Cryptographic machine data processing method, apparatus, device, medium and program product

Abstract

The embodiment of the application provides a cryptographic machine data processing method and device, relates to the field of information security, and the method comprises the following steps: receiving original key ciphertext sent by a service invoker, determining a cryptographic machine with optimal interface performance in an existing cryptographic machine; determining corresponding cryptographic machine key ciphertext, cryptographic machine message format and communication mode according to the identification of the cryptographic machine with optimal interface performance; decrypting the cryptographic machine key ciphertext and the original key ciphertext through a preset cryptographic machine master key, encrypting the cryptographic machine key plaintext obtained after the decryption and the key plaintext obtained after the decryption to obtain target key ciphertext; assembling a cryptographic machine service message according to the cryptographic machine message format and the communication mode and sending the target key ciphertext to the service invoker; and the application can effectively improve the compatibility of the cryptographic machine.

Description

Technical Field

[0001] This application relates to the field of information security, specifically to a method and apparatus for processing encrypted machine data. Background Technology

[0002] An encryption machine is a specialized device that uses cryptography to encrypt, decrypt, and authenticate information. The basic principle is as follows: the sender uses a cryptographic key to perform cryptographic operations on the plaintext to obtain ciphertext; the ciphertext is then transmitted over a public channel; the receiver performs an inverse cryptographic transformation on the received ciphertext and, using the key, recovers the plaintext. The security strength of an encryption machine primarily depends on the strength of the cryptographic algorithm and the key used.

[0003] Financial data encryption machines are closely integrated with financial operations, providing customized solutions based on different business needs. They are primarily suitable for banking and financial systems, especially interbank ATM / POS transaction systems. In addition, they can be widely used in social security, power, public transportation, securities, commerce, postal services, taxation, insurance, and other financial systems. They provide financial systems with secure cryptographic services such as data confidentiality, data integrity, data source authentication, and non-repudiation, while also implementing full lifecycle management of keys within the business system.

[0004] Currently, there are differences in message formats and interface formats among various data encryption machine manufacturers in existing technologies, which increases the difficulty of encryption machine compatibility. Summary of the Invention

[0005] To address the problems in the prior art, this application provides a data processing method and apparatus for encryption machines, which can effectively improve the compatibility of encryption machines.

[0006] To solve at least one of the above problems, this application provides the following technical solution:

[0007] In a first aspect, this application provides a method for processing encrypted machine data, including:

[0008] Receive the original key ciphertext sent by the service caller and determine the encryption machine with the best interface performance among the existing encryption machines;

[0009] The corresponding encryption key ciphertext, encryption message format, and communication method are determined based on the identifier of the encryption machine with the best interface performance.

[0010] The encryption machine key ciphertext and the original key ciphertext are decrypted using a preset encryption machine master key. The encryption machine key plaintext obtained after decryption is then used to encrypt the key plaintext obtained after decryption to obtain the target key ciphertext.

[0011] The encryption machine service message is assembled according to the encryption machine message format and communication method, and the target key ciphertext is sent to the service caller.

[0012] Furthermore, determining the encryption machine with the best interface performance among existing encryption machines includes:

[0013] Continuously probe existing encryption machines and determine their status and interface efficiency;

[0014] Based on the existing encryption machine status and interface function efficiency, a list of encryption machines in normal status is determined, and based on the encryption machine list, the encryption machine with the best interface performance is determined.

[0015] Furthermore, the cyclic probing of existing encryption machines and determination of interface functional efficiency includes:

[0016] Data plaintext is randomly generated based on the symmetric / asymmetric key randomly generated by the existing encryption machine, and the symmetric / asymmetric key and the data plaintext are combined to form a message, wherein the character length of the data plaintext is equal to that of the symmetric / asymmetric key;

[0017] The message is sent to the encryption machine, and the first time is recorded, so that the encryption machine encrypts the message to generate ciphertext and records the second time.

[0018] Based on the first time and the second time, the average response time and the corresponding encryption machine interface function efficiency are determined.

[0019] Furthermore, the cyclic detection of existing encryption machines and determination of their states includes:

[0020] Call another encryption machine to verify the ciphertext generated by the current encryption machine;

[0021] If the plaintext obtained after message verification matches the plaintext randomly generated by the current encryption machine, then the current encryption machine is determined to be in a normal state.

[0022] Further, the step of decrypting the encryption key ciphertext and the original key ciphertext using a preset encryption master key includes:

[0023] The corresponding encryption key ciphertext is retrieved from the designated key storage unit based on the encryption key identifier;

[0024] The encrypted key ciphertext and the original key ciphertext are sent to a preset master encryption machine and decrypted using the preset master encryption machine key.

[0025] Further, the step of assembling the encryption machine service message according to the encryption machine message format and communication method and sending the target key ciphertext to the service caller includes:

[0026] Call the encryption machine message format and communication method of the encryption machine with the best performance of the interface, and assemble the encryption machine service message;

[0027] The target key ciphertext is sent to the service caller via the encryption machine service message.

