Encryption system and key configuration and calling method

Abstract

The present application discloses an encryption system and a key configuration and calling method thereof, the system includes an encryption machine and a configuration module, wherein the configuration module is provided with a designated key configuration mode and a random key configuration mode: in the designated key configuration mode, the configuration module is used to select a first key purpose through a first interface and fill in a first number according to the first key purpose, select a first number through a second interface and fill in a corresponding key index according to the first number, and is used to write the first number, the first key purpose and the designated key index as a set of data into the key mapping table. Through the embodiments of the present application, it is possible to avoid that key-related calling information is mastered by one person, reduce the probability of targeted attacks on keys, reduce the risk of leakage, and further ensure key security.

Description

Technical Field

[0001] The present application relates to encryption machine technology, in particular to an encryption system and key configuration and calling method thereof. Background Art

[0002] The encryption machine is an important way to achieve data encryption. The security of the encryption machine is directly related to the security of the data. In some scenarios, users need to customize the key. For example, when the service provider provides relevant services to the customer, the relevant encryption key is specified by the customer. In this case, the customer needs to provide the key and enter the relevant information into the encryption machine.

[0003] In the prior art, the encryption machine administrator inputs the key value and key purpose into the encryption machine to obtain the key index, and the business system can then reference the corresponding key index according to the key purpose to complete the call of the key. The encryption machine administrator has information about what business system the key is used for and what key is called in the business system, which increases the risk of key leakage due to targeted attacks. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes an encryption system and a key configuration and calling method thereof, which hides the business attributes of the key, shields the business information involved in the key from everyone, and increases the security of the key used in the system.

[0005] On the one hand, an embodiment of the present application provides an encryption system, including:

[0006] The encryption machine is used to store the key and complete encryption and / or decryption according to the client's request;

[0007] A configuration module is used to automatically generate a key mapping table to hide information about the business system calling a key from everyone, wherein the key mapping table is used to store at least one set of key reference information, wherein a set of key reference information includes three data: a number, a key purpose, and a key index;

[0008] The configuration module is provided with a specified key configuration mode:

[0009] In the designated key configuration mode, the configuration module is used to select the first key purpose through the first interface and fill in the first number according to the first key purpose, select the first number through the second interface and fill in the corresponding key index according to the first number, and write the first number, the first key purpose and the designated key index as a set of data into the key mapping table, and encrypt and store the key mapping table;

[0010] The first interface is displayed when accessed by a first account, and the second interface is displayed when accessed by a second account.

[0011] It is understandable that in this embodiment, the first administrator accesses the configuration module through the first account, the configuration module displays the first interface, and then the first administrator enters the corresponding number of the replacement key purpose. The second administrator accesses the configuration module through the second account, the configuration module displays the second interface, and then the second administrator enters the key index corresponding to the specified number. Then the configuration module can associate the key index with the purpose by number. However, neither administrator knows the corresponding relationship between the key and the purpose.

[0012] In some embodiments, the encryption engine selects a corresponding key index according to the key usage in the client request, and encrypts or decrypts the data pointed to by the request.

[0013] In some embodiments, the first key usage is displayed on a key storage medium, and the first account user covers or smears the area where the first key usage is located on the key medium, and replaces the mark with the first number.

[0014] In some embodiments, the configuration module is provided with a random configuration mode. In the random configuration mode, the encryption machine randomly generates a batch of keys for use in batches. The configuration module is used to obtain the second key usage, and randomly generate a second number corresponding to the second key usage, and randomly select a key index, write the second number, the second key usage and the random key index as a set of data into the key mapping table, and encrypt and store the key mapping table.

[0015] In some embodiments, the key mapping table is encrypted and stored in a secure and confidential area.

[0016] In some embodiments, the configuration module and the encryption engine are configured in an independent security environment.

[0017] On the other hand, an embodiment of the present application provides a key configuration and calling method for an encryption system, which, in a specified key configuration mode, includes the following steps:

[0018] The first account user manages the key storage medium and replaces the first key usage with the first number;

[0019] Displaying the first interface according to the request when the first account is accessed;

[0020] The first interface displays the currently configurable key usages. Select one of the usages to be configured.

[0021] Through the first interface, the first account user enters the first number according to the mark on the key storage medium;

[0022] The second account user uses the key storage medium to import the key into the encryption machine and obtain the key index;

[0023] Displaying the second interface according to the request when the second account is accessed;

[0024] The second interface displays the first number currently to be configured;

[0025] According to the second interface display, the second account user retrieves the key index corresponding to the first number and enters the key index;

[0026] Writing the first number, the first key usage and the designated key index into the key mapping table as a set of data;

[0027] The key mapping table is stored encrypted.

