Password configuration method, password service method and related equipment

Abstract

The embodiment of the present application provides a password configuration method, a password service method and related devices, the password configuration method is applied to a password management device that manages password modules of multiple servers, including: sending key configuration information including at least a key for the first password module to perform a password service to a first password module, the first password module is any password module of any server; obtaining a first key image containing the key from the first password module; forwarding the first key image to a second password module, so that the second password module obtains the key, so that when the second password module is called by the corresponding server, the key is used to perform a cryptographic operation, the second password module is another password module configured on a different server. The embodiment of the present application can improve the performance of the password service.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a password configuration method, a password service method and related devices. Background Art

[0002] Passwords are the foundation of data security. Cryptographic operations on data through cryptographic application patterns can effectively ensure the confidentiality and security of data transmission. In addition to being applied to cryptographic operations on specific physical devices such as cryptographic machines, cryptographic application patterns can also be used in parallel cluster systems composed of a large number of devices, such as cloud computing, where a large number of servers and virtual machines running on the servers form a cluster to form a large computing resource, with each server running the same or similar services and performing the same or similar cryptographic operations.

[0003] In this context, it is particularly important to provide technical solutions to meet the cryptographic computing needs of each device in a parallel cluster system composed of a large number of devices and improve the performance of cryptographic services. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a password configuration method, a password service method and related devices to improve the performance of password services.

[0005] In a first aspect, an embodiment of the present application provides a password configuration method, which is applied to a password management device, wherein the password management device is used to manage password modules of multiple servers, and the method includes:

[0006] Sending key configuration information to a first cryptographic module, the key configuration information at least including a key for the first cryptographic module to perform a cryptographic service, the first cryptographic module being any cryptographic module of any server;

[0007] Obtaining a first key image of the first cryptographic module, where the first key image includes the key;

[0008] The first key image is forwarded to a second cryptographic module so that the second cryptographic module obtains the key and uses the key to perform cryptographic operations when the second cryptographic module is called by a corresponding server. The second cryptographic module is another cryptographic module configured on a different server.

[0009] Optionally, the password modules of the multiple servers managed by the password management device include a shared key;

[0010] The first key image of the first cryptographic module is obtained by: the first cryptographic module encrypts the corresponding key image by using the shared key;

[0011] The forwarding of the first key image to the second cryptographic module so that the second cryptographic module obtains the key is specifically: forwarding the first key image to the second cryptographic module so that the second cryptographic module decrypts the first key image using a shared key, obtains the key image corresponding to the first cryptographic module, and obtains the key according to the key image corresponding to the first cryptographic module.

[0012] Optionally, the cryptographic modules of the multiple servers managed by the cryptographic management device include an asymmetric encryption key pair and a signature public key obtained from an external certificate authority, and the first asymmetric encryption key pair of the first cryptographic module is different from the second asymmetric encryption key pair of the second cryptographic module;

[0013] Before obtaining the first key image of the first cryptographic module, the method further includes:

[0014] Obtaining a public key certificate of the second cryptographic module signed by an external certificate authority, wherein the public key certificate of the second cryptographic module includes the second public key in the second asymmetric encryption key pair;

[0015] The public key certificate of the second cryptographic module signed by the external certificate authority is forwarded to the first cryptographic module, so that the first cryptographic module verifies the legitimacy of the public key certificate of the second cryptographic module using the signature public key obtained from the external certificate authority.

[0016] In a second aspect, an embodiment of the present application provides a password configuration method, which is applied to a password module of a server, wherein the password module includes a first password module and a second password module, wherein the first password module is any password module of any server, and the second password module is another password module configured on a different server, wherein the method includes:

[0017] The first cryptographic module obtains key configuration information sent by the cryptographic management device, where the key configuration information at least includes a key for executing a cryptographic service;

[0018] The first cryptographic module sends a first key image to the password management device, so that the password management device forwards the first key image to the second cryptographic module, wherein the first key image includes the key;

[0019] The second cryptographic module obtains the first key image, and obtains the key according to the first key image, so as to perform cryptographic operations using the key when being called by the corresponding server.

[0020] Optionally, the cryptographic module includes a shared key;

[0021] The first key image sent by the first cryptographic module to the password management device is specifically obtained by encrypting the corresponding key image by the first cryptographic module using the shared key;

[0022] The second cryptographic module obtains the key according to the first key image, including:

[0023] The second cryptographic module decrypts the first key image using the shared key to obtain the key image corresponding to the first cryptographic module;

[0024] The second cryptographic module obtains the key according to the key image corresponding to the first cryptographic module.

[0025] Optionally, the cryptographic module includes an asymmetric encryption key pair and a signature public key obtained from an external certificate authority, and the first asymmetric encryption key pair of the first cryptographic module is different from the second asymmetric encryption key pair of the second cryptographic module;

[0026] Before the first password module sends the first key image to the password management device, the method further includes:

[0027] The first cryptographic module obtains the public key certificate of the second cryptographic module signed by an external certificate authority and sent by the password management device, wherein the public key certificate of the second cryptographic module includes the second public key in the second asymmetric encryption key pair;

[0028] The first cryptographic module verifies the legitimacy of the public key certificate of the second cryptographic module using the signature public key obtained from an external certificate authority;

[0029] If it is legal, the first cryptographic module obtains the second public key in the second asymmetric encryption key pair, and uses the second public key to encrypt the corresponding key image to obtain the first key image.

