Password component invocation method and apparatus

Abstract

The embodiment of the application discloses a password component calling method and device, which can be used in the financial field or other technical fields, and the method comprises the following steps: obtaining password algorithm information and key information; generating a data processing request according to the password algorithm information, the key information and to-be-processed data; determining password algorithm interface information corresponding to the to-be-processed data to be called; calling a corresponding password algorithm interface in a password component according to password algorithm interface calling code corresponding to the password algorithm interface information to be called, and transmitting the data processing request to the password algorithm interface, so that the password component processes the data processing request. The application realizes fast upgrading of the password algorithm, and avoids the situation that sensitive data protected by an old algorithm is cracked due to the fact that the password algorithm is not upgraded in time.

Description

Technical Field

[0001] This invention relates to the field of cryptographic algorithm technology, and more specifically, to a method and apparatus for invoking cryptographic components. Background Technology

[0002] The encryption, decryption, signing, and verification functions of cryptographic algorithms are generally implemented by cryptographic components (such as cryptographic machines and modules), which provide interfaces to callers to perform encryption, decryption, signing, and verification functions. Currently, these interfaces are generally designed from the perspective of cryptographic algorithms, provided in the format of "cryptographic algorithm name + a specific function under that algorithm." For example, cryptographic components support symmetric cryptographic algorithms (AES, SM4, etc.) and asymmetric cryptographic algorithms (RSA, SM2, etc.), with different interfaces for different functions of each algorithm. For instance, the AES algorithm has encryption and decryption interfaces; the SM2 algorithm has interfaces for encryption, decryption, signing, and verification. Callers select the appropriate interface based on the cryptographic algorithm and the required functionality.

[0003] Cryptographic algorithms are generally designed based on intractable mathematical problems or complex transformation logic, and their security depends on the complexity of cracking them. If the time required to crack the algorithm far exceeds the data's confidentiality period, then the cryptographic algorithm is secure. For example, if an attacker using the most powerful supercomputer and the best cracking methods would need 100 million years to crack the algorithm, far exceeding the data's confidentiality period, then the cryptographic algorithm is secure. However, due to technological advancements, future advancements may bring even stronger computing power or more efficient cracking methods, significantly shortening the cracking time and rendering the cryptographic algorithm insecure. Therefore, in the long run, cryptographic algorithms require continuous upgrades; when a particular cryptographic algorithm becomes insecure, it needs to be upgraded to a more secure one.

[0004] The current interface design, based on the dimension of "cryptographic algorithm name + a specific function under that algorithm," requires the caller to modify its own code to call the new algorithm interface when the cryptographic component invokes it. This involves code development, testing, installation, and deployment, resulting in a significant workload and lengthy algorithm upgrade time. This is particularly problematic in scenarios where the business involves collaboration between multiple information systems from different organizations. Algorithm upgrades require consensus among these systems to uniformly modify the invoked cryptographic algorithm interface, further complicating coordination, extending the upgrade cycle, and posing a risk of sensitive data being compromised due to untimely cryptographic component invocation.

[0005] This section is intended to provide background or context for the embodiments of the invention set forth in the claims. The description herein is not an admission that it is prior art simply because it is included in this section. Summary of the Invention

[0006] In order to solve at least one of the technical problems in the background art, the present invention proposes a method and apparatus for invoking cryptographic components.

[0007] To achieve the above objectives, according to one aspect of the present invention, a method for invoking a cryptographic component is provided, the method comprising:

[0008] Obtain cryptographic algorithm information and key information;

[0009] A data processing request is generated based on the cryptographic algorithm information, the key information, and the data to be processed.

[0010] Determine the cryptographic algorithm interface information to be invoked corresponding to the data to be processed;

[0011] Based on the cryptographic algorithm interface call code corresponding to the cryptographic algorithm interface information to be called, the corresponding cryptographic algorithm interface in the cryptographic component is called, and the data processing request is transmitted to the cryptographic algorithm interface so that the cryptographic component processes the data processing request.

[0012] Optionally, obtaining the cryptographic algorithm information and key information specifically includes:

[0013] The system obtains the cryptographic algorithm information and key information configured in the parameter system. Each time the cryptographic algorithm is upgraded, the cryptographic algorithm information and key information configured in the parameter system are updated according to the upgraded cryptographic algorithm.

