Modular cryptographic service method for cloud environment

Abstract

The present application relates to a kind of modular cryptographic service processing systems for cloud environment, wherein the system includes: cryptographic management system is responsible for the software and hardware system of key management, cryptographic resource management, certificate management, monitoring audit under entire cloud environment, with one or more HSM;Cryptographic security protection system is responsible for the software and hardware system of key management and service of all cryptographic security modules in certain security domain of cloud environment;Cryptographic security module is integrated in certain business application node inside cloud environment, and it is responsible for the software module of providing cryptographic service to it;And each cryptographic security module is from the specific corresponding cryptographic security protection system.This application also relates to a corresponding method, using the modular cryptographic service processing system for cloud environment of the present application, can solve the problems of existing cryptographic technology protection data security solution in cloud environment, such as leakage risk in encrypted data transmission, low data protection efficiency, scale compared with increasing input cost, etc.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information network security, in particular to the technical field of cryptography, and more particularly to a modular cryptographic service processing system for cloud environment and a method thereof. BACKGROUND

[0002] Cryptography is the most important means of data security protection. The existing information system uses cryptography to protect data security, which is mostly equipped with a hardware security module (HSM), and the data to be protected is pushed to the HSM, and the HSM performs encryption. This method has the following problems: before entering the HSM, the data to be encrypted is transmitted in plaintext in the network link, increasing the risk of data leakage; the time required for each data encryption is the sum of the data transmission time to the HSM and the HSM encryption time, resulting in low data protection efficiency; as the information scale expands, the HSM also needs to expand the HSM cluster scale in proportion to the expansion of the system hardware resources, and the investment cost is increasing. The current solution to the problem of protecting data security by cryptography in cloud environment is to virtualize the HSM into multiple virtual security modules (vHSM), and the HSM cluster is converted into a vHSM cluster to form a cryptographic resource pool, and one or more vHSMs are allocated to each application. This method improves the efficiency of cryptographic resource utilization, but the problems of data leakage risk during transmission of data to be encrypted, low data protection efficiency, and increasing investment cost in proportion to the scale still exist in non-cloud environments. SUMMARY

[0003] The present application aims to overcome the above-mentioned shortcomings of the prior art, and provides a modular cryptographic service processing system for cloud environment and a method thereof, which can realize secure, efficient and economical cryptographic protection services in cloud environment.

[0004] In order to achieve the above-mentioned purpose, the modular cryptographic service processing system for cloud environment and the method thereof are as follows:

[0005] The modular cryptographic service processing system for cloud environment has the following main features: the system comprises a cryptographic service architecture for cloud environment, which specifically comprises a cryptographic management system, a cryptographic security protection system and a cryptographic security module, wherein,

[0006] The cryptographic management system is arranged in the cryptographic system layer of the cryptographic service architecture, and is used for managing the key management, cryptographic resource management, certificate management and monitoring and auditing of the entire cloud environment, and is equipped with one or more HSMs.

[0007] The cryptographic security protection system is arranged in the cryptographic system layer of the cryptographic service architecture, and is a software and hardware system responsible for key management and services of all cryptographic security modules in a certain security domain of the cloud environment and integrated with the HSM.

[0008] The cryptographic security module is arranged in the business application layer of the cryptographic service architecture, is integrated in a certain business application node of the cloud environment, and is a software module responsible for providing cryptographic services.

[0009] Each cryptographic security module belongs to a specific corresponding cryptographic security protection system.

[0010] The method for providing modular cryptographic services for the cloud environment based on the system mainly includes: managing the cryptographic security modules in the system; and providing cryptographic protection when communicating between different business application nodes of an application system and when communicating between business application nodes of different application systems.

[0011] Preferably, the management of the cryptographic security modules in the system includes: cryptographic security module registration, cryptographic security module running, and cryptographic security module deregistration.

[0012] The cryptographic security module registration includes: after the cryptographic security module is integrated into the business application node, generating a module identifier and an asymmetric key pair representing the cryptographic security module according to node information provided or collected by the business application node, forming a registration request containing the module identifier and public key information, and submitting the registration request to the cryptographic management system; the cryptographic management system audits the registration request, and after the audit is passed, issues a module digital certificate, and returns the cryptographic security protection system information and the module digital certificate to the cryptographic security module.