[0030] Optionally, the second cryptographic module obtains the first key image, and obtains the key according to the first key image, including:

[0031] The second cryptographic module obtains the first key image;

[0032] The second cryptographic module uses the second private key in the second asymmetric encryption key pair to decrypt the first key image to obtain the key image corresponding to the first cryptographic module;

[0033] The second cryptographic module obtains the key according to the key image corresponding to the first cryptographic module.

[0034] In a third aspect, an embodiment of the present application provides a cryptographic service method, which is applied to a cryptographic module of a server, and the method includes:

[0035] Obtaining a cryptographic service request of a cryptographic application, wherein the cryptographic application and the cryptographic module are located on the same server;

[0036] According to the cryptographic service request, the key configured by the cryptographic configuration method described in the first aspect and / or the second aspect is called to perform cryptographic operations to provide cryptographic services for the cryptographic application.

[0037] In a fourth aspect, an embodiment of the present application provides a password management device, comprising at least one memory and at least one processor, wherein the memory stores one or more computer executable instructions, and the processor calls the one or more computer executable instructions to execute the password configuration method as described in the first aspect above.

[0038] In a fifth aspect, an embodiment of the present application provides a server comprising at least one memory and at least one processor, wherein the memory stores one or more computer executable instructions, and the processor calls the one or more computer executable instructions to execute the password configuration method as described in the second aspect above, or the password service method as described in the third aspect above.

[0039] In a sixth aspect, an embodiment of the present application provides a password service system, comprising at least a password management device and a plurality of servers, each of the servers comprising at least a password module and a password application, and the password management device is used to manage the password modules of the plurality of servers;

[0040] Wherein, the password module includes:

[0041] A request acquisition unit, used to acquire a cryptographic service request of a cryptographic application;

[0042] The cryptographic operation unit is used to call a key to perform cryptographic operation according to the cryptographic service request to provide cryptographic services for the cryptographic application, and the key is obtained based on the configuration of the cryptographic management device.

[0043] Optionally, the password management device includes:

[0044] a configuration information sending unit, configured to send key configuration information to a first cryptographic module, wherein the key configuration information at least includes a key for the first cryptographic module to perform a cryptographic service, and the first cryptographic module is any cryptographic module of any server;

[0045] An image acquisition unit, configured to acquire a first key image of the first cryptographic module, wherein the first key image includes the key;

[0046] The image forwarding unit is used to forward the first key image to the second cryptographic module so that the second cryptographic module obtains the key and uses the key to perform cryptographic operations when the second cryptographic module is called by the corresponding server. The second cryptographic module is another cryptographic module configured on a different server.

[0047] Optionally, the password module further includes: a first password module and a second password module;

[0048] The first cryptographic module is configured to obtain key configuration information sent by the password management device, wherein the key configuration information at least includes a key for performing a cryptographic service; and send a first key image to the password management device, so that the password management device forwards the first key image to the second cryptographic module, wherein the first key image includes the key;

[0049] The second cryptographic module is used to obtain the first key image, and obtain the key according to the first key image, so as to perform cryptographic operations using the key when called by the corresponding server.

[0050] Optionally, the cryptographic module is configured with a signature public key, and the signature public key is obtained based on a key file configuration of an external certificate authority.

[0051] In the seventh aspect, an embodiment of the present application provides a storage medium, which stores one or more computer-executable instructions. When the one or more computer-executable instructions are executed, the password configuration method as described in the first aspect above, or the password configuration method as described in the second aspect above, or the password service method as described in the third aspect above is implemented.

[0052] The password configuration method provided in the embodiment of the present application is applied to a password management device that manages password modules of multiple servers. The password management device sends key configuration information to a first password module, and the key configuration information at least includes a key for the first password module to perform password services. The first password module is any password module of any server; then a first key image of the first password module is obtained, and the first key image contains the key; and the first key image is forwarded to a second password module so that the second password module obtains the key, so that when the second password module is called by the corresponding server, the key is used to perform password services. The second password module is another password module configured on a different server.

[0053] It can be seen that in the embodiment of the present application, when the password management device configures the password module of any server to perform a key for cryptographic operations, the key image containing the key is forwarded to the password modules of different servers through the password management device, so that the keys are configured in the password modules on multiple servers, thereby realizing key synchronization of the password modules on different servers; furthermore, each server can perform cryptographic operations based on the cryptographic modules configured with the keys to obtain cryptographic services. Compared with the method in which multiple servers obtain cryptographic services by accessing a cryptographic machine through the network, the multiple servers in the embodiment of the present application can no longer rely on the network when obtaining cryptographic services, thereby effectively reducing the occupation of network bandwidth resources while improving the performance of cryptographic services. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0055] Figure 1 is an optional schematic diagram of a cluster system;

[0056] Figure 2 It is a schematic diagram of the architecture of the cryptographic service system provided in the embodiment of the present application;

[0057] Figure 3 is an interactive flow chart of the password configuration method provided in the embodiment of the present application;

[0058] Figure 4 It is an optional flow chart of the password configuration method provided in the embodiment of the present application;

[0059] Figure 5 This is another optional flow chart of the password configuration method provided in the embodiment of the present application;

[0060] Figure 6 is another interactive flow chart of the password configuration method provided in an embodiment of the present application;

[0061] Figure 7 It is an optional flow chart of the password service method provided in the embodiment of the present application;

[0062] Figure 8 is an optional block diagram of a password management device provided in an embodiment of the present application;

[0063] Fig. 9 is a schematic diagram of an optional structure of a password module provided in an embodiment of the present application;

[0064] Fig.10It is a schematic diagram of an optional structure of the password management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0066] As described in the background technology, in addition to being applied to cryptographic operations on specific physical devices such as cryptographic machines, the cryptographic application model can also be used in parallel cluster systems composed of a large number of devices, such as cloud computing, where a large number of servers and virtual machines running on the servers form a cluster to form a large computing resource, and each server runs the same or similar services and performs the same or similar cryptographic operations.

