PCI-E interface password card design method and PCI-E interface password card

Abstract

The present invention provides a PCI-E interface password card design method and a PCI-E interface password card, wherein the PCI-E interface password card comprises an encryption control chip, a security chip, a physical noise source chip, and an intelligent password key, wherein the encryption control chip is electrically connected to the security chip, the physical noise source chip, and the intelligent password key respectively, and the method comprises: obtaining a random number through the physical noise source chip; performing high-performance cryptographic operations, device management, key data management, key storage, and access control through the encryption control chip based on the random number obtained by the physical noise source chip; performing encrypted storage and authority management of key data through the security chip; and realizing operator and administrator identity authentication and key data backup through the intelligent password key. The present invention can further improve the security of the key, improve the communication rate, and meet the high-speed encryption requirements of devices such as cloud cryptographic machines.

Description

Technical Field

[0001] The present invention relates to the technical field of password cards, and in particular to a PCI-E interface password card design method and a PCI-E interface password card. Background Art

[0002] The PCI-E interface cryptographic card has a standard PCI-E interface and has functions such as cryptographic operations, key management, random number generation and verification, access control, and file storage management. It has been applied to high-end hardware products such as SSL VPN gateways, SVS signature verification servers, timestamp servers, and server cryptographic machines.

[0003] However, the commonly used PCI-E cryptographic card interface has a low communication rate and insufficient cryptographic computing power, which cannot meet the high-speed encryption requirements of devices such as cloud cryptographic machines. Summary of the invention

[0004] The present invention provides a PCI-E interface password card design method and a PCI-E interface password card, which are used to solve the defects in the prior art that the PCI-E interface communication rate is low, the password operation capability is insufficient, and the high-speed encryption requirements of devices such as cloud cryptographic machines cannot be met, the number of channels of the PCI-E interface password card is expanded, and the communication rate and the password operation capability are improved.

[0005] The present invention provides a method for designing a PCI-E interface password card, wherein the PCI-E interface password card comprises an encryption control chip, a security chip, a physical noise source chip, and an intelligent password key, wherein the encryption control chip is electrically connected to the security chip, the physical noise source chip, and the intelligent password key, respectively, and the method comprises:

[0006] Obtaining random numbers through the physical noise source chip;

[0007] Based on the random number obtained by the physical noise source chip, high-performance cryptographic operations, device management, key data management, key storage and access control are performed through the encryption control chip;

[0008] Encrypted storage and permission management of key data are performed through the security chip;

[0009] Operator and administrator identity authentication and key data backup are achieved through the intelligent password key.

[0010] According to the PCI-E interface password card design method provided by the present invention, the key data management includes:

[0011] The encryption control chip encrypts and manages key data through a three-level key structure, wherein the three-level key includes a first-level key, a second-level key, and a third-level key, wherein the first-level key is a protection key, and the second-level key includes a user key, a key encryption key, a backup key, a communication protection key encryption key, a communication protection key, a firmware protection key, a temporary key, a device key, and a device external authentication key, and the third-level key is a session key.

[0012] According to the PCI-E interface password card design method provided by the present invention, in the three-level key structure, the first-level key encrypts and protects the second-level key, and when the second-level key is stored inside the password card, it is encrypted and stored using the first-level key.

[0013] According to the PCI-E interface password card design method provided by the present invention, the role-based key access control includes: performing permission management inside the security chip, and synchronizing the permission status through the encrypted channel between the encryption control chip and the security chip to achieve collaborative access control between the encryption control chip and the security chip.

[0014] The present invention also provides a PCI-E interface password card obtained by the PCI-E interface password card design method, comprising:

[0015] Encryption control chip, used to achieve high-performance cryptographic operations based on random numbers obtained by physical noise source chips, and implement device management, key data management, key storage and access control functions;

[0016] Security chip, used for encrypted storage and permission management of key data processed by the encryption control chip;

[0017] Physical noise source chip, used to obtain random numbers;

[0018] Intelligent password key, used to realize operator and administrator identity authentication and back up the key data processed by the encryption control chip.

[0019] According to the PCI-E interface password card provided by the present invention, the physical noise source chip specifically includes: a first physical noise source chip and a second physical noise source chip, and the first physical noise source chip and the second physical noise source chip are electrically connected to the encryption control chip respectively.

