A method and device for migrating and upgrading an encryption machine cluster

Abstract

This application provides a method and device for migrating and upgrading an encryption machine cluster, which relates to the field of information security and can also be used in the financial field. The method includes: using the software development kit of a new encryption machine to configure new environment parameters and initialize the connection pool; obtaining the migration key of the new encryption machine and synthesizing the corresponding index key; modifying the public encryption parameters of the accessing party according to a preset business scenario and accessing the interface branch of the new encryption machine to complete the migration and upgrade access of the encryption machine cluster. This application can complete the migration and upgrade access of the encryption machine cluster through key migration, achieving rapid and stable iteration of encryption machine versions.

Description

Technical Field

[0001] The present application relates to the field of information security and can be used in the financial field. Specifically, it is a method and device for migrating and upgrading an encryption machine cluster. Background Art

[0002] Against the backdrop of the booming development of network technology, the demand for privacy-enhancing encryption of user business data is increasing in real-world production. Consequently, the need for encryption machine upgrades is increasing. However, currently, there are limited options for cross-brand and cross-model encryption machine upgrades.

[0003] With no reference solution available, traditionally, upgrading an encryption machine across brands and models involves uninstalling the old one and then reinstalling it in the designated installation directory on the access terminal's disk. This completes the installation and executes the relevant startup commands to connect to the HSM system. Password generation, migration, and verification are then performed manually using the new encryption machine to complete channel access. This demonstrates the lack of mitigation measures for potential upgrade risks in existing technologies, making it difficult for customers to avoid them. Access channels also face the burden of extensive process reorganization and modification, resulting in a long upgrade cycle and significant risks. Summary of the Invention

[0004] In response to the problems in the existing technology, the present application provides a method and device for encryption machine cluster migration, upgrade and access, which can complete the encryption machine cluster migration, upgrade and access through key migration, and realize the rapid and smooth iteration of encryption machine versions.

[0005] To solve the above technical problems, this application provides the following technical solutions:

[0006] In a first aspect, the present application provides a method for migrating and upgrading an encryption machine cluster, comprising:

[0007] Use the software development kit of the new encryption machine to configure new environment parameters and initialize the connection pool;

[0008] If the configuration and initialization are successful, obtain the migration key of the new encryption machine and synthesize the corresponding index key;

[0009] If the key is obtained successfully, the public encryption parameters of the access party are modified according to the preset business scenario and the interface branch of the new encryption machine is connected to complete the encryption machine cluster migration and upgrade access.

[0010] Furthermore, the software development kit of the new encryption machine is used to configure new environment parameters and initialize the connection pool, including:

[0011] Selecting the interface files and library files in the software development kit according to the preset business scenario;

[0012] Use the selected interface file and library file to configure new environment parameters; the new environment parameters include the caller application name, encryption machine IP address or domain name, encryption machine port number and encryption monitoring service Kafka address;

[0013] Use the selected interface file and library file to call the connection pool initialization function to initialize the connection pool.

[0014] Furthermore, the obtaining of the migration key of the new encryption machine includes:

[0015] Providing a key migration input file to the new encryption machine in a preset file format, and receiving a key migration output file sent by the new encryption machine according to the key migration input file;

[0016] The key migration output file is read to obtain the migration key.

[0017] Furthermore, the corresponding index key is synthesized, including:

[0018] Obtaining an old index key; wherein the old index key is synthesized based on a random component of an old encryption engine;

[0019] According to the old index number corresponding to the old index key, the index key of the new encryption machine is moved.

[0020] Furthermore, the modifying of the public encryption parameters of the access party according to the preset service scenario includes:

[0021] Add new storage parameters according to the preset business scenario; wherein the storage parameters include IP address, interface address, whether to enable the encryption service platform, whether to enable the encryption service platform to decrypt the RSA encryption password, RSA encryption mode, RSA public key and encryption scenario dictionary value;

[0022] Determine whether to enable RSA encryption, set RSA encryption mode and RSA public key, modify RSAKey in the corresponding configuration program, process RSA encryption password for decryption, and enable the new encryption machine based on the storage parameter flag.

[0023] Furthermore, the interface branch for accessing the new encryption machine includes:

[0024] Select a corresponding branch function according to the preset business scenario;

[0025] Use the selected branch function to encrypt the input parameters and return the encryption machine status and the encrypted password; if the encryption fails, output the encryption exception information.

