of the present invention, destroying corresponding mapping relationships in a key storage address relationship mapping table and a link variable storage address relationship mapping table according to a destruction instruction includes:

[0107] According to the destruction instruction, the key to be destroyed is searched from the key storage address relationship mapping table, and the key to be destroyed and the corresponding mapping relationship are destroyed;

[0108] According to the destruction instruction, the chain variable to be destroyed is searched from the chain variable storage address relationship mapping table, and the chain variable to be destroyed and the corresponding mapping relationship are destroyed.

[0109] In the above embodiment, after receiving the destruction instruction, the instruction usually includes the data stream number or related identifier to be destroyed, which is used to indicate which keys and link variables need to be destroyed. It is necessary to maintain a key storage address relationship mapping table and a link variable storage address relationship mapping table, which respectively record the storage addresses of keys and link variables and their corresponding relationships.

[0110] According to the information provided in the destruction instruction, the key to be destroyed is searched in the key storage address relationship mapping table. Once a matching key is found, it is deleted from the table and the mapping relationship associated with the key is destroyed at the same time, which means that the correspondence between the key and its storage address is no longer maintained.

[0111] Similarly, the link variable to be destroyed will be searched in the link variable storage address relationship mapping table according to the destruction instruction. Once a matching link variable is found, it will be deleted from the table and the mapping relationship associated with the link variable will be destroyed at the same time, ensuring that the correspondence between the link variable and its storage address is no longer maintained, thereby preventing subsequent illegal access to the link variable.

[0112] In a specific embodiment of the present invention, taking the security device needing to support 1000 keys as an example, after the security device is powered on, the 1000 numbers 0-999 are first continuously written into the key storage unit as free and available key storage addresses. When receiving the key configuration instruction issued by the user terminal security service software, first determine whether the key storage unit has free and available key storage addresses. If yes, read an address from the key storage unit and return it to the user terminal, and the user terminal adds a new table entry in the "key number-key address relationship mapping table", and the security device writes the key content to the corresponding position in the key library RAM according to the address. If no, a message of key configuration failure is returned to the user terminal. The algorithm scheduling module has two operations on the key library: obtaining keys and destroying and releasing keys. The key obtaining action is to search according to the key address, and the key destroying action is to write the key address back to the key storage unit to complete the release and recovery.

[0113] In another specific embodiment of the present invention, the security device needs to support 1000 keys and place 10 cryptographic algorithms. Each cryptographic algorithm needs to support the chain variable processing of 100 data streams. After the security device is powered on, the "chain variable address power-on initialization" module corresponding to each of the 5 algorithms will first write 100 numbers 0-99 to the chain variable storage address as free and available chain variable storage addresses. When a certain algorithm scheduling module receives a security service data stream message fragment from a user terminal, it first determines the "first packet / middle packet / last packet" attribute. If it is the first packet, it determines whether there is any free and available chain variable storage address space in the chain variable storage address. If so, a new table entry is added to the "data stream number-key address relationship mapping table", and the chain variable content is written to the corresponding position in the chain variable library RAM. If not, a message indicating that there is no free chain variable space is returned to the user terminal. The algorithm scheduling module operates on the chain variable library in two ways: obtaining chain variables and destroying and releasing chain variables. The key obtaining action searches according to the key address, and the key destroying action writes the key address back to the "key address recovery storage FIFO" to complete the release and recovery.

[0114] In order to better implement the parameter library management method of the safety device in the embodiment of the present invention, based on the parameter library management method of the safety device, correspondingly, please refer to Figure 7 , Figure 7 This is a schematic diagram of the structure of an embodiment of a parameter library management device for a safety device provided by the present invention. The embodiment of the present invention provides a parameter library management device 700 for a safety device, including:

[0115] A key mapping module 710, which is configured to randomly assign encryption keys to security service business data flows according to a preset key table, and to establish a key storage address relationship mapping table;

[0116] A chain variable mapping module 720, which is configured to distribute and store the initial chain variables to a preset chain variable storage location based on the first packet of the security service business data flow, and to establish a chain variable storage address relationship mapping table;

[0117] A parameter configuration module 730, which is configured to encrypt the security service business data flow according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table;

[0118] The parameter destruction module 740 is configured to destroy the corresponding mapping relationships in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to the destruction instruction.

[0119] It should be noted here that: the device 700 provided in the above embodiment can implement the technical solutions described in the above method embodiments. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above method embodiments, which will not be repeated here.