[0014] Optionally, the acquisition of cryptographic algorithm information and key information configured in the parameter system specifically includes:

[0015] The system obtains the cryptographic algorithm information and key information pushed by the parameter system. Each time the cryptographic algorithm information and key information configured in the parameter system are updated, the parameter system pushes the updated cryptographic algorithm information and key information.

[0016] Optionally, the cryptographic component invocation method may also include:

[0017] Receive the data processing result corresponding to the data processing request sent by the cryptographic component;

[0018] The data processing result, the cryptographic algorithm information, and the key information are sent to the next caller in the business processing flow, so that the next caller can generate a data processing request based on the cryptographic algorithm information and the key information.

[0019] Optionally, obtaining the cryptographic algorithm information and key information specifically includes:

[0020] Receive the cryptographic algorithm information and key information sent by the previous caller in the business processing flow.

[0021] Optionally, the cryptographic algorithm interface specifically includes: a data encryption interface, a data decryption interface, a data signature interface, a data signature verification interface, an integrity verification code generation interface, and an integrity verification interface.

[0022] Optionally, the cryptographic algorithm information includes: cryptographic algorithm name, symmetric algorithm encryption mode, padding rules, and symmetric algorithm initialization vector; the key information includes: key number and / or ciphertext, and key length.

[0023] To achieve the above objectives, according to another aspect of the present invention, a cryptographic component invocation apparatus is provided, the apparatus comprising:

[0024] The information acquisition unit is used to acquire cryptographic algorithm information and key information;

[0025] A data processing request generation unit is used to generate a data processing request based on the cryptographic algorithm information, the key information, and the data to be processed.

[0026] The cryptographic algorithm interface to be invoked determination unit is used to determine the cryptographic algorithm interface information to be invoked corresponding to the data to be processed;

[0027] The cryptographic algorithm interface invocation unit is used to invoke the corresponding cryptographic algorithm interface in the cryptographic component according to the cryptographic algorithm interface invocation code corresponding to the cryptographic algorithm interface information to be invoked, and to transmit the data processing request to the cryptographic algorithm interface so that the cryptographic component processes the data processing request.

[0028] To achieve the above objectives, according to another aspect of the present invention, a computer device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described cryptographic component invocation method.

[0029] To achieve the above objectives, according to another aspect of the present invention, a computer-readable storage medium is also provided, on which a computer program / instructions are stored, which, when executed by a processor, implement the steps of the cryptographic component invocation method described above.

[0030] To achieve the above objectives, according to another aspect of the present invention, a computer program product is also provided, comprising a computer program / instructions that, when executed by a processor, implement the steps of the cryptographic component invocation method described above.

[0031] The beneficial effects of this invention are as follows:

[0032] This invention extracts cryptographic algorithm information and key information from the cryptographic algorithm interface call code, and configures these information as configuration parameters. Therefore, when a cryptographic algorithm upgrade is needed, all callers do not need to modify their own code; instead, they only need to modify the parameter values ​​of the cryptographic algorithm and key information. The caller will automatically process the data (e.g., encryption, decryption, signing, verification, etc.) using the upgraded cryptographic algorithm and key according to the new parameters. This eliminates the need for code modification, testing, installation, and deployment, enabling rapid cryptographic algorithm upgrades and preventing the compromise of sensitive data protected by the old algorithm due to untimely upgrades. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0034] Figure 1 This is the first flowchart of the cryptographic component invocation method according to an embodiment of the present invention;

[0035] Figure 2 This is a second flowchart of the cryptographic component invocation method according to an embodiment of the present invention;

[0036] Figure 3 This is a first schematic diagram illustrating the invocation of the cryptographic component according to an embodiment of the present invention;

[0037] Figure 4 This is a second schematic diagram illustrating the invocation of the cryptographic component in an embodiment of the present invention;

[0038] Figure 5 This is a third schematic diagram illustrating the invocation of the cryptographic component in an embodiment of the present invention;

[0039] Figure 6 This is a structural block diagram of the cryptographic component invocation device according to an embodiment of the present invention;

[0040] Figure 7 This is a schematic diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0041] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0042] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0043] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification, claims and accompanying drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products or devices.