[0028] Secondly, this application provides an encryption machine data processing apparatus, comprising:

[0029] The encryption machine filtering module is used to receive the original key ciphertext sent by the service caller and determine the encryption machine with the best interface performance among the existing encryption machines;

[0030] The encryption method determination module is used to determine the corresponding encryption key ciphertext, encryption message format, and communication method based on the identifier of the encryption machine with the best interface performance.

[0031] The decryption and encryption module is used to decrypt the encryption machine key ciphertext and the original key ciphertext using a preset encryption machine master key, and to encrypt the decrypted key plaintext using the encryption machine key plaintext to obtain the target key ciphertext.

[0032] The ciphertext feedback module is used to assemble an encryption machine service message according to the encryption machine message format and communication method, and send the target key ciphertext to the service caller.

[0033] Furthermore, the encryption machine screening module includes:

[0034] The cyclic probing unit is used to cyclically probe existing encryption machines and determine the encryption machine status and interface function efficiency.

[0035] The optimal filtering unit is used to determine a list of encryption machines in normal condition based on the encryption machine status and interface function efficiency of each existing encryption machine, and to determine the encryption machine with the best interface performance based on the encryption machine list.

[0036] Furthermore, the cyclic detection unit includes:

[0037] The message generation subunit is used to randomly generate plaintext data based on a symmetric key / asymmetric key randomly generated by an existing encryption machine, and to combine the symmetric key / asymmetric key and the plaintext data into a message, wherein the character length of the plaintext data is equal to that of the symmetric key / asymmetric key;

[0038] The time recording subunit is used to send the message to the encryption machine and record the first time, so that the encryption machine can encrypt the message to generate ciphertext and record the second time.

[0039] The interface efficiency determination subunit is used to determine the average response time and the corresponding encryption machine interface function efficiency based on the first time and the second time.

[0040] Furthermore, the cyclic detection unit also includes:

[0041] The message verification subunit is used to call another encryption machine to verify the ciphertext of the data generated by the current encryption machine.

[0042] The encryption machine status determination subunit is used to determine that the current encryption machine is in a normal state if the plaintext obtained after the message verification is consistent with the plaintext randomly generated by the current encryption machine.

[0043] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the encryption machine data processing method.

[0044] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the encryption machine data processing method described above.

[0045] Fifthly, this application provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the encryption machine data processing method.

[0046] As can be seen from the above technical solution, this application provides a method and apparatus for processing encryption machine data. It involves receiving the original key ciphertext sent by a service caller, determining the encryption machine with the best interface performance among existing encryption machines, determining the corresponding encryption machine key ciphertext, encryption machine message format, and communication method based on the identifier of the encryption machine with the best interface performance, decrypting the encryption machine key ciphertext and the original key ciphertext using a preset encryption machine master key, encrypting the decrypted key plaintext with the decrypted key plaintext to obtain the target key ciphertext, assembling an encryption machine service message according to the encryption machine message format and communication method, and sending the target key ciphertext to the service caller. This effectively improves encryption machine compatibility. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is one of the flowcharts illustrating the encryption machine data processing method in the embodiments of this application;

[0049] Figure 2 This is a second schematic flowchart of the encryption machine data processing method in the embodiments of this application;

[0050] Figure 3 This is the third flowchart illustrating the encryption machine data processing method in the embodiments of this application;

[0051] Figure 4 This is the fourth flowchart illustrating the encryption machine data processing method in the embodiments of this application;

[0052] Figure 5 This is one of the structural diagrams of the encryption machine data processing device in the embodiments of this application;

[0053] Figure 6 This is the second structural diagram of the encryption machine data processing device in the embodiments of this application;

[0054] Figure 7 This is the third structural diagram of the encryption machine data processing device in the embodiments of this application;

[0055] Figure 8 This is the fourth structural diagram of the encryption machine data processing device in the embodiments of this application;

[0056] Figure 9 This is a structural diagram of the encryption machine data processing system in a specific embodiment of this application;

[0057] Figure 10 This is a schematic diagram of the structure of the electronic device in the embodiments of this application. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0059] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0060] In view of the problems existing in the prior art, this application provides a method and apparatus for processing encryption machine data. The method involves receiving the original key ciphertext sent by a service caller, identifying the encryption machine with the best interface performance among existing encryption machines, determining the corresponding encryption machine key ciphertext, encryption machine message format, and communication method based on the identifier of the encryption machine with the best interface performance, decrypting the encryption machine key ciphertext and the original key ciphertext using a preset encryption machine master key, encrypting the decrypted key plaintext with the plaintext key obtained after decryption to obtain the target key ciphertext, assembling an encryption machine service message according to the encryption machine message format and communication method, and sending the target key ciphertext to the service caller. This effectively improves the compatibility of encryption machines.