[0120] See also Figure 8 , Figure 8 A schematic diagram of the structure of a parameter library management device for a security device provided by an embodiment of the present invention. Based on the parameter library management method for the security device described above, the present invention also provides a parameter library management device for a security device, which can be a computing device such as a mobile terminal, a desktop computer, a notebook, a palm computer, and a server. The parameter library management device 800 of the security device includes a processor 810, a memory 820, and a display 830. Figure 8 Only some components of the synchronous tracking flying welding equipment for real-time measurement of battery height are shown, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead.

[0121] In some embodiments, the memory 820 may be an internal storage unit of the parameter library management device 800 of the safety device, such as a hard disk or memory of the parameter library management device 800 of the safety device. In other embodiments, the memory 820 may also be an external storage device of the parameter library management device 800 of the safety device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the parameter library management device 800 of the safety device. Further, the memory 820 may also include both the internal storage unit of the parameter library management device 800 of the safety device and an external storage device. The memory 820 is used to store application software and various types of data installed in the parameter library management device 800 of the safety device, such as the program code of the parameter library management device 800 installed in the safety device. The memory 820 may also be used to temporarily store data that has been output or is to be output. In one embodiment, a parameter library management program 840 of a safety device is stored in the memory 820 , and the parameter library management program 840 of the safety device can be executed by the processor 810 , thereby implementing the parameter library management method of the safety device of each embodiment of the present application.

[0122] In some embodiments, the processor 810 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes or process data stored in the memory 820, such as executing a parameter library management method of a security device.

[0123] In some embodiments, the display 830 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 830 is used to display information on the parameter library management device 800 of the safety device and to display a visual user interface. The components 810-830 of the parameter library management device 800 of the safety device communicate with each other via a system bus.

[0124] In one embodiment, when the processor 810 executes the parameter library management program 840 of the safety device in the memory 820 , the steps in the parameter library management method of the safety device described above are implemented.

[0125] This embodiment also provides a computer-readable storage medium, on which a parameter library management program of a safety device is stored. When the parameter library management program of the safety device is executed by a processor, the following steps are implemented:

[0126] Randomly assign encryption keys to security service business data flows according to a preset key table, and establish a key storage address relationship mapping table;

[0127] Based on the first packet of the security service business data flow, the initial chain variables are distributedly stored in the preset chain variable storage location, and a chain variable storage address relationship mapping table is established;

[0128] Encrypting the security service business data stream according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table;

[0129] The corresponding mapping relationships in the key storage address relationship mapping table and the chain variable storage address relationship mapping table are destroyed according to the destruction instruction.

[0130] In summary, the parameter library management method of a security device provided by the present invention randomly assigns encryption keys to security service business data streams through a preset key table. This method effectively prevents the reuse of keys and reduces the risk of key cracking. A key storage address relationship mapping table and a chain variable storage address relationship mapping table are established to facilitate rapid positioning and access to keys or chain variables when needed. The initial chain variables are distributedly stored in the preset chain variable storage positions, which can make full use of storage resources and improve the reading and writing speed of data. At the same time, distributed storage also enhances the fault tolerance of data. Even if some storage locations fail, it will not cause complete loss of data. When the encryption instruction is triggered, the required keys and chain variables can be quickly located through the key storage address relationship mapping table and the chain variable storage address relationship mapping table, thereby realizing rapid encryption of security service business data streams. When a key or chain variable is no longer needed, it can be deleted from the mapping table in time to release the corresponding storage space, which is convenient for maintenance and expansion.

[0131] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the above method are implemented. The computer-readable storage medium may include, but is not limited to, any type of disk, including a floppy disk, an optical disk, a DVD, a CD-ROM, a micro drive, and a magneto-optical disk, a ROM, a RAM, an EPROM, an EEPROM, a DRAM, a VRAM, a flash memory device, a magnetic card or an optical card, a nanosystem (including a molecular memory IC), or any type of medium or device suitable for storing instructions and / or data.

[0132] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0133] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0134] In the several embodiments provided in the present application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0135] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0136] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0137] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, disk or optical disk and other media that can store program code.