[0026] In a second aspect, the present application provides an encryption machine cluster migration and upgrade access device, comprising:

[0027] An environment connection pool initialization unit, used to configure new environment parameters and initialize the connection pool using the software development kit of the new encryption machine;

[0028] A key acquisition unit, configured to acquire the migration key of the new encryption machine and synthesize the corresponding index key after successful configuration and initialization;

[0029] The interface access unit is used to modify the public encryption parameters of the access party according to the preset business scenario after the key is successfully obtained and access the interface branch of the new encryption machine to complete the encryption machine cluster migration and upgrade access.

[0030] Furthermore, the environment connection pool initialization unit includes:

[0031] A file selection module, configured to select interface files and library files in the software development kit according to the preset business scenario;

[0032] The environment parameter configuration module is used to configure new environment parameters using the selected interface files and library files; the new environment parameters include the caller application name, the encryption machine IP address or domain name, the encryption machine port number and the encryption monitoring service Kafka address;

[0033] The connection pool initialization module is used to call the connection pool initialization function using the selected interface file and library file to realize the connection pool initialization.

[0034] Furthermore, the key acquisition unit includes:

[0035] A migration file transceiver module, configured to provide a key migration input file to the new encryption machine in accordance with a preset file format, and receive a key migration output file sent by the new encryption machine according to the key migration input file;

[0036] The migration key acquisition module is used to read the key migration output file and obtain the migration key.

[0037] Furthermore, the key acquisition unit includes:

[0038] An index key acquisition module, configured to acquire an old index key; wherein the old index key is synthesized based on a random component of an old encryption engine;

[0039] The index key migration module is used to migrate the index key of the new encryption machine according to the old index number corresponding to the old index key.

[0040] Furthermore, the interface access unit includes:

[0041] A module for adding storage parameters, which is used to add storage parameters according to the preset business scenario; wherein the storage parameters include IP address, interface address, whether to enable the encryption service platform, whether to enable the encryption service platform to decrypt the RSA encryption password, RSA encryption mode, RSA public key and encryption scenario dictionary value;

[0042] The parameter flag execution module is used to determine whether to enable the RSA encryption method, whether to set the RSA encryption mode and RSA public key, whether to modify the RSAKey in the corresponding configuration program, whether to process the RSA encryption password for decryption operation, and whether to enable the new encryption machine according to the storage parameter flag.

[0043] Furthermore, the interface access unit includes:

[0044] A branch function selection module is used to select a corresponding branch function according to the preset business scenario;

[0045] The status detection module is used to encrypt the input parameters using the selected branch function and return the encryption machine status and the encrypted password; if the encryption fails, the encryption exception information is output.

[0046] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the program, the steps of the encryption machine cluster migration and upgrade access method are implemented.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the encryption machine cluster migration and upgrade access method.

[0048] In a fifth aspect, the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the encryption machine cluster migration and upgrade access method.

[0049] In response to the problems in the existing technology, the encryption machine cluster migration, upgrade and access method and device provided in this application can complete the encryption machine cluster migration, upgrade and access through key migration, realize the rapid and smooth iteration of the encryption machine version, reduce the potential upgrade risks brought by manual operations of system maintenance personnel, and enable the new and old encryption machine clusters to complete emergency rollback during the upgrade process, realize the customer's unconscious and smooth transition, reduce the workload of access application coding, shorten the transformation and development cycle, and fully meet the needs of rapid and smooth upgrades. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0051] Figure 1 This is a flow chart of the encryption machine cluster migration and upgrade access method in an embodiment of the present application;

[0052] Figure 2 This is a flowchart of environment parameter configuration and connection pool initialization in an embodiment of the present application;

[0053] Figure 3 This is a flowchart of obtaining a migration key in an embodiment of the present application;

[0054] Figure 4 This is a flowchart of synthesizing index keys in an embodiment of the present application;

[0055] Figure 5 This is a flowchart of modifying public encryption parameters in an embodiment of the present application;

[0056] Figure 6 This is a flow chart of the access interface branch in the embodiment of the present application;

[0057] Figure 7 This is a structural diagram of the encryption machine cluster migration and upgrade access device in an embodiment of the present application;

[0058] Figure 8 This is a structural diagram of the environment connection pool initialization unit in an embodiment of the present application;

[0059] Figure 9 This is one of the structural diagrams of the key acquisition unit in the embodiment of the present application;

[0060] Figure 10 This is the second structural diagram of the key acquisition unit in the embodiment of this application;

[0061] Figure 11 This is one of the structural diagrams of the interface access unit in the embodiment of the present application;

[0062] Figure 12 This is the second structural diagram of the interface access unit in the embodiment of the present application;

[0063] Figure 13 A schematic diagram of the structure of an electronic device in an embodiment of the present application;

[0064] Figure 14 This is a schematic diagram of the upgrade system in the embodiment of this application;

[0065] Figure 15 This is a schematic diagram of the upgrade process in the embodiment of this application. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0067] In existing technologies, there is a lack of means to avoid potential upgrade risks, making it difficult for customers to remain unaware; the access channel side also needs to undertake the heavy work of program sorting and transformation, and the upgrade cycle and risks are relatively long.