[0067] Among them, a parallel cluster system (hereinafter referred to as a cluster system) composed of a large number of devices is usually connected through a high-speed communication network. Therefore, in order to meet the cryptographic operation requirements of each device in the cluster system, in one example, a "centralized" cryptographic service can be adopted. For a certain type of cryptographic service requirements, a certain number of cryptographic machines are set in the cluster system to centrally store and manage the passwords of all servers in the system. By connecting the cryptographic machine to the cluster network, the servers in the cluster can access the services provided by the cryptographic machine through the network.

[0068] like Figure 1 The cluster system 100 shown is an optional schematic diagram, the cluster system 100 includes multiple servers 101 and cryptographic machines 102, and the multiple servers 101 and cryptographic machines 102 communicate with each other through a network. Figure 1 The multiple servers 101 shown have requirements for a certain type of cryptographic service, and the multiple cryptographic machines 102 have the same configuration for the cryptographic service type of the servers 101 and can provide the same target type of cryptographic service.

[0069] However, the inventors found that: the server sends the data to be processed to the cryptographic machine through the network, and the cryptographic machine performs cryptographic operations on the data to be processed and returns it to the server through the network. Therefore, when all servers in the cluster system access the cryptographic machine through the network to perform cryptographic operations, a large amount of data will be moved, resulting in a large amount of network bandwidth being occupied, affecting the normal business on the network. In addition, when multiple servers use the network to perform business at the same time, the cryptographic service performance of the cryptographic machine will also be reduced due to the instability of the network bandwidth. In addition, the cost of the cryptographic machine is relatively high, and the price of a dedicated cryptographic machine dedicated to a certain type of cryptographic service is even more expensive, which seriously increases the research and development cost of the cluster system.

[0070] It can be seen that when a parallel cluster system composed of a large number of devices has cryptographic operation requirements, how to meet the cryptographic operation requirements of each device in the parallel cluster system and improve the cryptographic operation performance of the system is particularly important. Based on this, the embodiment of the present application uses an improved technical solution to configure the cryptographic module of any server through a password management device to perform cryptographic operations, and then forward the key image containing the key to the cryptographic modules of different servers, so that the cryptographic modules on multiple servers are configured with keys, and the key synchronization of the cryptographic modules on different servers is achieved, and then each server can perform cryptographic operations based on the cryptographic modules configured with keys to obtain cryptographic services. Compared with the way that multiple servers obtain cryptographic services by accessing the cryptographic machine through the network, the multiple servers in the embodiment of the present application can no longer rely on the network when obtaining cryptographic services, thereby effectively reducing the occupation of network bandwidth resources and improving the performance of cryptographic services.

[0071] Based on the above ideas, Figure 2 The schematic diagram of the architecture of the cryptographic service system provided by the embodiment of the present application is shown as an example. Figure 2 As shown, the cryptographic service system at least includes: a plurality of servers 20 and a cryptographic management terminal (CMT) 21.

[0072] The server 20 refers to a dedicated computer that provides services to users in a network environment. It is installed with a network operating system and various application software, such as cryptographic applications. The server can run relevant cryptographic applications according to business needs. Among them, the server 20 is correspondingly provided with a cryptographic module (Crypto Module, CM) 201. The cryptographic module 201 is a module with cryptographic operation functions. It stores the key corresponding to the cryptographic service executed by the cryptographic application on the server, and when the cryptographic application on the server calls the cryptographic module based on the provided dedicated interface, it uses the stored key to perform cryptographic operations. Among them, Figure 2 The multiple servers 20 in the system run in the same network environment, and the operating system can be called a parallel cluster system.

[0073] The password management device 21 is used to manage the password modules 201 of multiple servers 20, can create or modify the keys stored in the password modules 201, and support key synchronization between different password modules 201 by forwarding key images.

[0074] It should be noted that the password module in the embodiment of the present application can store all the keys, and in order to ensure that each password module can provide consistent password services, it is necessary to synchronize the key information between different password modules. Therefore, by managing the password modules of multiple servers through the password management device, key synchronization of different password modules can be achieved, thereby improving the performance of password services.

[0075] The following is a detailed description of the password configuration scheme of the embodiment of the present application based on the above-mentioned password service system architecture.

[0076] Figure 3 The following is an exemplary interactive flow chart of the password configuration method provided in the embodiment of the present application. The method flow can be Figure 2 The password module and password management device of the server in the password service system are implemented, wherein the password module may include a first password module and a second password module, wherein the first password module is any password module of any server, and the second password module is another password module configured on a different server. Figure 3 As shown, the method flow may include the following steps.

[0077] Step S31: The password management device sends key configuration information to the first password module.

[0078] In the case where the password management device manages the password modules of multiple servers, the password management device may send key configuration information to the first password module, wherein the key configuration information may be information for configuring the key corresponding to the password module. Furthermore, in the case where the password management device has the authority to create or modify the key stored in the password module, the key configuration information may at least include the key for the first password module to perform the password service, which may be a newly created key or a key after a certain key is modified.