[0138] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable memory, which can include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0139] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of the implementation scheme of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

[0140] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0141] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A parameter library management method for a safety device, characterized in that: include: Randomly assign encryption keys to security service business data flows according to a preset key table, and establish a key storage address relationship mapping table; Based on the first packet message of the security service business data flow, the initial chain variables are distributedly stored in a preset chain variable storage location, and a chain variable storage address relationship mapping table is established; Encrypting the security service business data stream according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table; The corresponding mapping relationships in the key storage address relationship mapping table and the link variable storage address relationship mapping table are destroyed according to the destruction instruction.

2. The parameter library management method of a safety device according to claim 1, characterized in that: The method of randomly allocating encryption keys to security service business data flows according to a preset key table and establishing a key storage address relationship mapping table also includes: Randomly select an encryption key from the preset key table according to the key configuration instruction and assign it to the security service business data flow; Determine whether there is an idle key storage address in the preset key storage address; If there is an idle key storage address, the encryption key is stored in the idle key storage address, and the corresponding key storage address is returned to establish a key storage address relationship mapping table.

3. The parameter library management method of a safety device according to claim 2, characterized in that: The determining whether there is an idle key storage address in the preset key storage address also includes: If there is no idle key storage address in the preset key storage address, wait for a first preset time and then determine whether there is an idle key storage address in the preset key storage address; If there is an idle key storage address after waiting for the first preset time, the encryption key is stored in the idle key storage address, and the corresponding key storage address is returned to establish a key storage address relationship mapping table; If there is no idle key storage address after waiting for the first preset time, a key configuration failure message is returned.

4. The parameter library management method of a safety device according to claim 1, characterized in that: The first packet message based on the security service business data flow stores the initial chain variables in a distributed manner to a preset chain variable storage location, and establishes a chain variable storage address relationship mapping table, including: Extracting a data flow number and an initial chain variable from a first packet of the security service business data flow; Determine whether there is an idle chain variable storage address in the preset chain variable storage address associated with the cryptographic algorithm corresponding to the data stream number; If there is an idle link variable storage address, the initial link variable is stored in the idle link variable storage address, and the corresponding link variable storage address is returned to establish a link variable storage address relationship mapping table.

5. The parameter library management method of a safety device according to claim 4, characterized in that: The step of determining whether there is an idle key storage address in the preset chain variable storage address further includes: If there is no idle link variable storage address in the preset link variable storage address, wait for a second preset time and then determine whether there is an idle link variable storage address in the preset link variable storage address; If there is an idle link variable storage address after waiting for the second preset time, the initial link variable is stored in the idle link variable storage address, and the corresponding link variable storage address is returned to establish a link variable storage address relationship mapping table; If there is no idle link variable storage address after waiting for the second preset time, a link variable configuration failure message is returned.

6. The parameter library management method of a safety device according to claim 4, characterized in that: The configuring the encryption key and the chain variable for the cryptographic algorithm according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table includes: Determine the cryptographic algorithm corresponding to the security service business data flow according to the data flow number; Acquire a key and a chain variable from the key storage address relationship mapping table and the chain variable storage address relationship mapping table based on the data stream number; The key and the chain variable are configured to the cryptographic algorithm.

7. The parameter library management method of a safety device according to claim 1, characterized in that: The destroying, according to the destroy instruction, the corresponding mapping relationships in the key storage address relationship mapping table and the link variable storage address relationship mapping table includes: According to the destruction instruction, the key to be destroyed is searched from the key storage address relationship mapping table, and the key to be destroyed and the corresponding mapping relationship are destroyed; According to the destruction instruction, the link variable to be destroyed is searched from the link variable storage address relationship mapping table, and the link variable to be destroyed and the corresponding mapping relationship are destroyed.

8. A parameter library management device for safety equipment, characterized in that: include: A key mapping module, which is configured to randomly assign encryption keys to security service business data flows according to a preset key table and establish a key storage address relationship mapping table; A chain variable mapping module, configured to distribute and store the initial chain variables to a preset chain variable storage location based on the first packet message of the security service business data flow, and to establish a chain variable storage address relationship mapping table; A parameter configuration module configured to encrypt the security service business data flow according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table; A parameter destruction module is configured to destroy corresponding mapping relationships in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to a destruction instruction.

9. A parameter library management device for a safety device, characterized in that: It comprises at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the computer program is executed by the processing unit, the processing unit executes the steps of the parameter library management method of the safety device according to any one of claims 1 to 7.

10. A storage medium, characterized in that: It stores a computer program executable by an access authentication device. When the computer program runs on the access authentication device, the access authentication device executes the steps of the parameter library management method of the security device according to any one of claims 1 to 7.

Images