[0028] In some embodiments, before displaying the first interface according to the request during access by the first account, the following steps are also included:

[0029] A selection interface for the key configuration mode is displayed, wherein the selection interface includes a first button for entering the specified key configuration mode and a second button for entering the random key configuration mode.

[0030] The embodiment of the present application uses two accounts to access two pages, obtains a set of key information through the two pages respectively, and associates the information entered separately by number. The service caller applies for the call through the key purpose, but he cannot know the corresponding number and index. The first account user cannot know the key index, and the second account user cannot know the key purpose. This method can prevent one person from mastering the complete key call information, reduce the probability of targeted attacks on the key, and reduce the risk of leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0032] Figure 1 It is a module block diagram of a key configuration and calling method of an encryption system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described through the implementation method with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0034] In the description of the present invention, "several" means more than one, "many" means more than two, "greater than", "less than", "exceed", etc. are understood to exclude the number itself, and "above", "below", "within", etc. are understood to include the number itself. If there is a description of "first" or "second", it is only used for the purpose of distinguishing the technical features, and cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0035] In the description of the present invention, unless otherwise clearly defined, words such as "setting" should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meaning of the above words in the present invention in combination with the specific content of the technical solution.

[0036] In the description of the present invention, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0037] Reference Figure 1 This embodiment provides a key configuration and calling method for an encryption system, including:

[0038] The encryption machine is used to store the key and complete encryption and / or decryption according to the request of the client. It should be understood that the encryption machine referred to in this application can be a hardware device or a software program, which stores various encryption algorithms and user key information. Based on these algorithms and key information, encryption and decryption services can be provided to the client. The operation process of the encryption machine is usually based on the user's request, and the corresponding algorithm and key are called to encrypt the data according to the purpose of the user's request (corresponding to certain algorithms or keys). Similarly, confidential data can also be decrypted at the decryption end according to relevant algorithms and keys. Relevant encryption algorithms include but are not limited to DES, 3DES, AES, RSA or DSA.

[0039] The configuration module is used to automatically generate a key mapping table to hide the information of the business system calling the key from everyone. The key mapping table is used to store at least one set of key reference information, and a set of key reference information includes three data: number, key purpose and key index. The key mapping table is managed by the configuration module and parsed and called according to the user's request. The key mapping table is usually stored in an encrypted manner. When it is called, the manager will first decrypt it, and the key mapping table cannot be accessed and read from the outside. The configuration module is used to configure related keys and corresponding purposes. The key purpose is visible to the client that needs to call the key, and the user can call it based on the purpose. The configuration module usually exists in the form of software, which is deployed in an independent security environment with the encryption machine, and remote access to the configuration module management function is prohibited. Only a parsing interface is provided for business calls, which can reduce the possibility of targeted attacks on the key.

[0040] In the specified key configuration mode, the configuration module is used to select the first key purpose through the first interface and fill in the first number according to the first key purpose, select the first number through the second interface and fill in the corresponding key index according to the first number, and write the first number, the first key purpose and the specified key index as a set of data into the key mapping table.

[0041] The first interface is displayed when accessed by a first account, and the second interface is displayed when accessed by a second account.

[0042] It is understandable that in this embodiment, the first administrator accesses the configuration module through the first account, the configuration module displays the first interface, and then the first administrator enters the corresponding number of the replacement key purpose. The second administrator accesses the configuration module through the second account, the configuration module displays the second interface, and then the second administrator enters the key index corresponding to the specified number. Then the configuration module can associate the key index with the purpose by number. However, neither administrator knows the corresponding relationship between the key and the purpose.

[0043] In some embodiments, the first key purpose is displayed on a key storage medium, and the first account user covers or smears a display area on the key medium where the first key purpose is located, and replaces the mark with the first number.

[0044] The embodiment of the present application accesses two pages through two accounts, obtains a set of key information referenced by a key through the two pages respectively, and associates the separately input information together using numbers, thereby preventing one person from mastering the complete key information and reducing the risk of leakage.

[0045] In some embodiments, the configuration module is provided with a random configuration mode. In the random configuration mode, the encryption machine randomly generates a batch of keys for use in batches. The configuration module is used to obtain the second key usage, and randomly generate a second number corresponding to the second key usage, and randomly select a key index, write the second number, the second key usage and the random key index as a set of data into the key mapping table, and encrypt and store the key mapping table.