[0079] It should be noted that, in the embodiment of the present application, step S31 can be implemented when there is a demand for execution of the password module, for example, when the system is powered on, or when the password module of the corresponding server in the system is started.

[0080] Step S32: The first password module obtains key configuration information sent by the password management device.

[0081] Step S33: The first cryptographic module sends the first key image to the cryptographic management device.

[0082] It is understandable that the cryptographic module usually stores the cryptographic algorithm and key in the image file within the module. When the cryptographic module is started, it will load the image file and perform the corresponding cryptographic algorithm and key operations. Therefore, after obtaining the key configuration information sent by the password management device, the first cryptographic module can update its corresponding key image based on the key configuration information. Among them, the key image of the cryptographic module is a copy of the key required for the cryptographic module to perform cryptographic operations, and contains the image form of all keys stored in the cryptographic module. The key image can be a binary code file or data file. By using the key image, the security and confidentiality of the key information can be protected to prevent unauthorized access and attacks.

[0083] Furthermore, in order to synchronize the keys to different cryptographic modules, after the first cryptographic module obtains the key configuration information sent by the password management device, the first cryptographic module may send a first key image to the password management device, and the first key image may include the key for the first cryptographic module to perform the cryptographic service. Furthermore, in order to ensure the key security of the cryptographic module, as an optional implementation, the first key image may be an image file after the key image corresponding to the first cryptographic module is encrypted.

[0084] It should be noted that the first cryptographic module sends the first key image to the password management device, which can be executed when the password management device calls the information export interface corresponding to the first cryptographic module.

[0085] Step S34: The password management device obtains the first key image of the first password module.

[0086] Step S35: The password management device forwards the first key image to the second password module.

[0087] It can be understood that in order to synchronize keys between different cryptographic modules, the cryptographic management device can forward the first key image to the second cryptographic module after obtaining the first key image of the first cryptographic module, so that the second cryptographic module can obtain the key of the first cryptographic module to perform cryptographic services, so that when the second cryptographic module is called by the corresponding server, the key can be used to perform cryptographic operations.

[0088] It should be noted that the password management device forwards the first key image to the second password module by calling the information import interface of the second password module.

[0089] Step S36: The second cryptographic module obtains the first key image, and obtains the key according to the first key image.

[0090] In the case where the first key image includes the key for the first cryptographic module to perform cryptographic services, after the second cryptographic module obtains the first key image forwarded by the cryptographic management module, it can obtain the key according to the first key image. Furthermore, when the second cryptographic module is called by the corresponding server, it can use the key to perform cryptographic operations, so that the server can obtain cryptographic services.

[0091] It can be seen that in the embodiment of the present application, when the password management device configures the password module of any server to perform a key for cryptographic operations, the key image containing the key is forwarded to the password modules of different servers through the password management device, so that the keys are configured in the password modules on multiple servers, thereby realizing key synchronization of the password modules on different servers; furthermore, each server can perform cryptographic operations based on the cryptographic modules configured with the keys to obtain cryptographic services. Compared with the method in which multiple servers obtain cryptographic services by accessing a cryptographic machine through the network, the multiple servers in the embodiment of the present application can no longer rely on the network when obtaining cryptographic services, thereby effectively reducing the occupation of network bandwidth resources while improving the performance of cryptographic services.

[0092] In some embodiments, to ensure the security of the key image forwarded by the password management device, the first key image may be obtained by encrypting the key image by the first password module, that is, the first key image is the ciphertext of the key image corresponding to the first password module.

[0093] As an optional implementation, the key used by the first cryptographic module to encrypt the key image may be a shared key (SharedKey, SK). Figure 4 The following is an exemplary diagram of an optional flow chart of the password configuration method in the embodiment of the present application. Figure 4 As shown, the first password module and the second password module include a shared key. The first password module encrypts its corresponding key image using the shared key to obtain the first key image. Then, when the password management device calls the export interface of the first password module, the first password module exports the first key image to the password management device; when the password management device calls the import interface of the second password module, the password management device imports the first key image into the second password module. After the second password module obtains the first key image imported by the password management device, the second password module can decrypt the first key image using the shared key, thereby obtaining the key image corresponding to the first password module, and then obtaining the key according to the key image corresponding to the first password module.

[0094] It should be noted that the shared key of the cryptographic module may be set by the manufacturer when manufacturing the server, and therefore, a shared key may exist in multiple cryptographic modules belonging to the same manufacturer.

[0095] As another optional implementation, the cryptographic module may include an asymmetric encryption key pair (a public key and a private key), and the asymmetric encryption key pairs of each cryptographic module may be different, so the key of the encryption key image of the first cryptographic module may be the public key in the asymmetric encryption key pair of the second cryptographic module. Figure 5 Another optional flow chart of the password configuration method provided in the embodiment of the present application is shown as an example. Figure 5 As shown, the second cryptographic module includes an asymmetric encryption key pair (the public key is shown as PbEK2 in the figure, and the private key is shown as PvEK2), and the first cryptographic module is configured with a signature public key (shown as PbSK in the figure), which can be obtained based on the key file configuration of an external certificate authority. Specifically, the external certificate authority (CA) has an asymmetric signature key pair (the public key is shown as PbSK in the figure, and the private key is shown as PvSK), and the external certificate authority can issue a public key certificate for the public key in the asymmetric encryption key pair of the verified cryptographic module, so as to be used by another cryptographic module to verify the legitimacy of the cryptographic module, so as to ensure the transmission security of the key image.