[0061] To effectively improve the compatibility of encryption machines, this application provides an embodiment of an encryption machine data processing method, see [link to embodiment]. Figure 1 and Figure 9 The encryption machine data processing method specifically includes the following:

[0062] Step S101: Receive the original key ciphertext sent by the service caller and determine the encryption machine with the best interface performance among the existing encryption machines.

[0063] Optionally, in this application, the service caller can invoke the encryption machine service scheduling submodule 203, sending in the original key ciphertext. The encryption machine service scheduling submodule 203 then invokes the encryption machine status submodule 202 to obtain a list of encryption machines in normal status. Based on the list of encryption machines in normal status, the identifier of the encryption machine with the best interface performance is matched from the interface performance submodule 201.

[0064] Step S102: Determine the corresponding encryption key ciphertext, encryption message format, and communication method based on the identifier of the encryption machine with the best interface performance.

[0065] Optionally, in this application, the encryption machine service scheduling submodule 203 automatically selects the encryption machine message format and communication method according to the encryption machine identifier, and assembles the encryption machine service message according to the message format and communication method.

[0066] Step S103: Decrypt the encrypted key ciphertext and the original key ciphertext using the preset encrypted key master key, and then encrypt the decrypted key plaintext using the encrypted key plaintext to obtain the target key ciphertext.

[0067] Optionally, in this application, the corresponding encryption key ciphertext can be obtained from the set key storage unit according to the encryption key identifier; the encryption key ciphertext and the original key ciphertext are sent to the preset master encryption machine and decrypted using the preset master encryption machine key.

[0068] Specifically, the encryption machine service scheduling submodule 203 calls the key dynamic processing submodule 301 of the dynamic key distribution module 003, and sends in the encryption machine identifier and key ciphertext. The key dynamic processing submodule 301 retrieves the encryption machine key ciphertext from the key storage 303 according to the encryption machine key identifier, and sends the encryption machine key ciphertext and key ciphertext to the first encryption machine 302.

[0069] The first encryption machine 302 decrypts the key ciphertext with the first encryption machine master key to obtain the key plaintext, decrypts the encryption machine key ciphertext with the first encryption machine master key to obtain the encryption machine key plaintext, and encrypts the key plaintext with the encryption machine key plaintext to obtain the new key ciphertext (i.e. the target key ciphertext), and returns it to the encryption machine service scheduling submodule 203.

[0070] Step S104: Assemble the encryption machine service message according to the encryption machine message format and communication method, and send the target key ciphertext to the service caller.

[0071] Optionally, in this application, the encryption machine service scheduling submodule 203 uses the new key ciphertext and data to call the corresponding encryption machine according to the encryption machine identifier, obtain the corresponding encryption machine service, and return it to the service caller.

[0072] As can be seen from the above description, the encryption machine data processing method provided in this application embodiment can determine the encryption machine with the best interface performance among existing encryption machines by receiving the original key ciphertext sent by the service caller; determine the corresponding encryption machine key ciphertext, encryption machine message format, and communication method according to the identifier of the encryption machine with the best interface performance; decrypt the encryption machine key ciphertext and the original key ciphertext by using a preset encryption machine master key; encrypt the decrypted key plaintext by using the encryption machine key plaintext obtained after decryption to obtain the target key ciphertext; assemble the encryption machine service message according to the encryption machine message format and communication method, and send the target key ciphertext to the service caller, thereby effectively improving the compatibility of encryption machines.

[0073] In one embodiment of the encryption machine data processing method of this application, see [link to embodiment]. Figure 2 The above step S101 may also specifically include the following:

[0074] Step S201: Loop through existing encryption machines and determine their status and interface efficiency.

[0075] Step S202: Determine a list of encryption machines in normal condition based on the encryption machine status and interface function efficiency of each existing encryption machine, and determine the encryption machine with the best interface performance based on the encryption machine list.

[0076] Optionally, in this application, the encryption machine detection module 001 cyclically detects each encryption machine and marks the encryption machine status and the efficiency of the interface functions.

[0077] In one embodiment of the encryption machine data processing method of this application, see [link to embodiment]. Figure 3 The above step S201 may also specifically include the following:

[0078] Step S301: Randomly generate plaintext data based on the symmetric key / asymmetric key randomly generated by the existing encryption machine, and combine the symmetric key / asymmetric key and the plaintext data into a message, wherein the character length of the plaintext data is equal to that of the symmetric key / asymmetric key.

[0079] Step S302: Send the message to the encryption machine and record the first time, so that the encryption machine can encrypt the message, generate ciphertext, and record the second time.

[0080] Step S303: Determine the average response time and the corresponding encryption machine interface function efficiency based on the first time and the second time.

[0081] Optionally, in this application, the symmetric key generation submodule 101 randomly generates a symmetric key KEY1 and distributes the key KEY1 to the message encryption submodule 102 and the message verification submodule 103.