[0068] The present application embodiment is based on the following scenario (see Figure 14 ), provides a solution to the above technical problems, and the operating subjects of each step in the complete technical solution provided in the embodiment of this application are Figure 14 The application server in .

[0069] Among them, the encryption machine refers to the hardware encryption machine (Hardware Security Module), which is an independently developed host encryption device that has been identified and approved for use by the commercial encryption authority. The encryption machine and the host use the TCP / IP protocol for communication, so the encryption machine has no special requirements for the host type and host operating system.

[0070] Asymmetric encryption (public-key encryption) refers to an encryption algorithm that uses different keys for encryption and decryption, also known as public-private key encryption. The most widely used algorithm is RSA.

[0071] F-EBMS (also known as application server) refers to the internal management system of overseas electronic banking. It is a comprehensive platform that provides all-round internal management and internal security for electronic banking (especially online banking and overseas online banking).

[0072] The embodiments of the present application provide an efficient and rapid method for migrating and upgrading access to a cluster of encryption machines across brands and models (the examples below are all based on upgrading a brand A SLJ05 financial data encryption machine to a brand B SJJ1747 financial data encryption machine). This method supplements the current situation of relatively few technical solutions for this upgrade scenario to better address the current demand for encryption machine upgrades; reduces potential upgrade risks caused by manual operations by system maintenance personnel through technical means; provides a fault-tolerant mechanism with one-click rollback, enabling emergency rollback at any time during the iteration process between the old and new encryption machine clusters, achieving a smooth and seamless transition for customers; and reduces the workload of access application coding, shortening the transformation and development cycle to meet the needs of rapid and smooth upgrades.

[0073] It should be noted that the encryption machine cluster migration, upgrade and access method and device provided in this application can be used in the financial field, and can also be used in any field other than the financial field. The application field of the encryption machine cluster migration, upgrade and access method and device provided in this application is not limited.

[0074] The acquisition, storage, use and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0075] In one embodiment, see Figure 1 In order to complete the migration and upgrade access of the encryption machine cluster by key migration and achieve fast and smooth iteration of the encryption machine version, this application provides an encryption machine cluster migration and upgrade access method, including:

[0076] S101: Use the software development kit of the new encryption machine to configure new environment parameters and initialize the connection pool;

[0077] It should be noted that, see Figure 2 , the software development kit of the new encryption machine is used to configure new environment parameters and initialize the connection pool, including: selecting the interface file and library file in the software development kit according to the preset business scenario (S201); configuring new environment parameters using the selected interface file and library file; the new environment parameters include the caller application name, the encryption machine IP address or domain name, the encryption machine port number and the encryption monitoring service Kafka address (S202); using the selected interface file and library file to call the connection pool initialization function to implement connection pool initialization (S203).

[0078] It is understandable that the overall process of the encryption machine cluster migration and upgrade access solution in the embodiment of the present application is as follows: Figure 15 This example solution is based on Brand A's SLJ05 financial data encryption machine and Brand B's SJJ1747 financial data encryption machine. Specifically, it involves upgrading Brand A's SLJ05 financial data encryption machine (old machine) to Brand B's SJJ1747 financial data encryption machine (new machine). First, after obtaining the SDK (Software Development Kit) for the new encryption machine to be upgraded, configure the connection pool and logs for the new encryption service environment according to the new encryption machine's operating manual.

[0079] The specific configuration parameters and steps for the new encryption service environment connection pool are as follows. After configuration, the connection pool can initialize the connection normally:

[0080] (1) Configure environment parameters: the calling application name LAppName, such as F-EBMS; the encryption machine IP address or domain name hsmremoteIP, such as HSM-NAP-A.sdc.cs.icbc; the encryption machine port number HsmPort, such as 8889; the encryption monitoring service Kafka address MonitorIP.