[0096] It should be noted that any cryptographic module of any server in the embodiments of the present application may include an asymmetric encryption key pair and a signature public key obtained from an external certificate authority. Figure 5 Only the signature public key PbSK is shown in the first cryptographic module, and the asymmetric encryption key pair (public key PbEK2 and private key PvEK2) is shown in the second cryptographic module. Among them, the private key PvEK in the asymmetric encryption key pair of the cryptographic module is always inside the cryptographic module and cannot be read from the outside, the public key PbEK can be read from the outside, and the signature public key PbSK of the external certificate authority cannot be tampered with from the outside.

[0097] In order to enable the first cryptographic module to verify the legitimacy of the second cryptographic module, the public key PbEK2 in the second asymmetric encryption key pair of the second cryptographic module can be issued with a public key certificate PbEKCert (shown as PbEKCert2 in the figure) by an external certificate authority. The PbEKCert certificate can include the public key PbEK2 of the second cryptographic module, and the external certificate authority can use the signature private key PvSK to sign the public key certificate of the second cryptographic module, so that the first cryptographic module can confirm the authenticity and integrity of the public key certificate of the second cryptographic module, thereby verifying that it is a legitimate public key certificate.

[0098] correspond Figure 5 , Figure 6 Another interactive flow chart of the password configuration method in the embodiment of the present application is shown as an example. Figure 6 As shown, before step S33, it also includes:

[0099] Step S321: The password management device obtains the public key certificate of the second password module signed by an external certificate authority.

[0100] The public key certificate of the second cryptographic module may include the second public key in the second asymmetric encryption key pair.

[0101] Step S322: The password management device forwards the public key certificate of the second password module signed by the external certificate authority to the first password module.

[0102] Thus, the first cryptographic module can verify the legitimacy of the public key certificate of the second cryptographic module by using the signature public key obtained from the external certificate authority.

[0103] Step S323: The first cryptographic module obtains the public key certificate of the second cryptographic module signed by an external certificate authority.

[0104] Step S324: The first cryptographic module verifies the legitimacy of the public key certificate of the second cryptographic module using the signature public key obtained from the external certificate authority.

[0105] In a specific example, the first cryptographic module can use the signature public key PbSK obtained from the external certificate authority to verify the signature of the public key certificate PbEKCert2 of the second cryptographic module. If the verification is successful, it can be confirmed that the public key certificate of the second cryptographic module is authentic and complete, and the public key certificate of the second cryptographic module is legal, and then step S325 is executed.

[0106] Step S325: The first cryptographic module obtains the second public key in the second asymmetric encryption key pair, and uses the second public key to encrypt the corresponding key image to obtain the first key image.

[0107] Further, in some embodiments, based on the first key image, the first cryptographic module uses the second public key of the second cryptographic module to encrypt its corresponding key image, such as Figure 6 As shown, the second cryptographic module obtains the first key image, and the process of obtaining the key according to the first key image may specifically include:

[0108] Step S361, the second cryptographic module obtains the first key image;

[0109] Step S362: The second cryptographic module uses the second private key in the second asymmetric encryption key pair to decrypt the first key image and obtain the key image corresponding to the first cryptographic module;

[0110] Step S363: The second cryptographic module obtains the key according to the key image corresponding to the first cryptographic module.

[0111] It can be seen that in the embodiment of the present application, when the password management device configures the password module of any server to perform a key for cryptographic operations, the key image containing the key is forwarded to the password modules of different servers through the password management device, so that the keys are configured in the password modules on multiple servers, thereby realizing key synchronization of the password modules on different servers; furthermore, each server can perform cryptographic operations based on the cryptographic modules configured with the keys to obtain cryptographic services. Compared with the method in which multiple servers obtain cryptographic services by accessing a cryptographic machine through the network, the multiple servers in the embodiment of the present application can no longer rely on the network when obtaining cryptographic services, thereby effectively reducing the occupation of network bandwidth resources while improving the performance of cryptographic services.

[0112] The present application also provides a password service method based on Figure 2 The cryptographic service system architecture shown is applied to the cryptographic module 201 of the server 20. As an optional implementation, Figure 7 The following is an exemplary diagram of an optional flow chart of the password service method provided in the embodiment of the present application. Figure 7 As shown, the password service method includes the following steps:

[0113] Step S71, obtaining a cryptographic service request of a cryptographic application.

[0114] The cryptographic application is located on the same server as the cryptographic module, so that inside the server, the cryptographic application can send the cryptographic service request directly to the cryptographic module without transmitting it to the outside through the network, so that the cryptographic module obtains the cryptographic service request of the cryptographic application.

[0115] Step S72: Based on the cryptographic service request, a key is called to perform cryptographic operations to provide cryptographic services for the cryptographic application.

[0116] The key used by the password module is configured using the password configuration method described above.

[0117] It can be seen that in the cryptographic service method of the embodiment of the present application, when the cryptographic application of the server has a cryptographic service demand, it can be based on accessing the cryptographic module so that the cryptographic module uses the configured key to perform cryptographic operations, thereby achieving access to the cryptographic service without transmitting the cryptographic service request to the outside through the network, so that the cryptographic application accesses the cryptographic service no longer depends on the network, effectively reducing the occupancy of network bandwidth resources and improving the performance of the cryptographic service.