[0044] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0045] It should be noted that the acquisition, storage, use, and processing of data in the technical solution of this application all comply with the relevant provisions of national laws and regulations.

[0046] It should be noted that the cryptographic component invocation method and apparatus of the present invention can be used in the financial field, or in any field other than the financial field. The application field of the cryptographic component invocation method and apparatus of the present invention is not limited.

[0047] This invention provides a method for rapid upgrades of cryptographic algorithms. First, different cryptographic algorithms implementing the same function are encapsulated into a single interface from a business functionality perspective. Then, through standardized and configurable interface parameters, information related to the cryptographic algorithm and key is extracted from the caller's code and stored as configuration parameters in a parameter system. When an upgrade is needed, all callers do not need to modify their own code; instead, they modify the cryptographic algorithm and key parameter values ​​in the parameter system. The caller will automatically process the data (e.g., encryption, decryption, signing, verification, etc.) using the upgraded cryptographic algorithm and key according to the new parameters. This eliminates the need for code modification, testing, installation, and deployment, enabling rapid upgrades and preventing the compromise of sensitive data protected by the old algorithm due to untimely calls to cryptographic components.

[0048] To better understand the technical principles behind this invention, a brief explanation of existing cryptographic algorithm interfaces, processing flows, and algorithm upgrade methods will be provided first.

[0049] The following table 1 shows examples of cryptographic algorithm interfaces designed using the "cryptographic algorithm name + a specific function under that algorithm" dimension:

[0050]

[0051]

[0052] Table 1

[0053] The following uses the AES data encryption interface (AES_En) and the AES data decryption interface (AES_De) as examples to illustrate the processing flow of existing cryptographic algorithm interfaces. In this example, although the cryptographic component supports the SM4 algorithm, the caller specifies the use of the AES algorithm; therefore, the caller's code only involves AES_En and AES_De.

[0054] like Figure 4 As shown, caller A invokes the AES_En interface of cryptographic component A through its program's AES_En call code, requesting the encryption of certain data using the AES algorithm and key AB. Upon receiving the request, cryptographic component A's AES_En interface performs the encryption process and returns the result to caller A, who then sends the encrypted data to caller B.

[0055] Caller B invokes the AES_De interface of cryptographic component B through its internal AES_De call code, requesting the decryption of certain data using the AES algorithm and key AB. Upon receiving the request, cryptographic component B's AES_De interface decrypts the data and returns the result to caller B. Depending on the business process requirements, caller B can directly process the decrypted data, or it can re-encrypt the data using the AES_En interface and key BC of cryptographic component B before sending it to caller C for decryption. AES_De and AES_En can also be encapsulated into a single interface, enabling decryption with key AB followed by encryption with key BC. If necessary, caller C can re-encrypt the data and send it to other callers until the complete business logic processing is finished.

[0056] Callers A, B, C, etc., may belong to the same company or different companies. When some callers belong to the same company, their cryptographic components may be the same or they may be independent. When callers belong to different companies, the cryptographic components are usually deployed independently, such as... Figure 3 As shown, the cryptographic component can be deployed as a module integrated with the caller, or it can provide remote invocation services to the caller via the network.

[0057] When upgrading the AES algorithm to the SM4 algorithm, it is necessary to coordinate with all callers, including A, B, C, etc., and modify the AES_En call code to the SM4_En call code and the AES_De call code to the SM4_De call code (no adjustment is needed on the cryptographic component side). Only after completing the code modification, testing, installation and deployment according to the software research process can the cryptographic algorithm be upgraded, which takes a long time.

[0058] To address the issues of complex coordination, high workload, and long upgrade cycles associated with algorithm upgrades, this invention proposes a cryptographic component invocation method to avoid existing problems and achieve rapid upgrades of cryptographic algorithms. This invention innovates through four aspects: designing cryptographic algorithm interfaces from a business function perspective, standardizing cryptographic algorithm interface parameters, configuring cryptographic algorithm and key information, and adding cryptographic algorithm and key parameters to transmission messages. This allows for rapid upgrades of cryptographic algorithms by requiring only the first caller to modify the cryptographic algorithm and key parameters in its parameter system; subsequent callers do not need to modify their invocation code.

[0059] It should be noted that the execution subject of the cryptographic component invocation method in the following embodiments of the present invention is the caller, that is, the cryptographic component invocation method of the present invention is applied to the caller.