[0046] In some embodiments, in order to ensure the security of the most critical information, the key mapping table is encrypted and stored. Even if the location of the key mapping table is known, the mapping table content cannot be directly read. This approach can increase the security performance of the encryption system.

[0047] In some embodiments, the configuration module and the encryption engine are configured in an independent security environment.

[0048] On the other hand, the embodiment of the present application provides a specified key configuration mode, including the following steps:

[0049] The first account user manages the key storage medium and replaces the first key usage with the first number;

[0050] Displaying the first interface according to the request when the first account is accessed;

[0051] The first interface displays the currently configurable key usages. Select one of the usages to be configured.

[0052] Through the first interface, the first account user enters the first number according to the mark on the key storage medium;

[0053] The second account user uses the key storage medium to import the key into the encryption machine and obtain the key index;

[0054] Displaying the second interface according to the request when the second account is accessed;

[0055] The second interface displays the first number currently to be configured;

[0056] According to the second interface display, the second account user retrieves the key index corresponding to the first number and enters the key index;

[0057] Writing the first number, the first key usage and the designated key index into the key mapping table as a set of data;

[0058] The key mapping table is stored encrypted.

[0059] In some embodiments, before displaying the first interface according to the request during access by the first account, the following steps are also included:

[0060] A selection interface for the key configuration mode is displayed, wherein the selection interface includes a first button for entering the specified key configuration mode and a second button for entering the random key configuration mode.

[0061] If the integrated unit described in the present application is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0062] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. An encryption system, characterized in that ,include: The encryption machine is used to store the key and complete encryption and / or decryption according to the client's request; A configuration module is used to automatically generate a key mapping table to hide information about the business system calling a key from everyone, wherein the key mapping table is used to store at least one set of key reference information, wherein a set of key reference information includes three data: a number, a key purpose, and a key index; The configuration module is provided with a specified key configuration mode: In the designated key configuration mode, the configuration module is used to select the first key purpose through the first interface and fill in the first number according to the first key purpose, select the first number through the second interface and fill in the corresponding key index according to the first number, and write the first number, the first key purpose and the designated key index as a set of data into the key mapping table, and encrypt and store the key mapping table; The first interface is displayed when accessed by a first account, and the second interface is displayed when accessed by a second account.

2. The encryption system according to claim 1, characterized in that: The encryption machine selects a corresponding key index according to the key usage in the client request, and encrypts or decrypts the data pointed to by the request.

3. The encryption system according to claim 1, characterized in that: The first key usage is displayed on the key storage medium, and the first account user covers or smears the area where the first key usage is located on the key medium, and replaces the mark with the first number.

4. The encryption system according to claim 1, characterized in that: The configuration module is provided with a random configuration mode. In the random configuration mode, the encryption machine randomly generates a batch of keys for use in batches. The configuration module is used to obtain the second key usage, and randomly generate a second number corresponding to the second key usage, and randomly select a key index, write the second number, the second key usage and the random key index as a set of data into the key mapping table, and encrypt and store the key mapping table.

5. The encryption system according to claim 1, characterized in that: The key mapping table is encrypted and stored in a secure and confidential area.

6. The encryption system according to claim 1, characterized in that: The configuration module and the encryption machine are configured in an independent security environment.

7. A key configuration and calling method for an encryption system according to any one of claims 1 to 6, characterized in that: The following steps are involved: The first account user manages the key storage medium and replaces the first key usage with the first number; Displaying the first interface according to the request when the first account is accessed; The first interface displays the currently configurable key usages. Select one of the usages to be configured. Through the first interface, the first account user enters the first number according to the mark on the key storage medium; The second account user uses the key storage medium to import the key into the encryption machine and obtain the key index; Displaying the second interface according to the request when the second account is accessed; The second interface displays the first number currently to be configured; According to the second interface display, the second account user retrieves the key index corresponding to the first number and enters the key index; Writing the first number, the first key usage and the designated key index into the key mapping table as a set of data; The key mapping table is stored encrypted.

8. The key configuration and calling method of an encryption system according to claim 7, characterized in that: Before displaying the first interface according to the request during access by the first account, the method further includes the following steps: A selection interface for the key configuration mode is displayed, wherein the selection interface includes a first button for entering the specified key configuration mode and a second button for entering the random key configuration mode.

Images