[0013] Preferably, the cryptographic security module running includes:

[0014] After the cryptographic security module is registered, the cryptographic security module and the cryptographic security protection system perform mutual authentication based on their respective digital certificates, and a secure transmission channel is established; when receiving a cryptographic service request from the business application node, the cryptographic security module obtains a required working key from the cryptographic security protection system through the secure transmission channel, and is destroyed after the cryptographic service is completed.

[0015] Preferably, the cryptographic security module deregistration includes active deregistration and passive deregistration.

[0016] The password security module is passively logged off by the password management system, and the password management system sends a log-off message to the password security protection system, and the password security protection system immediately cuts off the secure transmission channel with the password security module and no longer connects with the password security module.

[0017] The specific processing flow of the passive log-off of the password security module includes:

[0018] The password management system logs off the digital certificate of the password security module, and immediately sends a log-off message to the password security protection system, and the password security protection system immediately cuts off the secure transmission channel with the password security module and no longer connects with the password security module.

[0019] Preferably, the password protection processing for the communication between different business application nodes in the application system includes the definition of the application internal data password protection service interface and the application internal data password protection processing, wherein,

[0020] The definition of the application internal data password protection service interface includes input parameters and output parameters, the input parameters include application identification, data plaintext, and data plaintext length, and the output parameters include encrypted result data and encrypted result data length; wherein the encrypted result data specifically includes data ciphertext, data ciphertext length, data ciphertext hash value, dispersion factor, application identification, and this time password security module identification.

[0021] Preferably, the application internal data password protection processing specifically includes encryption flow processing and decryption flow processing; wherein,

[0022] The encryption flow processing specifically includes that when the password security module as a sender receives data plaintext, the working key and the used dispersion factor are obtained from the password security protection system according to the application identification, the data plaintext is encrypted using the working key to obtain data ciphertext, the hash value of the data ciphertext is calculated, the output parameters are formed, the result is returned, and the working key is destroyed;

[0023] The decryption flow processing specifically includes that when the password security module as a receiver receives encrypted result data, the hash value is verified, and the working key is obtained from the password security protection system according to the application identification and the dispersion factor in the encrypted result data, and the data plaintext is obtained by decrypting the data ciphertext using the working key, the result is returned, and the working key is destroyed.

[0024] Preferably, the cryptographic protection processing when communicating between the service application nodes of the different application systems comprises: defining an inter-application data cryptographic protection service interface and performing inter-application data cryptographic protection processing, wherein

[0025] The defining of the inter-application data cryptographic protection service interface comprises: input parameters and output parameters; the input parameters comprise a sender cryptographic security module identifier, a receiver cryptographic security module identifier, data plaintext, data plaintext length and a timestamp; the output parameters comprise encrypted result data and encrypted result data length; the encrypted result data comprises the sender cryptographic security module identifier, the receiver cryptographic security module identifier, a working key ciphertext, a message ciphertext and a message ciphertext length.

[0026] Preferably, the inter-application data cryptographic protection processing comprises: an encryption flow processing and a decryption flow processing.

[0027] The encryption flow processing specifically comprises: after the cryptographic security module as a sender receives data plaintext, signing the input parameters using a private key of itself to obtain a signature value, obtaining a working key and a public key of the receiver cryptographic security module from the cryptographic security protection system according to the receiver cryptographic security module identifier, encrypting a message plaintext composed of the data plaintext, the data plaintext length and the signature value using the working key to obtain a message ciphertext, encrypting the working key using the public key of the receiver cryptographic security module to obtain a working key ciphertext, forming the output parameters, returning a result and destroying the working key.

[0028] Preferably, the decryption flow processing specifically comprises:

[0029] After the cryptographic security module as a receiver receives the message ciphertext, decrypting the working key ciphertext using a private key of itself to obtain the working key, decrypting the message ciphertext using the working key to obtain a message plaintext, obtaining a public key of the sender cryptographic security module from the cryptographic security protection system according to the sender cryptographic security module identifier, verifying the validity of the signature value in the message plaintext, returning a result and destroying the working key.