[0060] Figure 1 This is the first flowchart of the cryptographic component invocation method according to an embodiment of the present invention, as follows: Figure 1 As shown, in one embodiment of the present invention, the cryptographic component invocation method of the present invention includes steps S101 to S104.

[0061] Step S101: Obtain cryptographic algorithm information and key information.

[0062] In one embodiment of the present invention, the cryptographic algorithm information includes: cryptographic algorithm name, symmetric algorithm encryption mode, padding rules, and symmetric algorithm initialization vector; the key information includes: key number and / or ciphertext, and key length.

[0063] This invention designs the cryptographic algorithm calling code in the caller from the perspective of implemented business functions. It extracts the cryptographic algorithm information and key information from the cryptographic algorithm interface calling code and configures the cryptographic algorithm information and key information as configuration parameters. Therefore, when the cryptographic algorithm needs to be upgraded, all callers do not need to modify their own code. Instead, they modify the parameter values ​​of the cryptographic algorithm information and key information. The caller will automatically process the data (such as encryption, decryption, signing, and verification) using the upgraded cryptographic algorithm and key according to the new parameters. This eliminates the need for code modification, testing, installation and deployment processes, and enables rapid upgrade of cryptographic algorithms.

[0064] Step S102: Generate a data processing request based on the cryptographic algorithm information, the key information, and the data to be processed.

[0065] Step S103: Determine the cryptographic algorithm interface information to be invoked corresponding to the data to be processed.

[0066] Step S104: According to the cryptographic algorithm interface call code corresponding to the cryptographic algorithm interface information to be called, the corresponding cryptographic algorithm interface in the cryptographic component is called, and the data processing request is transmitted to the cryptographic algorithm interface so that the cryptographic component processes the data processing request.

[0067] In one embodiment of the present invention, the cryptographic algorithm interface specifically includes: a data encryption interface, a data decryption interface, a data signature interface, a data signature verification interface, an integrity verification code generation interface, and an integrity verification interface.

[0068] This invention designs the cryptographic algorithm interfaces in cryptographic components from the perspective of the required business functions, encapsulating different cryptographic algorithms with the same business function into a single interface. For example, the cryptographic algorithm interfaces can be categorized as data encryption, data decryption, data signing, data signature verification, integrity verification code generation, and integrity verification code validation. Each interface supports multiple cryptographic algorithms that can implement its business function, as shown in Table 2 below.

[0069]

[0070] Table 2

[0071] To support different cryptographic algorithms under the same interface, the interface parameters need to be standardized, specifically divided into two main parts: interface input parameters and interface return parameters. Interface input parameters are the parameters provided by the caller to the cryptographic component, while interface return parameters are the calculation results returned by the cryptographic component. The interface input parameters can be further divided into four parts: data to be processed, data to be compared, cryptographic algorithm information, and key information. The specific content of the parameters may differ for different algorithm interfaces.

[0072] by Figure 5 Taking the Data_En data encryption interface as an example, its interface parameters can be represented as Data_En(data1,data2,algInfo,keyInfo,output), where:

[0073] data1, the data to be processed.

[0074] data2 represents the data to be compared. This interface does not have this field; it can be removed or given a default value (e.g., null). For interfaces such as integrity verification and signature verification, this field sends integrity verification codes, signature values, and other information to be compared with the processing results of data1 to confirm whether the verification codes and signature values ​​are correct.

[0075] `algInfo` contains information about the cryptographic algorithm used for encryption, including the specific algorithm name (e.g., AES128, AES256, SM4, RSA2048, SM2, etc.), the symmetric encryption mode (e.g., ECB, CBC, GCM, etc.), the padding rule (PKCS#5, NOPADDING, etc.), and the initialization vector of the symmetric algorithm. For easier understanding and configuration, the required combinations can be formatted into a string with a fixed format, such as: AES128-ECB-NOPADDING-01234567, SM4-CBC-PKCS#5-12345670.

[0076] keyInfo contains key information, including the key number (or key ciphertext) and key length. Examples of key information include: 1A37B48847387C6353653D84848F0154-128, 2846B8475980E84760C84759DA37B488-128, etc.

[0077] The output is the result of the interface processing, i.e., the encrypted ciphertext.