[0082] The message encryption submodule 102 receives the key KEY1, randomly generates plaintext data D1 with the same length as the key. It combines the plaintext data D1 and the key KEY1 into a message, records the start time (i.e., the first time), sends the message to the encryption machine 02, and calls the encryption interface of the encryption machine 02 to generate ciphertext data D2. It records the end time (i.e., the second time), calculates and updates the average response time, and sends the key, plaintext data D1, and ciphertext data D2 to the message verification submodule 103.

[0083] Average response time calculation and update method: The difference between the start time and the end time is called the current response time. The new call count = old call count + 1. The new average response time = (old average response * old call count + current response time) / new call count. Based on the encryption machine identifier "encryption machine 02" and the interface identifier "encryption interface", update the new response time and the new call count to the interface performance submodule 201.

[0084] In another embodiment of this application, the asymmetric key generation submodule 104 randomly generates an asymmetric key, a private key PriKey, and a public key PubKey, and distributes the private key PriKey to the message signing submodule 105 and the public key PubKey to the message verification submodule 106.

[0085] The message signing submodule 105 receives the private key PriKey and randomly generates data D4. It combines data D4 and the private key PriKey to form a message, records the start time, sends the message to encryption machine 02, and calls the signature interface of encryption machine 02 to receive the data signature value SIGND, records the end time, and calculates the average response time. It then sends data D4 and the signature value SIGND to the message verification submodule 106. Based on the encryption machine identifier "encryption machine 02" and the interface identifier "signature interface," it updates the new average response time and the new number of calls to the interface performance submodule 201.

[0086] In one embodiment of the encryption machine data processing method of this application, see [link to embodiment]. Figure 4 The above step S201 may also specifically include the following:

[0087] Step S401: Call another encryption machine to verify the ciphertext of the data generated by the current encryption machine.

[0088] Step S402: If the plaintext obtained after message verification is consistent with the plaintext randomly generated by the current encryption machine, then the current encryption machine is determined to be in a normal state.

[0089] Optionally, in this application, the message verification submodule 103 receives key KEY1, plaintext data D1, and ciphertext D2, combines ciphertext D2 and key KEY1 into a message, records the start time, sends the message to encryption machine 02, and calls the decryption interface of encryption machine 02 to receive ciphertext D3, records the end time, and calculates the average response time. It then compares whether plaintext D1 and plaintext D3 are the same. If they are different, it registers an abnormal encryption machine status and exits. If they are the same, it registers a normal encryption machine status, identifies the encryption machine as "encryption machine 02," and transitions the status to "normal" to encryption machine status submodule 201.

[0090] In another embodiment of this application, the message verification submodule 106 receives the public key PubKey, received data D4, and signature value SIGND. It combines the public key PubKey, data D4, and signature value SIGND to form a message, records the start time, sends the message to the encryption machine 02, and calls the verification interface of the encryption machine 02 to receive the verification result. Based on the verification result, it determines whether the verification is normal. It registers the encryption machine status, identifies the encryption machine as "encryption machine 02," the interface as "verification interface," and updates the new average response time to the interface performance submodule 201.

[0091] To effectively improve the compatibility of encryption machines, this application provides an embodiment of an encryption machine data processing apparatus for implementing all or part of the encryption machine data processing method, see [link to embodiment]. Figure 5 The encryption machine data processing device specifically includes the following components:

[0092] The encryption machine screening module 10 is used to receive the original key ciphertext sent by the service caller and determine the encryption machine with the best interface performance among the existing encryption machines.

[0093] The encryption method determination module 20 is used to determine the corresponding encryption key ciphertext, encryption message format and communication method based on the identifier of the encryption machine with the best interface performance.

[0094] The decryption and encryption module 30 is used to decrypt the encryption machine key ciphertext and the original key ciphertext using a preset encryption machine master key, and then encrypt the decrypted encryption machine key plaintext to obtain the target key ciphertext.

[0095] The ciphertext feedback module 40 is used to assemble an encryption machine service message according to the encryption machine message format and communication method and send the target key ciphertext to the service caller.

[0096] As can be seen from the above description, the encryption machine data processing device provided in this application embodiment can determine the encryption machine with the best interface performance among existing encryption machines by receiving the original key ciphertext sent by the service caller; determine the corresponding encryption machine key ciphertext, encryption machine message format, and communication method according to the identifier of the encryption machine with the best interface performance; decrypt the encryption machine key ciphertext and the original key ciphertext by using a preset encryption machine master key; encrypt the decrypted encryption machine key plaintext with the decrypted key plaintext to obtain the target key ciphertext; assemble the encryption machine service message according to the encryption machine message format and communication method, and send the target key ciphertext to the service caller, thereby effectively improving the compatibility of encryption machines.

[0097] In one embodiment of the encryption machine data processing apparatus of this application, see [link to embodiment]. Figure 6 The encryption machine screening module 10 includes:

[0098] The cyclic detection unit 11 is used to cyclically detect the existing encryption machine and determine the encryption machine status and interface function efficiency.