[0030] The cloud environment-oriented modular cryptographic service processing system and method of the present application, the cryptographic service architecture of which establishes a cryptographic management and service architecture composed of a cryptographic management system, a cryptographic security protection system and a cryptographic security module, and transfers the cryptographic service subject from an HSM and a vHSM to the cryptographic security module, thereby realizing the endogenesis of the cryptographic service capability; the cryptographic security module management method, through cryptographic security module registration, operation management and active and passive cancellation, effectively ensures the safety and controllability of the entire life cycle of the cryptographic security module; the application internal data cryptographic protection method, which realizes efficient and safe cryptographic protection when different business application nodes in an application system communicate; and the application inter data cryptographic protection method, which realizes universal cryptographic protection when business application nodes of different application systems communicate, thereby effectively improving the safety, reliability and convenience of the cryptographic protection of the cloud environment. Moreover, the HSM scale required by the present technical solution does not need to expand in proportion to the scale of the cloud environment, and the cost of cryptographic service investment can be effectively controlled. The present technical solution realizes safe, efficient and economical cryptographic protection service in the cloud environment, and can solve the problems of the existing cryptographic technology for protecting data security in the cloud environment, such as the risk of leakage during the transmission of data to be encrypted, low data protection efficiency, and increasing investment cost in proportion to the scale. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 The system architecture diagram of the cloud environment-oriented modular cryptographic service processing system of the present application.

[0032] Figure 2 The flowchart of the management and processing of the cryptographic security module in the system of the present application.

[0033] Figure 3 The flowchart of the cryptographic protection processing when different business application nodes in an application system communicate.

[0034] Figure 4 The flowchart of the cryptographic protection processing when business application nodes of different application systems communicate. DETAILED DESCRIPTION

[0035] In order to more clearly describe the technical content of the present application, the following further describes in combination with specific embodiments.

[0036] Before the embodiments according to the present application are described in detail, it should be noted that in the following, the terms “comprise”, “contain” or any other variant are intended to cover non-exclusive inclusion, thereby enabling a process, method, article or device including a series of elements to not only include these elements, but also include other elements not explicitly listed or inherent to such a process, method, article or device.

[0037] Referring to Figure 1 The cloud environment-oriented modular cryptographic service processing system shown in the figure, wherein the system comprises: a cloud environment-oriented cryptographic service architecture, which specifically comprises: a cryptographic management system, a cryptographic security protection system, and a cryptographic security module, wherein,

[0038] The cryptographic management system is arranged at the cryptographic system layer of the cryptographic service architecture, and is configured to be responsible for the software and hardware system of key management, cryptographic resource management, certificate management, and monitoring and auditing in the entire cloud environment, and is provided with one or more HSMs.

[0039] The cryptographic security protection system is arranged at the cryptographic system layer of the cryptographic service architecture, and is configured to be responsible for the software and hardware system of key management and services of all cryptographic security modules in a certain security domain of the cloud environment, and is integrated with the HSM.

[0040] The cryptographic security module is arranged at the business application layer of the cryptographic service architecture, is integrated in a certain business application node of the cloud environment, and is configured to be a software module responsible for providing cryptographic services.

[0041] Each cryptographic security module belongs to a specific corresponding cryptographic security protection system.

[0042] The cloud environment-oriented modular cryptographic service processing method based on the above system comprises: managing and processing the cryptographic security module in the system; and performing cryptographic protection processing when the application system communicates between different business application nodes and when the different application systems communicate between business application nodes.

[0043] Referring to Figure 2 As a preferred embodiment of the present application, the management and processing of the cryptographic security module in the system specifically comprises: cryptographic security module registration, cryptographic security module running, and cryptographic security module deregistration, wherein,

[0044] The specific processing flow of the cryptographic security module registration comprises: after the cryptographic security module is distributed and integrated into the business application node, the node information provided or collected by the business application node is used to generate a module identifier and an asymmetric key pair representing the cryptographic security module, a registration request containing the module identifier and public key information is formed, and the registration request is submitted to the cryptographic management system; the cryptographic management system audits the registration request, and after the audit is passed, issues a module digital certificate, and returns the information of the cryptographic security protection system and the module digital certificate to the cryptographic security module.