[0081] (2) Call the corresponding service to initialize the connection pool InitHsmService.init(localAppName,hsmremoteIP,HsmPort,MonitorIP)

[0082] / / Get the connection pool instance

[0083] HsmConnectionPool conPool=

[0084] com.icbc.hsm.socket.pool.HsmConnectionPool.getInstance();

[0085] boolean flag = conPool.isPoolInit(); / / Judge whether the connection pool initialization is successful

[0086] if(!flag){

[0087] Add alarm or manual analysis

[0088] }

[0089] The new encryption service environment uses LOG4J to record logs, supporting both LOG4J1 and LOG4J2. The specific configuration parameters (using LOG4J2 as an example) are as follows. After configuration, you can add and generate a separate HSM log file:

[0090] <!--LOG4J2 log configuration example-->

[0091] <appenders>

[0092] <!-- Output to console -->

[0093] <Console name="Console"target="SYSTEM_OUT">

[0094] <!--Required logging level-->

[0095] <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss,SSS}:%4p%t(%F:%L)-%m%n" / >

[0096]

[0097] <! -- Output to file, where the log generation path is divided according to the actual configuration, by day or when it exceeds 80MB -->

[0098] <RollingRandomAccessFile name="RollingFile"

[0099] fileName="${LOG_HOME} / hsm.log"

[0100] filePattern="${BACKUP_HOME} / $${date:yyyy-MM} / xjj-%d{yyyy-MM-dd}-%i.log.gz">

[0101] <!--Required logging level-->

[0102] <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss,SSS}:%4p%t(%F:%L)-%m%n" / >

[0103] <policies>

[0104] <timebasedtriggeringpolicy / >

[0105] <SizeBasedTriggeringPolicy size="80MB" / >

[0106] < / policies>

[0107] <DefaultRolloverStrategy max="20" / >

[0108]

[0109] <Async name="AsyncAppender">

[0110] <AppenderRef ref="RollingFile" / >

[0111]

[0112] < / appenders>

[0113] From the above description, it can be seen that the encryption machine cluster migration and upgrade access method provided in this application can use the software development kit of the new encryption machine to configure new environment parameters and initialize the connection pool.

[0114] S102: If the configuration and initialization are successful, obtain the migration key of the new encryption machine and synthesize the corresponding index key;

[0115] It should be noted that, see Figure 3, obtaining the migration key of the new encryption machine includes: providing the key migration input file to the new encryption machine according to a preset file format, and receiving the key migration output file sent by the new encryption machine according to the key migration input file (S301); reading the key migration output file to obtain the migration key (S302).

[0116] It can be understood that, first, after the original encryption machine backs up the original key, the key migration input file is provided in the format agreed upon by the encryption service platform of the new encryption machine; after the file is input into the new encryption machine, the file is output in the agreed format, the new key is obtained from the output file, and stored back in the application database.

[0117] Secondly, when storing new keys, the database corresponding transaction table adds a new HSM_PSWD field to back up the original NEW_PSWD field content. The original brand A's index data encryption and decryption key ZEK (ZEK is the original Westone index data encryption and decryption key) is converted into the format agreed upon by the encryption machine to be upgraded, and the key migration input file encryption service layer can use the DEK (DEK is the data encryption and decryption key that can be used by the encryption service layer of the new encryption machine) key is provided. The key string and KCV (KCV is the verification value generated on the encryption machine) obtained by migration are stored back in the application database. The purpose of the key is data encryption and decryption. The database corresponding transaction storage key table adds a new HIS_PSWD field to back up the historical content of the original PSWD field.

[0118] It should also be noted that, see Figure 4 , synthesizing the corresponding index key, including: obtaining the old index key (S401); wherein the old index key is synthesized based on the random component of the old encryption machine; according to the old index number corresponding to the old index key, moving the index key of the new encryption machine (S402).

[0119] It is understandable that

[0120] (1) Synthesize the old (original brand A encryption machine) ZMK (ZMK is the data encryption and decryption key required for migration) using the management tool of brand A company and the ZMK key with the encryption machine component synthesis index. Select double length, such as: enter the key index 099 (select an unused index number, subject to actual production), and then use three components (part1, part2, part3 generated above) to synthesize the key (if there are only two components, enter the same length of 0 for the third component).

[0121] (2) After synthesis, the index number (3-digit decimal value converted to 4-digit hexadecimal value) and KCV are written to the first line of the ZMKS configuration file (as shown in Table 1) (the corresponding position of the old encryption machine).

[0122] (3) Migrate the index ZEK key. Migrate the key corresponding to the index number of the old encryption machine. Replace the ciphertext information with index numbers 0006 and 0007 in the new encryption machine according to the agreed format, and assemble the complete information into the migration file. A migration result file will be generated in the specified disk directory. The key string and key check value KCV corresponding to index numbers 0006 and 0007 in the migration result file F_WAPB_OUT_FILE will be stored back in the application database.

[0123] From the above description, it can be seen that the encryption machine cluster migration, upgrade and access method provided in this application can obtain the migration key of the new encryption machine and synthesize the corresponding index key.

[0124] S103: If the key is successfully obtained, the public encryption parameters of the access party are modified according to the preset business scenario and the interface branch of the new encryption machine is accessed to complete the encryption machine cluster migration upgrade access.