[0078] In one embodiment of the present invention, after receiving a data processing request, the cryptographic component processes the data to be processed using the selected cryptographic algorithm and key based on algInfo (cryptographic algorithm information) and keyInfo (key information), and returns the processing result as output to the caller, thereby completing the data processing flow.

[0079] In one embodiment of the present invention, the step S101 of obtaining cryptographic algorithm information and key information specifically includes:

[0080] The system obtains the cryptographic algorithm information and key information configured in the parameter system. Each time the cryptographic algorithm is upgraded, the cryptographic algorithm information and key information configured in the parameter system are updated according to the upgraded cryptographic algorithm.

[0081] This invention avoids hardcoding the caller's algInfo (cryptographic algorithm information) and keyInfo (key information) into the interface call code, instead placing them as configuration parameters in a parameter system. In one embodiment of this invention, a corresponding parameter system can be set for each caller, or multiple callers can share a single parameter system.

[0082] After the above modification, when upgrading the cryptographic algorithm, the relevant caller only needs to synchronously modify the values ​​of algInfo and keyInfo parameters in the parameter system, without the need for coding, testing, and deployment, which greatly improves the timeliness of cryptographic algorithm upgrades.

[0083] For example, when upgrading the data transmission encryption algorithm from AES128 to SM4, all callers do not need to modify their interface call code. They only need to change the algInfo (cryptographic algorithm information) from AES128-ECB-NOPADDING-01234567 to SM4-CBC-PKCS#5-12345670 in the parameter system, and change the keyInfo (key information) from 1A37B48847387C6353653D84848F0154-128 to 2846B8475980E84760C84759DA37B488-128 to achieve the algorithm upgrade. At this point, caller A's Data_En interface, caller B's Data_De and Data_En interfaces, and caller C's Data_De interface will all be upgraded to use the new SM4 algorithm and the new key for encryption and decryption based on the new algInfo and keyInfo parameter values.

[0084] In one embodiment of the present invention, if the executing entity of the above step S101 is the first caller in the business processing flow, then the cryptographic algorithm information and key information are obtained from the preset parameter system.

[0085] In one embodiment of the present invention, the steps of obtaining the cryptographic algorithm information and key information configured in the parameter system specifically include:

[0086] The system obtains the cryptographic algorithm information and key information pushed by the parameter system. Each time the cryptographic algorithm information and key information configured in the parameter system are updated, the parameter system pushes the updated cryptographic algorithm information and key information.

[0087] In one embodiment of the present invention, the parameter system of the present invention can be built on open source software such as Apollo, and has the ability to actively push and take effect when parameter values ​​change.

[0088] Figure 2 This is a second flowchart of the cryptographic component invocation method according to an embodiment of the present invention, as follows: Figure 2 As shown, in one embodiment of the present invention, the cryptographic component invocation method of the present invention includes steps S201 and S202.

[0089] Step S201: Receive the data processing result corresponding to the data processing request sent by the cryptographic component.

[0090] Step S202: The data processing result, the cryptographic algorithm information, and the key information are sent to the next caller in the business processing flow, so that the next caller can generate a data processing request based on the cryptographic algorithm information and the key information.

[0091] like Figure 5 As shown, in the business processing flow, after processing the data, the caller sends the data processing result to the next caller, along with the cryptographic algorithm information and key information. For example, when caller A sends the data processing result to caller B, it also sends algInfo (cryptographic algorithm information) and keyInfo (key information) to caller B.

[0092] Existing techniques require all callers to apply new parameters simultaneously. If a caller applies the new parameters earlier or later, transactions in transit may fail due to algorithm or key mismatches. To avoid this problem and reduce complexity, this invention transmits the algInfo and keyInfo information along with the business message from the first caller to the last. Parameter modifications are only implemented by the first caller. From the second caller onwards, the specified cryptographic algorithm and key are directly selected based on the algInfo and keyInfo transmitted from the previous caller, without requiring modification of the cryptographic algorithm and key parameters in the code or parameter system.

[0093] In one embodiment of the present invention, the step S101 of obtaining cryptographic algorithm information and key information specifically includes:

[0094] Receive the cryptographic algorithm information and key information sent by the previous caller in the business processing flow.