[0045] As a preferred embodiment of the present application, the specific processing flow of the cryptographic security module running comprises:

[0046] After the registration of the password security module is completed, the password security module and the password security protection system based on the respective digital certificates perform mutual authentication, and a secure transmission channel is established; when receiving a password service request from the business application node, the password security module obtains the required working key from the password security protection system through the secure transmission channel, and destroys the working key after completing the password service.

[0047] As a preferred embodiment of the present application, the password security module logout includes active logout and passive logout, and the specific processing flow of the password security module performing active logout includes:

[0048] The business application node issues a logout instruction, and after the password security module receives the logout instruction, the module identification, the asymmetric key pair and the digital certificate are destroyed, and the logout result is returned to the business application node and the password management system, the password security module stops running, and the password management system logs out the digital certificate of the current password security module;

[0049] The specific processing flow of the password security module performing passive logout includes:

[0050] The password management system logs out the digital certificate of the current password security module, and immediately issues a logout message to the password security protection system to which the password security module belongs, and the password security protection system immediately cuts off the secure transmission channel with the current password security module and no longer connects.

[0051] Please refer to Figure 3 As a preferred embodiment of the present application, the password protection processing for communication between different business application nodes in the application system includes application internal data password protection service interface definition and application internal data password protection processing, wherein,

[0052] The application internal data password protection service interface definition includes input parameters and output parameters, the input parameters include application identification, data plaintext and data plaintext length, and the output parameters include encrypted result data and encrypted result data length; wherein, the encrypted result data specifically includes data ciphertext, data ciphertext length, data ciphertext hash value, dispersion factor, application identification and this time password security module identification.

[0053] As a preferred embodiment of the present application, the application internal data password protection processing specifically includes encryption flow processing and decryption flow processing; wherein,

[0054] The encryption process processing is specifically: when the password security module as a sender receives data plaintext, the working key and the used dispersion factor are obtained from the password security protection system according to the application identifier, the data plaintext is encrypted using the working key to obtain data ciphertext, the hash value of the data ciphertext is calculated to form an output parameter, the result is returned and the working key is destroyed.

[0055] The decryption process processing is specifically: when the password security module as a receiver receives encrypted result data, the hash value is verified, and the working key is obtained from the password security protection system according to the application identifier and the dispersion factor in the hash value, and the data plaintext is obtained by decrypting the data ciphertext using the working key, the result is returned and the working key is destroyed.

[0056] Please refer to Figure 4 As a preferred embodiment of the present application, the password protection processing when communicating between the business application nodes of the application system comprises: performing application data password protection service interface definition and application data password protection processing, wherein,

[0057] The application data password protection service interface definition comprises: input parameters and output parameters; the input parameters comprise sender password security module identifier, receiver password security module identifier, data plaintext, data plaintext length and time stamp; the output parameters comprise encrypted result data and encrypted result data length; wherein the encrypted result data comprises sender password security module identifier, receiver password security module identifier, working key ciphertext, message ciphertext and message ciphertext length.

[0058] As a preferred embodiment of the present application, the application data password protection processing comprises: encryption process processing and decryption process processing; wherein,

[0059] The encryption process processing is specifically: when the password security module as a sender receives data plaintext, the working key and the used dispersion factor are obtained from the password security protection system according to the application identifier, the data plaintext is encrypted using the working key to obtain data ciphertext, the hash value of the data ciphertext is calculated to form an output parameter, the result is returned and the working key is destroyed.

[0060] As a preferred embodiment of the present application, the decryption process processing specifically comprises:

[0061] When the password security module as the receiver receives the message ciphertext, the working key is decrypted using the private key of the password security module to obtain the working key, and the message ciphertext is decrypted using the working key to obtain the message plaintext, the public key of the sender password security module is obtained from the password security protection system through the identification of the sender password security module, the validity of the signature value in the message plaintext is verified, the result is returned, and the working key is destroyed.

[0062] In a specific embodiment of the present application, the cloud environment-oriented password service architecture mainly includes a password management system, a password security protection system, and a password security module, as shown in Figure 1

[0063] In a preferred embodiment, the password management system refers to a software and hardware system responsible for key management, password resource management, certificate management, and monitoring and auditing in the entire cloud environment, which is composed of one or more HSMs in the basic resource layer and password management system software in the password system layer.