[0125] It should be noted that, see Figure 5 , the modifying of the public encryption parameters of the access party according to the preset business scenario includes: adding new storage parameters according to the preset business scenario (S501); wherein the storage parameters include the IP address, the interface address, whether to enable the encryption service platform, whether to enable the encryption service platform to decrypt the password of the RSA encryption method, the RSA encryption mode, the RSA public key and the encryption scenario dictionary value; determining whether to enable the RSA encryption method, whether to set the RSA encryption mode and the RSA public key, whether to modify the RSAKey in the corresponding configuration program, whether to process the password of the RSA encryption method for decryption operation, and whether to enable the new encryption machine according to the storage parameter flag (S502).

[0126] It is understandable that the public encryption parameters of the access party have been modified, including a disaster recovery rollback switch, which allows upgrades to be rolled back with one click:

[0127] 1) Added a new storage parameter, newHsm_IP, which specifies "password encryption related settings. Encryption service platform address."

[0128] 2) Added a new entry parameter, newHsm_Port, for "Password encryption related settings. Encryption service platform port."

[0129] 3) Added a new entry parameter, IsNewHsm_Flag, which specifies "password encryption related settings. Whether to enable the encryption service platform switch. 0 is off, 1 is on, and the default is on."

[0130] 4) Added a new storage parameter, IsNewHsm_RSAFLAG, which specifies password encryption settings. Specifies whether to enable the encryption service platform to decrypt RSA-encrypted passwords. 0: Off, 1: On, default is On.

[0131] 5) Added new Hsm_RSAMod, "RSA encryption mode" as a new input parameter.

[0132] 6) Added the new storage parameter newHsm_RSAKey, "RSA public key".

[0133] 7) Added the new storage parameter functionFlag to encrypt the scene dictionary value

[0134] 8) According to the IsNewHsm_Flag flag of the storage parameter, add a program to determine whether to call the SJL05 of brand A or the encryption machine to be upgraded.

[0135] 9) Based on the hsmPlatform_RSAFLAG flag, determine whether to enable the encryption service platform to decrypt the RSA encrypted password. Add a program to determine whether to call brand A's SJL05 or encryption service platform during decryption.

[0136] 10) According to the hsmPlatform_RSAFLAG flag of the storage parameter, set the RSA encryption mode and RSA public key, modify the RSAKey in the corresponding configuration program, and process the RSA encryption password for decryption operations.

[0137] 11) Based on the original encryption machine access parameters, the F-EBMS channel modifies the calling program corresponding to the access encryption machine scenario. The mobile phone involves modifying the judgment file and calling the SJL05 of brand A or the SJJ1747 of brand B according to the storage parameter hsmPlatform_Flag flag.

[0138] It should be noted that, see Figure 6 , accessing the interface branch of the new encryption machine, including: selecting the corresponding branch function according to the preset business scenario (S601); using the selected branch function to encrypt the input parameters, returning the encryption machine status and the encrypted password (S602); if the encryption fails, outputting encryption exception information.

[0139] It is understandable that the F-EBMS channel accesses the new encryption machine interface branch, that is, F-EBMS introduces the new encryption machine API, which has branches as follows according to different scenarios of telephone banking login password encryption.

[0140] Branch 1: If the phone banking password is set through other channels, functionFlag is set to 1, and the PhoneHSM() branch is executed. The generatedFovaEbankPWD method provided by the IcbcFeature4Fova class encrypts the incoming parameters (e-bank internal transmission ciphertext, e-bank storage ciphertext, 3DES-encrypted transmission password, transmission interference factor, and phone banking ID). The method returns the encryption status and the encrypted password. If encryption is successful, the next step is to store the password. If encryption fails, an exception is thrown.

[0141] Branch 2: In the F-EBMS channel scenario where the password is set using a password envelope, functionFlag is set to 2, and the PhoneMMXFHSM() branch is executed. The generatedFovaEbankPWD method provided by the IcbcFeature4Fova class encrypts the ciphertext using the password envelope encryption key, the enterprise stored ciphertext, the plaintext password, the transmission interference factor, and the telephone banking ID. The method returns the encryption status and the encrypted password. If encryption is successful, the next step is to store the password. If encryption fails, an exception is thrown.

[0142] Branch 3: In the F-EBMS channel password setting scenario for telephone banking, functionFlag is set to 3, and the PhoneEBMSHSM() branch is executed. The generatedFovaEbankPWD method provided by the IcbcFeature4Fova class encrypts the incoming parameters (e-bank internal transmission ciphertext, e-bank storage ciphertext, plaintext password, transmission interference factor, and telephone banking ID) and returns the encryption status and the encrypted password. If encryption is successful, the next step is to store the password. If encryption fails, an exception is thrown.