[0095] In one embodiment of the present invention, if the executing entity of step S101 is not the first caller in the business processing flow, the cryptographic algorithm information and key information can be obtained from the previous caller in the business processing flow. Specifically, when the previous caller in the business processing flow sends its business processing result to this caller, it will also send the cryptographic algorithm information and key information.

[0096] As can be seen from the above embodiments, the present invention enables cryptographic algorithm upgrades to be completed by only requiring the first caller to modify parameters. This avoids the problems of high coordination difficulty, large workload, and long algorithm upgrade cycle caused by the traditional method, which requires all callers to modify interface code, test, install and deploy simultaneously. This greatly improves the timeliness of algorithm upgrades and reduces the risk of sensitive data being cracked due to the failure to upgrade the old algorithm in a timely manner.

[0097] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0098] Based on the same inventive concept, embodiments of the present invention also provide a cryptographic component invocation apparatus, which can be used to implement the cryptographic component invocation method described in the above embodiments, as described in the following embodiments. Since the principle by which the cryptographic component invocation apparatus solves the problem is similar to that of the cryptographic component invocation method, embodiments of the cryptographic component invocation apparatus can refer to embodiments of the cryptographic component invocation method, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0099] Figure 6 This is a structural block diagram of the cryptographic component invocation device according to an embodiment of the present invention, as shown below. Figure 6 As shown, in one embodiment of the present invention, the cryptographic component invocation device of the present invention includes:

[0100] Information acquisition unit 1 is used to acquire cryptographic algorithm information and key information;

[0101] The data processing request generation unit 2 is used to generate a data processing request based on the cryptographic algorithm information, the key information, and the data to be processed.

[0102] The cryptographic algorithm interface to be invoked determination unit 3 is used to determine the cryptographic algorithm interface information to be invoked corresponding to the data to be processed;

[0103] The cryptographic algorithm interface calling unit 4 is used to call the corresponding cryptographic algorithm interface in the cryptographic component according to the cryptographic algorithm interface calling code corresponding to the cryptographic algorithm interface information to be called, and to transmit the data processing request to the cryptographic algorithm interface so that the cryptographic component can process the data processing request.

[0104] In one embodiment of the present invention, the information acquisition unit 1 is specifically used to acquire cryptographic algorithm information and key information configured in the parameter system, wherein each time the cryptographic algorithm is upgraded, the cryptographic algorithm information and key information configured in the parameter system are updated according to the upgraded cryptographic algorithm.

[0105] In one embodiment of the present invention, the information acquisition unit 1 specifically includes:

[0106] The push information receiving module is used to obtain the cryptographic algorithm information and key information pushed by the parameter system. The parameter system pushes the updated cryptographic algorithm information and key information after each update of the cryptographic algorithm information and key information configured in the parameter system.

[0107] In one embodiment of the present invention, the cryptographic component invocation device of the present invention further includes:

[0108] A data processing result receiving unit is used to receive the data processing result corresponding to the data processing request sent by the cryptographic component;

[0109] The data sending unit is used to send the data processing result, the cryptographic algorithm information, and the key information to the next caller in the business processing flow, so that the next caller can generate a data processing request based on the cryptographic algorithm information and the key information.

[0110] In one embodiment of the present invention, the information acquisition unit 1 specifically includes:

[0111] The data receiving module is used to receive cryptographic algorithm information and key information sent by the previous caller in the business processing flow.

[0112] To achieve the above objectives, according to another aspect of this application, a computer device is also provided. For example... Figure 7As shown, the computer device includes a memory, a processor, a communication interface, and a communication bus. The memory stores a computer program that can run on the processor. When the processor executes the computer program, it implements the steps in the method of the above embodiments.

[0113] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0114] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and units, such as the program units corresponding to the above-described method embodiments of the present invention. The processor executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the methods described in the above-described method embodiments.

[0115] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0116] The one or more units are stored in the memory and, when executed by the processor, perform the methods described in the above embodiments.

[0117] The specific details of the aforementioned computer equipment can be understood by referring to the relevant descriptions and effects in the above embodiments, and will not be repeated here.

[0118] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed in a computer processor, implements the steps in the cryptographic component invocation method described above. Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0119] To achieve the above objectives, according to another aspect of this application, a computer program product is also provided, including a computer program / instructions that, when executed by a processor, implement the steps of the cryptographic component invocation method described above.