[0099] The optimal filtering unit 12 is used to determine a list of encryption machines in normal status based on the encryption machine status and interface function efficiency of each existing encryption machine, and to determine the encryption machine with the best interface performance based on the encryption machine list.

[0100] In one embodiment of the encryption machine data processing apparatus of this application, see [link to embodiment]. Figure 7 The cyclic detection unit 11 includes:

[0101] The message generation subunit 111 is used to randomly generate plaintext data based on a symmetric key / asymmetric key randomly generated by an existing encryption machine, and to combine the symmetric key / asymmetric key and the plaintext data into a message, wherein the character length of the plaintext data is equal to that of the symmetric key / asymmetric key.

[0102] The time recording subunit 112 is used to send the message to the encryption machine and record the first time so that the encryption machine can encrypt the message to generate ciphertext and record the second time.

[0103] Interface efficiency determination subunit 113 is used to determine the average response time and the corresponding encryption machine interface function efficiency based on the first time and the second time.

[0104] In one embodiment of the encryption machine data processing apparatus of this application, see [link to embodiment]. Figure 8 The cyclic detection unit 11 further includes:

[0105] The message verification subunit 114 is used to call another encryption machine to verify the message encryption of the data ciphertext generated by the current encryption machine.

[0106] The encryption machine status determination subunit 115 is used to determine that the current encryption machine is in a normal state if the plaintext obtained after the message verification is consistent with the plaintext randomly generated by the current encryption machine.

[0107] To further illustrate this solution, this application also provides a specific application example of using the above-mentioned encryption machine data processing device to implement the encryption machine data processing method. See [link to example]. Figure 9 Specifically, it includes the following components: encryption machine detection module 001, encryption machine and interface service module 002, dynamic key distribution module 003, and encryption machine module 004.

[0108] The encryption machine detection module 001 consists of a symmetric key generation submodule 101, a message encryption submodule 102, a message verification submodule 103, an asymmetric key generation submodule 104, a message signature submodule 105, and a message signature verification submodule 106.

[0109] The encryption machine and interface service module 002 consists of an interface performance submodule 201, an encryption machine status submodule 202, and an encryption machine service scheduling submodule 203.

[0110] Interface performance submodule 201 records interface performance information. Format: Interface identifier, encryption machine identifier, average response time, number of calls.

[0111] The encryption machine status submodule 202 records the encryption machine identifier and automatically selects the encryption machine message format and communication method. Format: Encryption machine identifier, message format, communication method, status.

[0112] The dynamic key distribution module 003 consists of a key dynamic processing submodule 301, a first encryption machine 302, and a key storage 303.

[0113] Key storage 303: Each master key of the encryption machine group is encrypted and protected as ciphertext using the master key of the first encryption machine, and the ciphertext is stored in key storage 303.

[0114] Encryption module 004 consists of multiple encryption machines.

[0115] Specifically, this embodiment relates to an encryption machine monitoring process, including:

[0116] 1) Encryption machine detection module 001 cyclically detects each encryption machine and marks the encryption machine status and interface function efficiency. The following example is to detect the symmetric key encryption function and asymmetric key of encryption machine 02.

[0117] 2) The symmetric key generation submodule 101 randomly generates a symmetric key KEY1 and distributes the key KEY1 to the message encryption submodule 102 and the message verification submodule 103.

[0118] 3) The message encryption submodule 102 receives the key KEY1, randomly generates plaintext data D1 with the same length as the key. It combines the plaintext data D1 and the key KEY1 into a message, records the start time, sends the message to the encryption machine 02, calls the encryption interface of the encryption machine 02 to generate ciphertext data D2, records the end time, calculates and updates the average response time, and sends the key, plaintext data D1, and ciphertext data D2 to the message verification submodule 103.

[0119] Average response time calculation and update method: The difference between the start time and the end time is called the current response time. The new call count = old call count + 1. The new average response time = (old average response * old call count + current response time) / new call count. Based on the encryption machine identifier "encryption machine 02" and the interface identifier "encryption interface", update the new response time and the new call count to the interface performance submodule 201.

[0120] 4) The message verification submodule 103 receives the key KEY1, plaintext D1, and ciphertext D2. It combines the ciphertext D2 and key KEY1 into a message, records the start time, sends the message to the encryption machine 02, and calls the decryption interface of the encryption machine 02 to receive the ciphertext D3, records the end time, and calculates the average response time. It compares whether plaintext D1 and plaintext D3 are the same. If they are different, it registers the encryption machine status as abnormal and exits. If they are the same, it registers the encryption machine status as normal, identifies the encryption machine as "encryption machine 02", and changes the status to "normal" to the encryption machine status submodule 201.

[0121] 5) The asymmetric key generation submodule 104 randomly generates an asymmetric key, a private key PriKey and a public key PubKey, and distributes the private key PriKey to the message signing submodule 105 and the public key PubKey to the message verification submodule 106.