[0143] From the above description, it can be seen that the encryption machine cluster migration, upgrade and access method provided in this application can complete the encryption machine cluster migration, upgrade and access through key migration, realize the rapid and smooth iteration of the encryption machine version, reduce the potential upgrade risks brought by manual operations of system maintenance personnel, and enable the new and old encryption machine clusters to complete emergency rollback during the upgrade process, realize the customer's unconscious and smooth transition, reduce the workload of access application coding, shorten the transformation and development cycle, and fully meet the needs of rapid and smooth upgrades.

[0144] Based on the same inventive concept, the embodiments of the present application also provide an encryption machine cluster migration and upgrade access device, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Since the principle of solving the problem by the encryption machine cluster migration and upgrade access device is similar to that of the encryption machine cluster migration and upgrade access method, the implementation of the encryption machine cluster migration and upgrade access device can refer to the implementation of the method based on software performance benchmark determination, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements the predetermined function. Although the system described in the following embodiments is preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and conceived.

[0145] In one embodiment, see Figure 7 In order to complete the migration and upgrade access of the encryption machine cluster by key migration and achieve rapid and stable iteration of the encryption machine version, the present application provides an encryption machine cluster migration and upgrade access device, including:

[0146] The environment connection pool initialization unit 701 is used to configure new environment parameters and initialize the connection pool using the software development kit of the new encryption machine;

[0147] The key acquisition unit 702 is used to obtain the migration key of the new encryption machine and synthesize the corresponding index key after the configuration and initialization are successful;

[0148] The interface access unit 703 is used to modify the public encryption parameters of the access party according to the preset business scenario after the key is successfully obtained and access the interface branch of the new encryption machine to complete the encryption machine cluster migration and upgrade access.

[0149] In one embodiment, see Figure 8 The environment connection pool initialization unit 701 includes:

[0150] The file selection module 801 is used to select the interface file and library file in the software development kit according to the preset business scenario;

[0151] The environment parameter configuration module 802 is used to configure new environment parameters using the selected interface files and library files; the new environment parameters include the caller application name, the encryption machine IP address or domain name, the encryption machine port number and the encryption monitoring service Kafka address;

[0152] The connection pool initialization module 803 is used to call the connection pool initialization function using the selected interface file and library file to implement connection pool initialization.

[0153] In one embodiment, see Figure 9 The key acquisition unit 702 includes:

[0154] The migration file receiving and sending module 901 is used to provide the key migration input file to the new encryption machine according to a preset file format, and receive the key migration output file sent by the new encryption machine according to the key migration input file;

[0155] The migration key acquisition module 902 is configured to read the key migration output file and acquire the migration key.

[0156] In one embodiment, see Figure 10 The key acquisition unit 702 includes:

[0157] The index key acquisition module 1001 is used to obtain an old index key; wherein the old index key is synthesized based on the random component of the old encryption engine;

[0158] The index key migration module 1002 is used to migrate the index key of the new encryption machine according to the old index number corresponding to the old index key.

[0159] In one embodiment, see Figure 11 The interface access unit 703 includes:

[0160] The storage parameter adding module 1101 is used to add storage parameters according to the preset business scenario; wherein the storage parameters include IP address, interface address, whether to enable the encryption service platform, whether to enable the encryption service platform to decrypt the RSA encryption password, RSA encryption mode, RSA public key and encryption scenario dictionary value;

[0161] The parameter flag execution module 1102 is used to determine whether to enable the RSA encryption method, whether to set the RSA encryption mode and RSA public key, whether to modify the RSAKey in the corresponding configuration program, whether to process the RSA encryption password for decryption operations, and whether to enable the new encryption machine based on the storage parameter flag.

[0162] In one embodiment, see Figure 12 The interface access unit 703 includes:

[0163] A branch function selection module 1201 is configured to select a corresponding branch function according to the preset business scenario;

[0164] The state detection module 1202 is used to encrypt the input parameters using the selected branch function and return the encryption machine state and the encrypted password; if the encryption fails, it outputs encryption exception information.