[0064] In a preferred embodiment, the password security protection system refers to a software and hardware system responsible for key management and services of all password security modules in a certain security domain (such as a virtual private cloud VPC) of the cloud environment, which is generally integrated with an HSM; the password security protection system has an asymmetric key pair representing itself and a digital certificate issued by the password management system.

[0065] In a preferred embodiment, the password security module refers to a software module integrated in a certain business application node of the cloud environment and responsible for providing password services to the node; each password security module belongs to a specific password security protection system, i.e., the password security protection system to which it belongs.

[0066] In a specific embodiment of the present application, the management and processing of the password security module in the system are as shown in Figure 2

[0067] including password security module registration, password security module running, and password security module deregistration.

[0068] Password security module registration refers to that after the password security module is distributed and integrated into the business application node, the module generates a module identification and an asymmetric key pair representing itself according to the node information provided or collected by the business application node, forms a registration request containing the module identification and public key information, and submits it to the password management system; the password management system audits the registration request, issues a module digital certificate after the audit is passed, and returns the password security protection system information and the module digital certificate to the password security module.

[0069] ​​The password security module runs, that is, the registered password security module establishes a secure transmission channel with the password security protection system based on mutual authentication of respective digital certificates; when receiving a password service request from the service application node, the password security module obtains the required working key and related information from the password security protection system through the secure transmission channel, completes the password service, and then destroys the working key;

[0070] The password security module is unregistered, including active unregistration and passive unregistration; the active unregistration refers to that the service application node issues an unregistration instruction, the password security module receives the unregistration instruction, first completes the destruction of the module identifier, the asymmetric key pair and the digital certificate, returns the unregistration result to the service application node and the password management system, stops running, and the password management system unregisters the digital certificate of the password security module; the passive unregistration refers to that the password management system unregisters the digital certificate of the password security module, immediately issues an unregistration message to the password security protection system, and the password security protection system cuts off the secure transmission channel with the password security module and no longer allows connection.

[0071] In a specific embodiment of the present application, the password protection processing when the application system communicates between different service application nodes is as shown in Figure 3 , including an encryption process and a decryption process.

[0072] The encryption process refers to that the sending password security module receives the data plaintext, requests a working key from the password security protection system; the password security protection system calculates the working key according to the application identifier and a randomly generated dispersion factor, returns the working key and the used dispersion factor to the sending password security module; the sending password security module uses the working key to encrypt the data plaintext to obtain data ciphertext, calculates a hash value of the data ciphertext to form an output parameter, returns the result and destroys the working key.

[0073] The decryption process refers to that the receiving password security module receives the encrypted result data, verifies the consistency of the data ciphertext and the hash value; after verification, the receiving password security module obtains the working key from the password security protection system according to the application identifier and the dispersion factor, uses the working key to decrypt the data ciphertext to obtain the data plaintext, returns the result and destroys the working key.

[0074] In a specific embodiment of the present application, the password protection processing when the application system communicates between different service application nodes is as shown in Figure 4 , including an encryption process and a decryption process.

[0075] The encryption process refers to that after the sender's cryptographic security module receives the data plaintext, the module information (the sender's cryptographic security module identifier, the receiver's cryptographic security module identifier), the data plaintext (the data plaintext, the data plaintext length), and the timestamp are signed (the hash value is calculated first, and then the private key is used for encryption) to obtain a signature value; the cryptographic security protection system is requested for a working key and the public key of the receiver's cryptographic security module, the cryptographic security protection system queries the public key of the receiver's cryptographic security module according to the receiver's cryptographic security module identifier, and randomly generates a working key, and returns the public key and the working key to the sender's cryptographic security module; the sender's cryptographic security module uses the working key to encrypt the message plaintext composed of the data plaintext, the data plaintext length, and the signature value to obtain message ciphertext, uses the public key of the receiver's cryptographic security module to encrypt the working key to obtain working key ciphertext, forms an output parameter, returns a result, and destroys the working key;

[0076] The decryption process refers to that after the receiver's cryptographic security module receives the message ciphertext, the working key ciphertext is decrypted using the private key of the receiver's cryptographic security module to obtain the working key, the message ciphertext is decrypted using the working key to obtain the message plaintext, the public key of the sender's cryptographic security module is obtained from the cryptographic security protection system through the sender's cryptographic security module identifier, the validity of the signature value in the message plaintext is verified, a result is returned, and the working key is destroyed.