[0118] The present application also provides a password management device as an optional implementation. Figure 8 An optional block diagram of a password management device provided in an embodiment of the present application, such as Figure 8As shown, the password management device may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4.

[0119] In the embodiment of the present application, the number of the processor 1 , the communication interface 2 , the memory 3 , and the communication bus 4 is at least one, and the processor 1 , the communication interface 2 , and the memory 3 communicate with each other through the communication bus 4 .

[0120] Optionally, the communication interface 2 may be an interface of a communication module for performing network communication.

[0121] Optionally, processor 1 may be a CPU (central processing unit), a GPU (Graphics Processing Unit), an NPU (embedded neural network processor), an FPGA (Field Programmable Gate Array), a TPU (tensor processing unit), an AI chip, an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement an embodiment of the present application.

[0122] The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0123] The memory 3 stores one or more computer executable instructions, and the processor 1 calls the one or more computer executable instructions to execute the password configuration method as described above.

[0124] The present application also provides a server, which can correspond to the reference Figure 8 As shown, the server may include: at least one memory and at least one processor, the memory storing one or more computer executable instructions, the processor calling the one or more computer executable instructions to execute the password configuration method as described above, or the password service method as described above.

[0125] The present application also provides a password service system. Figure 2 As shown, the password service system may include at least a password management device and multiple servers. Each of the servers may include at least a password module and a password application (not shown in the figure), and the password management device may be used to manage the password modules of the multiple servers.

[0126] in, Fig. 9The following is an exemplary diagram of an optional structure of a password module provided in an embodiment of the present application. Fig. 9 As shown, the password module may include:

[0127] A request obtaining unit 91, used to obtain a cryptographic service request of a cryptographic application;

[0128] The cryptographic operation unit 92 is used to call a key to perform cryptographic operation according to the cryptographic service request to provide cryptographic services for the cryptographic application, and the key is obtained based on the configuration of the cryptographic management device.

[0129] In some embodiments, based on the feature that the password management device has the ability to manage password modules of multiple servers, Fig.10 An exemplary diagram of an optional structure of a password management device provided in an embodiment of the present application is shown. Fig.10 As shown, the password management device may include:

[0130] The configuration information sending unit 110 is used to send key configuration information to the first cryptographic module, where the key configuration information at least includes a key for the first cryptographic module to perform a cryptographic service, and the first cryptographic module is any cryptographic module of any server;

[0131] An image acquisition unit 120 is used to acquire a first key image of the first cryptographic module, where the first key image includes the key;

[0132] The image forwarding unit 130 is used to forward the first key image to the second cryptographic module so that the second cryptographic module obtains the key and uses the key to perform cryptographic operations when the second cryptographic module is called by the corresponding server. The second cryptographic module is another cryptographic module configured on a different server.

[0133] Optionally, the password modules of the multiple servers managed by the password management device may include a shared key;

[0134] The first key image of the first cryptographic module obtained by the image obtaining unit 120 may be obtained by: the first cryptographic module encrypts the corresponding key image using the shared key;

[0135] The image forwarding unit 130 forwards the first key image to the second cryptographic module so that the second cryptographic module obtains the key. Specifically, the first key image is forwarded to the second cryptographic module so that the second cryptographic module decrypts the first key image using the shared key, obtains the key image corresponding to the first cryptographic module, and obtains the key according to the key image corresponding to the first cryptographic module.

[0136] Optionally, the cryptographic modules of the multiple servers managed by the cryptographic management device may include an asymmetric encryption key pair and a signature public key obtained from an external certificate authority, and the first asymmetric encryption key pair of the first cryptographic module is different from the second asymmetric encryption key pair of the second cryptographic module;

[0137] Before the image acquisition unit 120 acquires the first key image of the first cryptographic module, the following steps may also be included:

[0138] Obtaining a public key certificate of the second cryptographic module signed by an external certificate authority, wherein the public key certificate of the second cryptographic module includes the second public key in the second asymmetric encryption key pair;

[0139] The public key certificate of the second cryptographic module signed by the external certificate authority is forwarded to the first cryptographic module, so that the first cryptographic module verifies the legitimacy of the public key certificate of the second cryptographic module using the signature public key obtained from the external certificate authority.

[0140] In some embodiments, based on the characteristic that the password module is managed by a password management device, the password module of the embodiment of the present application may also include: a first password module and a second password module; the first password module can be any password module of any server, and the second password module is different from the first password module and is another password module configured on a different server.

[0141] The first cryptographic module is configured to obtain key configuration information sent by the password management device, wherein the key configuration information at least includes a key for performing a cryptographic service; and send a first key image to the password management device, so that the password management device forwards the first key image to the second cryptographic module, wherein the first key image includes the key;

[0142] The second cryptographic module is used to obtain the first key image, and obtain the key according to the first key image, so as to perform cryptographic operations using the key when called by the corresponding server.

[0143] Optionally, the cryptographic module may include a shared key;

[0144] The first key image sent by the first cryptographic module to the password management device may be obtained by: encrypting the corresponding key image by the first cryptographic module using the shared key;

[0145] The second cryptographic module obtaining the key according to the first key image may include:

[0146] The second cryptographic module decrypts the first key image using the shared key to obtain the key image corresponding to the first cryptographic module;

[0147] The second cryptographic module obtains the key according to the key image corresponding to the first cryptographic module.