[0165] From a hardware perspective, in order to complete the migration, upgrade, and access of an encryption machine cluster through key migration and achieve rapid and stable iteration of encryption machine versions, this application provides an embodiment of an electronic device for implementing all or part of the content of the encryption machine cluster migration, upgrade, and access method. The electronic device specifically includes the following content:

[0166] Processor, memory, communication interface, and bus; wherein the processor, memory, and communication interface communicate with each other via the bus; the communication interface is used to implement information transmission between the encryption machine cluster migration and upgrade access device and related devices such as the core business system, user terminals, and related databases; the logic controller can be a desktop computer, a tablet computer, a mobile terminal, etc., but this embodiment is not limited thereto. In this embodiment, the logic controller can be implemented with reference to the embodiment of the encryption machine cluster migration and upgrade access method and the embodiment of the encryption machine cluster migration and upgrade access device in the embodiment, the contents of which are incorporated herein and repeated parts are not repeated.

[0167] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0168] In practical applications, portions of the encryption machine cluster migration and upgrade access method can be performed on the electronic device side as described above, or all operations can be performed on the client device. The specific selection can be based on the processing capabilities of the client device and the limitations of the user's usage scenario. This application does not impose any restrictions on this. If all operations are performed on the client device, the client device may also include a processor.

[0169] The client device may include a communication module (i.e., a communication unit) that can establish a communication connection with a remote server to implement data transmission with the server. The server may include a server on the task scheduling center side, and in other implementation scenarios, may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0170] Figure 13 Schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Figure 13As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that the Figure 13 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0171] In one embodiment, the encryption machine cluster migration and upgrade access method function can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following control:

[0172] S101: Use the software development kit of the new encryption machine to configure new environment parameters and initialize the connection pool;

[0173] S102: If the configuration and initialization are successful, obtain the migration key of the new encryption machine and synthesize the corresponding index key;

[0174] S103: If the key is successfully obtained, the public encryption parameters of the access party are modified according to the preset business scenario and the interface branch of the new encryption machine is accessed to complete the encryption machine cluster migration upgrade access.

[0175] From the above description, it can be seen that the encryption machine cluster migration, upgrade and access method and device provided in this application can complete the encryption machine cluster migration, upgrade and access through key migration, realize the rapid and smooth iteration of the encryption machine version, reduce the potential upgrade risks brought by manual operations of system maintenance personnel, and enable the new and old encryption machine clusters to complete emergency rollback during the upgrade process, realize the customer's unconscious and smooth transition, reduce the workload of access application coding, shorten the transformation and development cycle, and fully meet the needs of rapid and smooth upgrades.

[0176] In another embodiment, the encryption machine cluster migration and upgrade access device can be configured separately from the central processor 9100. For example, the data composite transmission device encryption machine cluster migration and upgrade access device can be configured as a chip connected to the central processor 9100, and the function of the encryption machine cluster migration and upgrade access method can be realized through the control of the central processor.

[0177] like Figure 13 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Figure 13 In addition, the electronic device 9600 may also include all components shown in Figure 13 For components not shown, reference may be made to the prior art.

[0178] like Figure 13As shown, the central processing unit 9100 is sometimes also referred to as a controller or operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0179] Memory 9140 can be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It can store the aforementioned failure-related information and also store programs that execute the relevant information. The CPU 9100 can execute the programs stored in memory 9140 to implement information storage or processing.

[0180] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 may be, for example, a keypad or touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0181] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), or a SIM card. Alternatively, it may be a memory that retains information even when power is off, can be selectively erased, and is provided with more data. Examples of such memory are sometimes referred to as EPROMs. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 by the central processing unit 9100.

[0182] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various driver programs for the electronic device's communication functions and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0183] The communication module 9110 is a transmitter / receiver 9110 that sends and receives signals via an antenna 9111. The communication module (transmitter / receiver) 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as in a conventional mobile communication terminal.

[0184] Based on different communication technologies, multiple communication modules 9110 can be provided in the same electronic device, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module. The communication module (transmitter / receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby implementing common telecommunication functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 9130 is also coupled to the central processing unit 9100, enabling local recording via the microphone 9132 and playback of stored audio via the speaker 9131.

[0185] Embodiments of the present application also provide a computer-readable storage medium capable of implementing all steps of the encryption machine cluster migration, upgrade, and access method in the above-mentioned embodiment, where the execution subject is a server or a client. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, all steps of the encryption machine cluster migration, upgrade, and access method in the above-mentioned embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0186] S101: Use the software development kit of the new encryption machine to configure new environment parameters and initialize the connection pool;

[0187] S102: If the configuration and initialization are successful, obtain the migration key of the new encryption machine and synthesize the corresponding index key;

[0188] S103: If the key is successfully obtained, the public encryption parameters of the access party are modified according to the preset business scenario and the interface branch of the new encryption machine is accessed to complete the encryption machine cluster migration upgrade access.