[0077] Any process or method descriptions or any other information described herein in the flowchart form can be understood as representing at least one of the steps of a method implemented with one or more computers, as well as or instead of being understood as representing several coupled logic circuits or several parts of one or more large-scale integrated circuits. It will again be understood that the order in which the process or method steps are described is not necessarily the order in which the steps are performed.

[0078] It should be understood that each part of the present application can be realized by hardware, software, firmware or a combination thereof. In the above embodiments, a plurality of steps or methods can be realized by software or firmware stored in a memory and executed by a suitable instruction execution device.

[0079] Those skilled in the art of the present technology can understand that all or part of the steps carried out by the above-mentioned embodiments can be instructed by a program to complete the relevant hardware, and the program can be stored in a computer readable storage medium, and the program includes one of the steps of the method embodiments or a combination thereof when executed.

[0080] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0081] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "embodiments" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples.

[0082] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary, and cannot be construed as limiting the present application, and those of ordinary skill in the art can make changes, modifications, replacements and variations to the above-described embodiments within the scope of the present application.

[0083] The cloud environment-oriented modular cryptographic service processing system and method thereof adopt the cryptographic service architecture composed of a cryptographic management system, a cryptographic security protection system and a cryptographic security module, transfer the cryptographic service subject from an HSM and a vHSM to the cryptographic security module, realize the endogenous of the cryptographic service capability, the cryptographic security module management method effectively guarantees the security and controllability of the whole life cycle of the cryptographic security module through the registration, running management and active and passive cancellation of the cryptographic security module, the application internal data cryptographic protection method realizes the efficient and secure cryptographic protection when the communication between different business application nodes in the application system, and the application inter-data cryptographic protection method realizes the universal cryptographic protection when the communication between the business application nodes of different application systems, thereby effectively improving the security, reliability and convenience of the cryptographic protection in the cloud environment. Moreover, the required HSM scale of the technical solution does not need to be expanded in proportion to the scale of the cloud environment, and the cost of the cryptographic service investment can be effectively controlled. The technical solution realizes the secure, efficient and economic cryptographic protection service in the cloud environment, and can solve the problems of the existing cryptographic technology for protecting data security in the cloud environment, such as the leakage risk in the transmission of data to be encrypted, the low data protection efficiency, the increasing cost of investment in proportion to the scale, and the like.

[0084] In this specification, the present application has been described with reference to its specific embodiments. However, it is obvious that various modifications and changes can be made without departing from the spirit and scope of the present application. Therefore, the specification and drawings should be considered as illustrative rather than limiting.

Claims

1. A cloud environment oriented modular cryptographic service processing method implemented by a cloud environment oriented modular cryptographic service processing system, the system comprising: The application discloses a cloud environment-oriented password service architecture, which specifically comprises a password management system, a password security protection system and a password security module. The password management system is arranged at a password system layer of the password service architecture and is used for managing keys, password resources, certificates and monitoring and auditing in the whole cloud environment. The password security protection system is arranged at the password system layer of the password service architecture and is used for managing keys and services of all the password security modules in a certain security domain of the cloud environment and is integrated with the HSM. The password security module is arranged at a business application layer of the password service architecture, is integrated in a certain business application node of the cloud environment and is used for providing software modules with password services. Each password security module belongs to a corresponding password security protection system. The method comprises the following steps: managing the password security module in the system, performing password protection when different business application nodes in an application system communicate with each other and performing password protection when different business application nodes communicate with each other. The password protection when different business application nodes in the application system communicate with each other comprises defining an application internal data password protection service interface and performing application internal data password protection. The application internal data password protection service interface definition comprises input parameters and output parameters.