[0120] Obviously, those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps as a single integrated circuit module. Thus, the present invention is not limited to any particular hardware and software combination.

[0121] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for invoking a cryptographic component, characterized in that, include: Obtain cryptographic algorithm information and key information; A data processing request is generated based on the cryptographic algorithm information, the key information, and the data to be processed. Determine the cryptographic algorithm interface information to be invoked corresponding to the data to be processed; Based on the cryptographic algorithm interface call code corresponding to the cryptographic algorithm interface information to be called, the corresponding cryptographic algorithm interface in the cryptographic component is called, and the data processing request is transmitted to the cryptographic algorithm interface so that the cryptographic component processes the data processing request. Specifically, obtaining the cryptographic algorithm information and key information includes: The system retrieves the cryptographic algorithm information and key information configured in the parameter system. Each time the cryptographic algorithm is upgraded, the cryptographic algorithm information and key information configured in the parameter system are updated according to the upgraded cryptographic algorithm. The cryptographic algorithm information and key information configured in the parameter system are extracted from the cryptographic algorithm interface call code and stored in the parameter system as configuration parameters. The method further includes: Receive the data processing result corresponding to the data processing request sent by the cryptographic component; The data processing result, the cryptographic algorithm information, and the key information are sent to the next caller in the business processing flow, so that the next caller can generate a data processing request based on the cryptographic algorithm information and the key information; wherein, each time the cryptographic algorithm is upgraded, the first caller in the business processing flow synchronously modifies the cryptographic algorithm information and the key information in the parameter system.

2. The method for invoking a cryptographic component according to claim 1, characterized in that, The acquisition of cryptographic algorithm information and key information configured in the parameter acquisition system specifically includes: The system obtains the cryptographic algorithm information and key information pushed by the parameter system. Each time the cryptographic algorithm information and key information configured in the parameter system are updated, the parameter system pushes the updated cryptographic algorithm information and key information.

3. The method for invoking a cryptographic component according to claim 1, characterized in that, The acquisition of cryptographic algorithm information and key information specifically includes: Receive the cryptographic algorithm information and key information sent by the previous caller in the business processing flow.

4. The method for invoking a cryptographic component according to claim 1, characterized in that, The cryptographic algorithm interface specifically includes: a data encryption interface, a data decryption interface, a data signature interface, a data signature verification interface, an integrity verification code generation interface, and an integrity verification interface.

5. The method for invoking a cryptographic component according to claim 1, characterized in that, The cryptographic algorithm information includes: cryptographic algorithm name, symmetric algorithm encryption mode, padding rules, and symmetric algorithm initialization vector; the key information includes: key number and / or ciphertext, and key length.

6. A cryptographic component invocation device, characterized in that, include: The information acquisition unit is used to acquire cryptographic algorithm information and key information; A data processing request generation unit is used to generate a data processing request based on the cryptographic algorithm information, the key information, and the data to be processed. The cryptographic algorithm interface to be invoked determination unit is used to determine the cryptographic algorithm interface information to be invoked corresponding to the data to be processed; The cryptographic algorithm interface calling unit is used to call the corresponding cryptographic algorithm interface in the cryptographic component according to the cryptographic algorithm interface calling code corresponding to the cryptographic algorithm interface information to be called, and to transmit the data processing request to the cryptographic algorithm interface so that the cryptographic component can process the data processing request. The information acquisition unit is specifically used to acquire the cryptographic algorithm information and key information configured in the parameter system. Each time the cryptographic algorithm is upgraded, the cryptographic algorithm information and key information configured in the parameter system are updated according to the upgraded cryptographic algorithm. The cryptographic algorithm information and key information configured in the parameter system are extracted from the cryptographic algorithm interface call code and stored in the parameter system as configuration parameters. The device further includes: A data processing result receiving unit is used to receive the data processing result corresponding to the data processing request sent by the cryptographic component; The data sending unit is used to send the data processing result, the cryptographic algorithm information, and the key information to the next caller in the business processing flow, so that the next caller can generate a data processing request based on the cryptographic algorithm information and the key information; wherein, each time the cryptographic algorithm is upgraded, the first caller in the business processing flow synchronously modifies the cryptographic algorithm information and the key information in the parameter system.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 5.

9. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 5.

Images