[0148] Optionally, the cryptographic module may include an asymmetric encryption key pair and a signature public key obtained from an external certificate authority, and the first asymmetric encryption key pair of the first cryptographic module is different from the second asymmetric encryption key pair of the second cryptographic module;

[0149] Before the first password module sends the first key image to the password management device, the method may further include:

[0150] The first cryptographic module obtains the public key certificate of the second cryptographic module signed by an external certificate authority and sent by the password management device, wherein the public key certificate of the second cryptographic module includes the second public key in the second asymmetric encryption key pair;

[0151] The first cryptographic module verifies the legitimacy of the public key certificate of the second cryptographic module using the signature public key obtained from an external certificate authority;

[0152] If it is legal, the first cryptographic module obtains the second public key in the second asymmetric encryption key pair, and uses the second public key to encrypt the corresponding key image to obtain the first key image.

[0153] Optionally, the step of the second cryptographic module acquiring the first key image, and acquiring the key according to the first key image may include:

[0154] The second cryptographic module obtains the first key image;

[0155] The second cryptographic module uses the second private key in the second asymmetric encryption key pair to decrypt the first key image to obtain the key image corresponding to the first cryptographic module;

[0156] The second cryptographic module obtains the key according to the key image corresponding to the first cryptographic module.

[0157] In some embodiments, the cryptographic module may be configured with a signature public key, and the signature public key may be configured based on a key file of an external certificate authority.

[0158] An embodiment of the present application also provides a storage medium, which stores one or more computer-executable instructions. When the one or more computer-executable instructions are executed, a password configuration method executed by a password management device in an embodiment of the present application, or a password configuration method executed by a password module of a server, or a password service method executed by a password module of a server is implemented.

[0159] The above describes multiple implementation schemes provided by the embodiments of the present application. The various optional methods introduced in each implementation scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible implementation schemes, which can all be considered as implementation schemes disclosed and open in the embodiments of the present application.

[0160] Although the embodiments of the present application are disclosed above, the present application is not limited thereto. Any person skilled in the art may make various changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be subject to the scope defined by the claims.

Claims

1. A password configuration method, characterized in that: Applied to a password management device, the password management device is used to manage password modules of multiple servers, the password module is a module with a password operation function, stores a key corresponding to a password application on the server executing a password service, and when the password application on the server calls the password module based on a provided dedicated interface, the stored key is used to perform a password operation, the method includes: Sending key configuration information to the first cryptographic module, where the key configuration information is information for configuring a key corresponding to the cryptographic module, and at least includes a key for the first cryptographic module to perform a cryptographic service, and the first cryptographic module is any cryptographic module of any server; Obtaining a first key image of the first cryptographic module, where the first key image is obtained by updating the corresponding key image of the first cryptographic module based on the key configuration information, and the first key image includes the key, wherein the key image of the cryptographic module is a copy of the key required for the cryptographic module to perform cryptographic operations, and includes the image form of all keys stored in the cryptographic module; The first key image is forwarded to a second cryptographic module so that the second cryptographic module obtains the key and uses the key to perform cryptographic operations when the second cryptographic module is called by a corresponding server. The second cryptographic module is another cryptographic module configured on a different server.

2. The password configuration method according to claim 1, characterized in that: The password modules of the multiple servers managed by the password management device include a shared key; Acquiring a first key image of the first cryptographic module, specifically: the first cryptographic module encrypts the corresponding key image using the shared key; The forwarding of the first key image to the second cryptographic module so that the second cryptographic module obtains the key is specifically: forwarding the first key image to the second cryptographic module so that the second cryptographic module decrypts the first key image using a shared key to obtain the key image corresponding to the first cryptographic module, and obtaining the key according to the key image corresponding to the first cryptographic module.

3. The password configuration method according to claim 1, characterized in that: The cryptographic modules of the multiple servers managed by the cryptographic management device include an asymmetric encryption key pair and a signature public key obtained from an external certificate authority, and the first asymmetric encryption key pair of the first cryptographic module is different from the second asymmetric encryption key pair of the second cryptographic module; Before obtaining the first key image of the first cryptographic module, the method further includes: Obtaining a public key certificate of the second cryptographic module signed by an external certificate authority, wherein the public key certificate of the second cryptographic module includes the second public key in the second asymmetric encryption key pair; The public key certificate of the second cryptographic module signed by the external certificate authority is forwarded to the first cryptographic module, so that the first cryptographic module verifies the legitimacy of the public key certificate of the second cryptographic module using the signature public key obtained from the external certificate authority.

4. A password configuration method, characterized in that: A cryptographic module applied to a server, the cryptographic module is a module with a cryptographic operation function, stores a key corresponding to a cryptographic application on the server executing a cryptographic service, and uses the stored key to perform cryptographic operations when the cryptographic application on the server calls the cryptographic module based on a provided dedicated interface. The cryptographic module includes a first cryptographic module and a second cryptographic module. The first cryptographic module is any cryptographic module of any server, and the second cryptographic module is another cryptographic module configured on a different server. The method includes: The first cryptographic module obtains key configuration information sent by the cryptographic management device, where the key configuration information is information for configuring a key corresponding to the cryptographic module, and at least includes a key for executing a cryptographic service; The first cryptographic module sends a first key image to the password management device, so that the password management device forwards the first key image to the second cryptographic module, wherein the first key image is obtained by the first cryptographic module updating its corresponding key image based on the key configuration information, and the first key image includes the key, wherein the key image of the cryptographic module is a copy of the key required by the cryptographic module to perform cryptographic operations, and includes the image form of all keys stored in the cryptographic module; The second cryptographic module obtains the first key image, and obtains the key according to the first key image, so as to perform cryptographic operations using the key when being called by the corresponding server.