2. The method of claim 1, wherein the method is implemented in a cloud environment. The input parameters comprise an application identifier, data plaintext and data plaintext length. The output parameters comprise encrypted result data and encrypted result data length.

3. The method of claim 2, wherein the cloud environment-oriented modular cryptographic service processing method is characterized by, The encrypted result data comprises data ciphertext, data ciphertext length, data ciphertext hash value, a dispersion factor, an application identifier and a password security module identifier. The management of the password security module in the system comprises password security module registration, password security module running and password security module deregistration. The password security module registration comprises the following steps: after the password security module is integrated into a business application node, a module identifier and an asymmetric key pair are generated according to node information provided or collected by the business application node, a registration request containing the module identifier and public key information is formed and is submitted to the password management system, the password management system audits the registration request, issues a module digital certificate after the registration request is audited, returns the password security protection system information and the module digital certificate to the password security module. The password security module running comprises the following steps: After the password security module is registered, the password security module and the password security protection system are mutually authenticated based on their digital certificates, a secure transmission channel is established, the password security module obtains a required working key from the password security protection system through the secure transmission channel when receiving a password service request from the business application node and is destroyed after the password service is completed.

4. The method of claim 3, wherein the cloud environment-oriented modular cryptographic service processing method is characterized by, The password security module logout includes active logout and passive logout, the specific process of active logout of the password security module includes: The logout instruction is sent by the business application node, when the password security module receives the logout instruction, the module identification, the asymmetric key pair and the digital certificate are destroyed first, and the logout result is returned to the business application node and the password management system, the password security module stops running, and the password management system cancels the digital certificate of the current password security module; The specific process of passive logout of the password security module includes: The password management system cancels the digital certificate of the current password security module, and immediately issues a logout message to the password security protection system to which the password security module belongs, and the password security protection system immediately cuts off the secure transmission channel with the current password security module and no longer connects.

5. The method of claim 1, wherein the method is implemented in a cloud environment. The application data password protection processing specifically includes encryption process processing and decryption process processing, wherein The encryption process processing specifically includes: when the password security module as a sender receives the data plaintext, the working key and the used dispersion factor are obtained from the password security protection system according to the application identification, the data plaintext is encrypted using the working key to obtain the data ciphertext, the hash value of the data ciphertext is calculated to form the output parameter, the result is returned and the working key is destroyed; The decryption process processing specifically includes: when the password security module as a receiver receives the encrypted result data, the hash value is verified, and the working key is obtained from the password security protection system according to the application identification and the dispersion factor, and the data plaintext is decrypted using the working key to obtain the data plaintext, the result is returned and the working key is destroyed.

6. The method of claim 1, wherein the method is implemented in a cloud environment. The password protection processing when communicating between different application business application nodes includes defining application data password protection service interface and application data password protection processing, wherein The application data password protection service interface definition includes input parameters and output parameters, the input parameters include sender password security module identification, receiver password security module identification, data plaintext, data plaintext length and time stamp, the output parameters include encrypted result data and encrypted result data length, and the encrypted result data includes sender password security module identification, receiver password security module identification, working key ciphertext, message ciphertext and message ciphertext length.

7. The method of claim 6, wherein the method is implemented in a cloud environment. The application data password protection processing includes encryption process processing and decryption process processing, wherein The encryption process specifically comprises: when the password security module as a sender receives data plaintext, signing the input parameter using a private key of the password security module to obtain a signature value, obtaining a working key and a public key of a password security module of a receiver from the password security protection system according to an identifier of the password security module of the receiver, encrypting a message plaintext composed of the data plaintext, a length of the data plaintext and the signature value using the working key to obtain message ciphertext, encrypting the working key using the public key of the password security module of the receiver to obtain working key ciphertext, forming an output parameter, returning a result and destroying the working key.

8. The method of claim 7, wherein the method is implemented in a cloud environment. The decryption process specifically comprises: When the password security module as a receiver receives the message ciphertext, decrypting the working key ciphertext using a private key of the password security module to obtain the working key, and decrypting the message ciphertext using the working key to obtain message plaintext, obtaining a public key of a password security module of a sender from the password security protection system through a sender password security module identifier, verifying validity of the signature value in the message plaintext, returning a result and destroying the working key.

Images