[0122] 6) The message signature submodule 105 receives the private key PriKey and randomly generates data D4. It combines data D4 and the private key PriKey to form a message, records the start time, sends the message to encryption machine 02, and calls the signature interface of encryption machine 02 to receive the data signature value SIGND, records the end time, and calculates the average response time. It then sends data D4 and the signature value SIGND to the message verification submodule 106. Based on the encryption machine identifier "encryption machine 02" and the interface identifier "signature interface," it updates the new average response time and the new number of calls to the interface performance submodule 201.

[0123] 7) The message signature verification submodule 106 receives the public key PubKey, received data D4, and signature value SIGND. It combines the public key PubKey, data D4, and signature value SIGND to form a message, records the start time, sends the message to encryption machine 02, and calls the signature verification interface of encryption machine 02 to receive the signature verification result. Based on the result, it determines whether the verification is normal. It registers the encryption machine status, identifies the encryption machine as "encryption machine 02," the interface as "signature verification interface," and updates the new average response time to the interface performance submodule 201.

[0124] In addition, this embodiment also relates to a service scheduling process, including:

[0125] The service caller invokes the encryption machine service scheduling submodule 203, sending in the key ciphertext. The encryption machine service scheduling submodule 203 then invokes the encryption machine status submodule 202 to obtain a list of encryption machines in normal status. Based on the list of encryption machines in normal status, the interface performance submodule 201 is used to match the identifier of the encryption machine with the best interface performance.

[0126] The encryption machine service scheduling submodule 203 calls the key dynamic processing submodule 301 of the dynamic key distribution module 003, sending in the encryption machine identifier and the key ciphertext. The key dynamic processing submodule 301 retrieves the encryption machine key ciphertext from the key storage 303 based on the encryption machine key identifier, and sends the encryption machine key ciphertext and the key ciphertext to the first encryption machine 302. The first encryption machine 302 decrypts the key ciphertext using its master key to obtain the key plaintext, decrypts the encryption machine key ciphertext using its master key to obtain the encryption machine key plaintext, and encrypts the key plaintext using the encryption machine key plaintext to obtain the new key ciphertext, and returns it to the encryption machine service scheduling submodule 203.

[0127] The encryption machine service scheduling submodule 203 automatically selects the encryption machine message format and communication method according to the encryption machine identifier, and assembles the encryption machine service message according to the message format and communication method.

[0128] The encryption machine service scheduling submodule 203 uses the new key ciphertext and data, calls the corresponding encryption machine according to the encryption machine identifier, receives the corresponding encryption machine service, and returns it to the service caller.

[0129] Based on the above, this application can achieve at least the following technical effects:

[0130] 1) Enhanced encryption machine compatibility, allowing for flexible compatibility with multiple encryption machine products from various manufacturers.

[0131] 2) Select the encryption machine based on the interface performance to maximize its performance.

[0132] 3) The protection key is separated from the encryption machine master key, which improves the security of both the protection key and the encryption machine master key.

[0133] 4) Monitor the functionality of the encryption machine through custom transactions to enhance in-depth monitoring capabilities.

[0134] From a hardware perspective, in order to effectively improve the compatibility of the encryption machine, this application provides an embodiment of an electronic device for implementing all or part of the encryption machine data processing method, wherein the electronic device specifically includes the following:

[0135] The system comprises a processor, memory, a communications interface, and a bus; wherein the processor, memory, and communications interface communicate with each other via the bus; the communications interface is used to realize information transmission between the encryption machine data processing device and core business systems, user terminals, and related databases and other related devices; the logic controller can be a desktop computer, tablet computer, or mobile terminal, etc., and this embodiment is not limited to these. In this embodiment, the logic controller can be implemented with reference to the embodiments of the encryption machine data processing method and the encryption machine data processing device in the embodiments, the contents of which are incorporated herein, and repeated details will not be described again.

[0136] It is understood that the user terminal may include smartphones, tablet computers, network set-top boxes, portable computers, desktop computers, personal digital assistants (PDAs), in-vehicle devices, smart wearable devices, etc. Among these, the smart wearable devices may include smart glasses, smartwatches, smart bracelets, etc.

[0137] In practical applications, the encryption machine data processing method can be executed on the electronic device side as described above, or all operations can be completed in the client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations on this. If all operations are completed in the client device, the client device may further include a processor.

[0138] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0139] Figure 10 This is a schematic block diagram illustrating the system configuration of the electronic device 9600 according to an embodiment of this application. Figure 10 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that... Figure 10 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions.

[0140] In one embodiment, the encryption machine data processing method function can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following control:

[0141] Step S101: Receive the original key ciphertext sent by the service caller and determine the encryption machine with the best interface performance among the existing encryption machines.

[0142] Step S102: Determine the corresponding encryption key ciphertext, encryption message format, and communication method based on the identifier of the encryption machine with the best interface performance.

[0143] Step S103: Decrypt the encrypted key ciphertext and the original key ciphertext using the preset encrypted key master key, and then encrypt the decrypted key plaintext using the encrypted key plaintext to obtain the target key ciphertext.