5. The password configuration method according to claim 4, characterized in that: The cryptographic module includes a shared key; The first key image sent by the first cryptographic module to the password management device is specifically obtained by encrypting the corresponding key image by the first cryptographic module using the shared key; The second cryptographic module obtains the key according to the first key image, including: The second cryptographic module decrypts the first key image using the shared key to obtain the key image corresponding to the first cryptographic module; The second cryptographic module obtains the key according to the key image corresponding to the first cryptographic module.

6. The password configuration method according to claim 4, characterized in that: The cryptographic module includes an asymmetric encryption key pair and a signature public key obtained from an external certificate authority, and a first asymmetric encryption key pair of the first cryptographic module is different from a second asymmetric encryption key pair of the second cryptographic module; Before the first password module sends the first key image to the password management device, the method further includes: The first cryptographic module obtains the public key certificate of the second cryptographic module sent by the cryptographic management device and signed by an external certificate authority, wherein the public key certificate of the second cryptographic module includes the second public key in the second asymmetric encryption key pair; The first cryptographic module verifies the legitimacy of the public key certificate of the second cryptographic module using the signature public key obtained from an external certificate authority; If it is legal, the first cryptographic module obtains the second public key in the second asymmetric encryption key pair, and uses the second public key to encrypt the corresponding key image to obtain the first key image.

7. The password configuration method according to claim 6, characterized in that: The second cryptographic module obtains the first key image, and obtains the key according to the first key image, including: The second cryptographic module obtains the first key image; The second cryptographic module uses the second private key in the second asymmetric encryption key pair to decrypt the first key image to obtain the key image corresponding to the first cryptographic module; The second cryptographic module obtains the key according to the key image corresponding to the first cryptographic module.

8. A cryptographic service method, characterized in that: The cryptographic modules used for the server include: Obtaining a cryptographic service request of a cryptographic application, wherein the cryptographic application and the cryptographic module are located on the same server; According to the cryptographic service request, a key is called to perform a cryptographic operation to provide cryptographic services for the cryptographic application, and the key is configured using the cryptographic configuration method as described in any one of claims 1-3 and / or claims 4-7.

9. A password management device, characterized in that: The system comprises at least one memory and at least one processor, wherein the memory stores one or more computer executable instructions, and the processor calls the one or more computer executable instructions to execute the password configuration method according to any one of claims 1 to 3.

10. A server, characterized in that: It includes at least one memory and at least one processor, the memory stores one or more computer-executable instructions, and the processor calls the one or more computer-executable instructions to execute the password configuration method as described in any one of claims 4 to 7, or the password service method as described in claim 8.

11. A cryptographic service system, characterized in that: At least includes a password management device and multiple servers, each of the servers includes at least a password module and a password application, the password management device is used to manage the password modules of the multiple servers, the password module is a module with a password operation function, stores a key corresponding to the password service executed by the password application on the server, and uses the stored key to perform a password operation when the password application on the server calls the password module based on a provided dedicated interface; Wherein, the password module includes: A request acquisition unit, used to acquire a cryptographic service request of a cryptographic application; A cryptographic operation unit, configured to call a key to perform cryptographic operation according to the cryptographic service request, so as to provide cryptographic service to the cryptographic application, wherein the key is obtained based on the configuration of the cryptographic management device; The password management device comprises: a configuration information sending unit, configured to send key configuration information to a first cryptographic module, wherein the key configuration information is information for configuring a key corresponding to the cryptographic module, and at least includes a key for the first cryptographic module to perform a cryptographic service, and the first cryptographic module is any cryptographic module of any server; an image acquisition unit, configured to acquire a first key image of the first cryptographic module, wherein the first key image is obtained by the first cryptographic module updating its corresponding key image based on the key configuration information, and the first key image includes the key, wherein the key image of the cryptographic module is a copy of the key required by the cryptographic module to perform cryptographic operations, and includes the image form of all keys stored in the cryptographic module; The image forwarding unit is used to forward the first key image to the second cryptographic module so that the second cryptographic module obtains the key and uses the key to perform cryptographic operations when the second cryptographic module is called by the corresponding server. The second cryptographic module is another cryptographic module configured on a different server.

12. The cryptographic service system according to claim 11, characterized in that: The password module includes: a first password module and a second password module; The first cryptographic module is configured to obtain key configuration information sent by the password management device, wherein the key configuration information is information for configuring a key corresponding to the cryptographic module, and at least includes a key for executing a cryptographic service; and send a first key image to the password management device, so that the password management device forwards the first key image to the second cryptographic module, wherein the first key image is obtained by the first cryptographic module updating its corresponding key image based on the key configuration information, and the first key image includes the key; The second cryptographic module is used to obtain the first key image, and obtain the key according to the first key image, so as to use the key to perform cryptographic operations when called by the corresponding server.

13. The cryptographic service system according to claim 12, characterized in that: The cryptographic module is configured with a signature public key, and the signature public key is configured based on a key file of an external certificate authority.

14. A storage medium, characterized in that: The storage medium stores one or more computer-executable instructions, which, when executed, implement the password configuration method as described in any one of claims 1-3, or the password configuration method as described in any one of claims 4-7, or the password service method as described in claim 8.

Images