[0189] From the above description, it can be seen that the encryption machine cluster migration, upgrade and access method and device provided in this application can complete the encryption machine cluster migration, upgrade and access through key migration, realize the rapid and smooth iteration of the encryption machine version, reduce the potential upgrade risks brought by manual operations of system maintenance personnel, and enable the new and old encryption machine clusters to complete emergency rollback during the upgrade process, realize the customer's unconscious and smooth transition, reduce the workload of access application coding, shorten the transformation and development cycle, and fully meet the needs of rapid and smooth upgrades.

[0190] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0191] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0192] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0193] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0194] Specific embodiments are used in the present invention to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A method for migrating and upgrading an encryption machine cluster, characterized in that: include: Use the software development kit of the new encryption machine to configure new environment parameters and initialize the connection pool; If the configuration and initialization are successful, obtain the migration key of the new encryption machine and synthesize the corresponding index key; If the key is successfully obtained, the public encryption parameters of the access party are modified according to the preset business scenario and the interface branch of the new encryption machine is connected to complete the encryption machine cluster migration and upgrade access; The corresponding index key is synthesized, including: Obtaining an old index key; wherein the old index key is synthesized based on a random component of an old encryption engine; According to the old index number corresponding to the old index key, the index key of the new encryption machine is moved; The modifying of the public encryption parameters of the access party according to the preset service scenario includes: Add new storage parameters according to the preset business scenario; wherein the storage parameters include IP address, interface address, whether to enable the encryption service platform, whether to enable the encryption service platform to decrypt the RSA encryption password, RSA encryption mode, RSA public key and encryption scenario dictionary value; Determine whether to enable RSA encryption, set RSA encryption mode and RSA public key, modify RSAKey in the corresponding configuration program, process RSA encryption password for decryption, and enable the new encryption machine according to the storage parameter flag; The interface branch for accessing the new encryption machine includes: Select a corresponding branch function according to the preset business scenario; Use the selected branch function to encrypt the input parameters and return the encryption machine status and the encrypted password; if the encryption fails, output the encryption exception information.

2. The encryption machine cluster migration, upgrade and access method according to claim 1, characterized in that: The software development kit of the new encryption machine is used to configure new environment parameters and initialize the connection pool, including: Selecting the interface file and library file in the software development kit according to the preset business scenario; Use the selected interface file and library file to configure new environment parameters; the new environment parameters include the caller application name, encryption machine IP address or domain name, encryption machine port number and encryption monitoring service Kafka address; Use the selected interface file and library file to call the connection pool initialization function to initialize the connection pool.

3. The encryption machine cluster migration, upgrade and access method according to claim 1, characterized in that: The step of obtaining the migration key of the new encryption machine includes: Providing a key migration input file to the new encryption machine in a preset file format, and receiving a key migration output file sent by the new encryption machine according to the key migration input file; The key migration output file is read to obtain the migration key.

4. An encryption machine cluster migration and upgrade access device, characterized in that: include: An environment connection pool initialization unit, used to configure new environment parameters and initialize the connection pool using the software development kit of the new encryption machine; A key acquisition unit, configured to acquire the migration key of the new encryption machine and synthesize the corresponding index key after successful configuration and initialization; An interface access unit is used to modify the public encryption parameters of the access party according to the preset business scenario after the key is successfully obtained and access the interface branch of the new encryption machine to complete the migration and upgrade access of the encryption machine cluster; The key acquisition unit includes: An index key acquisition module, configured to acquire an old index key; wherein the old index key is synthesized based on a random component of an old encryption engine; An index key migration module, configured to migrate the index key of the new encryption engine according to the old index number corresponding to the old index key; The interface access unit includes: A module for adding storage parameters, which is used to add storage parameters according to the preset business scenario; wherein the storage parameters include IP address, interface address, whether to enable the encryption service platform, whether to enable the encryption service platform to decrypt the RSA encryption password, RSA encryption mode, RSA public key and encryption scenario dictionary value; A parameter flag execution module is used to determine whether to enable the RSA encryption method, whether to set the RSA encryption mode and RSA public key, whether to modify the RSAKey in the corresponding configuration program, whether to process the RSA encryption password for decryption, and whether to enable the new encryption machine according to the storage parameter flag; The interface access unit includes: A branch function selection module is used to select a corresponding branch function according to the preset business scenario; The status detection module is used to encrypt the input parameters using the selected branch function and return the encryption machine status and the encrypted password; if the encryption fails, the encryption exception information is output.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the encryption machine cluster migration, upgrade and access method described in any one of claims 1 to 3 are implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the encryption machine cluster migration, upgrade and access method described in any one of claims 1 to 3 are implemented.

7. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the encryption machine cluster migration, upgrade and access method described in any one of claims 1 to 3 are implemented.

Images