[0144] Step S104: Assemble the encryption machine service message according to the encryption machine message format and communication method, and send the target key ciphertext to the service caller.

[0145] As described above, the electronic device provided in this application embodiment determines the encryption machine with the best interface performance among existing encryption machines by receiving the original key ciphertext sent by the service caller; determines the corresponding encryption machine key ciphertext, encryption machine message format, and communication method according to the identifier of the encryption machine with the best interface performance; decrypts the encryption machine key ciphertext and the original key ciphertext by using a preset encryption machine master key; encrypts the decrypted key plaintext with the encryption machine key plaintext obtained after decryption to obtain the target key ciphertext; assembles an encryption machine service message according to the encryption machine message format and communication method, and sends the target key ciphertext to the service caller, thereby effectively improving the compatibility of encryption machines.

[0146] In another embodiment, the encryption machine data processing device can be configured separately from the central processing unit 9100. For example, the encryption machine data processing device can be configured as a chip connected to the central processing unit 9100, and the encryption machine data processing method function can be implemented through the control of the central processing unit.

[0147] like Figure 10 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily need to include these components. Figure 10 All components shown; in addition, the electronic device 9600 may also include Figure 10 For components not shown, please refer to existing technologies.

[0148] like Figure 10 As shown, the central processing unit 9100, sometimes also referred to as a controller or operating control, may include a microprocessor or other processor device and / or logic device, which receives inputs and controls the operation of various components of the electronic device 9600.

[0149] The memory 9140 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 9100 may execute the program stored in the memory 9140 to perform information storage or processing, etc.

[0150] Input unit 9120 provides input to central processing unit 9100. Input unit 9120 may be, for example, a keypad or touch input device. Power supply 9170 provides power to electronic device 9600. Display 9160 displays images and text. Display may be, for example, an LCD display, but is not limited thereto.

[0151] The memory 9140 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 via the central processing unit 9100.

[0152] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for the electronic device's communication functions and / or for performing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0153] The communication module 9110 is a transmitter / receiver 9110 that transmits and receives signals via the antenna 9111. The communication module (transmitter / receiver) 9110 is coupled to the central processing unit 9100 to provide input signals and receive output signals, which can be the same as in a conventional mobile communication terminal.

[0154] Based on different communication technologies, multiple communication modules 9110 can be configured in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module (transmitter / receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby realizing typical telecommunications functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Additionally, the audio processor 9130 is coupled to a central processing unit 9100, enabling on-device recording via the microphone 9132 and on-device playback of stored sound via the speaker 9131.

[0155] Embodiments of this application also provide a computer-readable storage medium capable of implementing all steps of the encryption machine data processing method with a server or client as the execution subject in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the encryption machine data processing method with a server or client as the execution subject in the above embodiments. For example, when the processor executes the computer program, it implements the following steps:

[0156] Step S101: Receive the original key ciphertext sent by the service caller and determine the encryption machine with the best interface performance among the existing encryption machines.

[0157] Step S102: Determine the corresponding encryption key ciphertext, encryption message format, and communication method based on the identifier of the encryption machine with the best interface performance.

[0158] Step S103: Decrypt the encrypted key ciphertext and the original key ciphertext using the preset encrypted key master key, and then encrypt the decrypted key plaintext using the encrypted key plaintext to obtain the target key ciphertext.

[0159] Step S104: Assemble the encryption machine service message according to the encryption machine message format and communication method, and send the target key ciphertext to the service caller.

[0160] As described above, the computer-readable storage medium provided in this application embodiment determines the encryption machine with the best interface performance among existing encryption machines by receiving the original key ciphertext sent by the service caller; determines the corresponding encryption machine key ciphertext, encryption machine message format, and communication method according to the identifier of the encryption machine with the best interface performance; decrypts the encryption machine key ciphertext and the original key ciphertext by using a preset encryption machine master key; encrypts the decrypted key plaintext with the encryption machine key plaintext obtained after decryption to obtain the target key ciphertext; assembles an encryption machine service message according to the encryption machine message format and communication method, and sends the target key ciphertext to the service caller, thereby effectively improving encryption machine compatibility.

[0161] Embodiments of this application also provide a computer program product capable of implementing all steps of the encryption machine data processing method with the execution subject being a server or client in the above embodiments. When this computer program / instruction is executed by a processor, it implements the steps of the encryption machine data processing method. For example, the computer program / instruction implements the following steps:

[0162] Step S101: Receive the original key ciphertext sent by the service caller and determine the encryption machine with the best interface performance among the existing encryption machines.

[0163] Step S102: Determine the corresponding encryption key ciphertext, encryption message format, and communication method based on the identifier of the encryption machine with the best interface performance.

[0164] Step S103: Decrypt the encrypted key ciphertext and the original key ciphertext using the preset encrypted key master key, and then encrypt the decrypted key plaintext using the encrypted key plaintext to obtain the target key ciphertext.

[0165] Step S104: Assemble the encryption machine service message according to the encryption machine message format and communication method, and send the target key ciphertext to the service caller.

[0166] As described above, the computer program product provided in this application embodiment determines the encryption machine with the best interface performance among existing encryption machines by receiving the original key ciphertext sent by the service caller; determines the corresponding encryption machine key ciphertext, encryption machine message format, and communication method according to the identifier of the encryption machine with the best interface performance; decrypts the encryption machine key ciphertext and the original key ciphertext by using a preset encryption machine master key; encrypts the decrypted key plaintext with the decrypted key plaintext to obtain the target key ciphertext; assembles an encryption machine service message according to the encryption machine message format and communication method, and sends the target key ciphertext to the service caller, thereby effectively improving encryption machine compatibility.

[0167] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0168] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0169] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0170] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0171] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A data processing method for an encryption machine, characterized in that, The method includes: Receive the original key ciphertext sent by the service caller and determine the encryption machine with the best interface performance among the existing encryption machines; The corresponding encryption key ciphertext, encryption message format, and communication method are determined based on the identifier of the encryption machine with the best interface performance; wherein, the encryption message format and communication method are automatically selected based on the encryption machine identifier; the encryption key ciphertext is obtained from the designated key storage unit based on the key identifier of the encryption machine with the best interface performance. The encryption machine key ciphertext and the original key ciphertext are decrypted using a preset encryption machine master key, and the decrypted key plaintext is then used to encrypt the decrypted key plaintext to obtain the target key ciphertext. The encryption machine service message is assembled according to the encryption machine message format and communication method, and the target key ciphertext is sent to the service caller. The step of decrypting the encryption key ciphertext and the original key ciphertext using a preset encryption master key includes: The encrypted machine key ciphertext and the original key ciphertext are sent to a preset master encryption machine and decrypted using the preset master encryption machine key; The step of assembling an encryption machine service message according to the encryption machine message format and communication method, and sending the target key ciphertext to the service caller, includes: Call the encryption machine message format and communication method of the encryption machine with the best performance of the interface, and assemble the encryption machine service message; The target key ciphertext is sent to the service caller via the encryption machine service message.

2. The encryption machine data processing method according to claim 1, characterized in that, The process of determining the encryption machine with the best interface performance among existing encryption machines includes: Continuously probe existing encryption machines and determine their status and interface efficiency; Based on the existing encryption machine status and interface function efficiency, a list of encryption machines in normal status is determined, and based on the encryption machine list, the encryption machine with the best interface performance is determined.

3. The encryption machine data processing method according to claim 2, characterized in that, The process of cyclically probing existing encryption machines and determining interface functional efficiency includes: Data plaintext is randomly generated based on the symmetric / asymmetric key randomly generated by the existing encryption machine, and the symmetric / asymmetric key and the data plaintext are combined to form a message, wherein the character length of the data plaintext is equal to that of the symmetric / asymmetric key; The message is sent to the encryption machine, and the first time is recorded, so that the encryption machine encrypts the message to generate ciphertext and records the second time. Based on the first time and the second time, the average response time and the corresponding encryption machine interface function efficiency are determined.

4. The encryption machine data processing method according to claim 2, characterized in that, The process of cyclically probing existing encryption machines and determining their status includes: Call another encryption machine to verify the ciphertext generated by the current encryption machine; If the plaintext obtained after message verification matches the plaintext randomly generated by the current encryption machine, then the current encryption machine is determined to be in a normal state.

5. A data processing device for an encryption machine, characterized in that, include: The encryption machine filtering module is used to receive the original key ciphertext sent by the service caller and determine the encryption machine with the best interface performance among the existing encryption machines; The encryption method determination module is used to determine the corresponding encryption key ciphertext, encryption message format, and communication method based on the identifier of the encryption machine with the best interface performance; wherein, the encryption message format and communication method are automatically selected based on the encryption machine identifier; the encryption key ciphertext is obtained from the designated key storage unit based on the key identifier of the encryption machine with the best interface performance; The decryption and encryption module is used to decrypt the encryption machine key ciphertext and the original key ciphertext using a preset encryption machine master key, and to encrypt the decrypted key plaintext using the encryption machine key plaintext obtained after the decryption, so as to obtain the target key ciphertext. The ciphertext feedback module is used to assemble an encryption machine service message according to the encryption machine message format and communication method, and send the target key ciphertext to the service caller; The decryption and encryption module is specifically used for: The encrypted machine key ciphertext and the original key ciphertext are sent to a preset master encryption machine and decrypted using the preset master encryption machine key; The encrypted feedback module is specifically used to: call the encryption machine message format and communication method of the encryption machine with the best interface performance and assemble the encryption machine service message; The target key ciphertext is sent to the service caller via the encryption machine service message.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the encryption machine data processing method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the encryption machine data processing method according to any one of claims 1 to 4.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the encryption machine data processing method according to any one of claims 1 to 4.

Images