[0020] The PCI-E interface password card provided according to the present invention also includes a power control chip, which is electrically connected to the encryption control chip and is used to convert the PCI-E interface voltage and supply power to other modules of the password card.

[0021] According to the PCI-E interface password card provided by the present invention, the physical noise source chip uses two RSP physical noise source chips T10 to realize two-way random sources that back up each other.

[0022] According to the PCI-E interface password card provided by the present invention, the PCI-E interface password card is connected to a PC via a PCI-EX16 interface.

[0023] The PCI-E interface password card provided according to the present invention further includes a key destruction module, which is electrically connected to the encryption control chip and the security chip respectively through a key destruction interface and is used for key destruction and key initialization operations.

[0024] According to the PCI-E interface password card provided by the present invention, the key destruction and key initialization operations include:

[0025] When the power is on, if a button is pressed, the encryption control chip starts the self-destruction program, destroys the temporary key inside the secondary key inside the password card, the user key, the password encryption key, the session key, the device external authentication key and the private key access control code hash value, and the device returns to the initial state.

[0026] According to the PCI-E interface password card provided by the present invention, a temperature sensor is electrically connected to the encryption control chip, and the temperature sensor is used to monitor the temperature of the encryption control chip;

[0027] The encryption control chip is electrically connected to the indicator light through an I / O interface, and the indicator light includes a first status indicator light, a second status indicator light and a smart password key access indicator light, wherein the first status indicator light is used to indicate whether the power supply is normal after the password card is powered on, the second status indicator light is used to indicate whether the power-on self-test of the password card has passed, and the smart password key access indicator light is used to indicate whether the smart password key is accessed to the password card.

[0028] According to the PCI-E interface password card provided by the present invention, the encryption control chip adopts the RSP-S20 chip, the security chip adopts the Z32HUA chip, and the smart password key adopts the Utap smart password key.

[0029] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the PCI-E interface password card design method as described in any one of the above items are implemented.

[0030] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the PCI-E interface password card design method as described in any one of the above items are implemented.

[0031] The PCI-E interface password card design method and the PCI-E interface password card provided by the present invention expand the number of channels of the PCI-E interface password card and improve the communication rate by setting an encryption control chip and a security chip in the PCI-E interface password card. At the same time, data is encrypted and stored through the security chip, which can further improve the security of the key, meet the high-speed encryption requirements of devices such as cloud cryptographic machines, and have stronger applicability and wider usage scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 It is a structural block diagram of a PCI-E interface password card provided by an embodiment of the present invention;

[0034] Figure 2 This is the overall architecture of the PCI-E interface password card provided by the present invention;

[0035] Figure 3 This is a flowchart of the power-on self-test of the password card provided by the embodiment of the present invention;

[0036] Figure 4 It is the PCB layout of the PCI-E interface password card provided by the present invention;

[0037] Figure 5 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] The PCI-E interface cryptographic card has a standard PCI-E interface and has functions such as cryptographic operations, key management, random number generation and verification, access control, and file storage management. It has been applied to high-end hardware products such as SSL VPN gateways, SVS signature verification servers, timestamp servers, and server cryptographic machines.

[0040] Most of the password cards on the market use FPGA general-purpose chips as the management core and external password algorithm chips as the computing unit. There are many types of chips used, the technical implementation is complex, and the manufacturing cost is high. To address this problem, some high-end password cards use PCI-E X8 / X4 interface as the interactive interface between the password card and the host computer.

[0041] However, the above-mentioned cryptographic cards have fewer PCI-E interface channels, lower interface communication rates, and insufficient cryptographic computing capabilities, and cannot meet the high-speed encryption requirements of devices such as cloud cryptographic machines.

[0042] To solve the above problems, the present invention proposes a PCI-E interface password card design method and a PCI-E interface password card. Figure 1 : is a structural block diagram of a PCI-E interface password card provided by an embodiment of the present invention, such as Figure 1 As shown, the PCI-E interface password card includes an encryption control chip, a security chip, a physical noise source chip, and an intelligent password key. The encryption control chip is electrically connected to the security chip, the physical noise source chip, and the intelligent password key respectively. The method includes:

[0043] Obtaining random numbers through the physical noise source chip;

[0044] Based on the random number obtained by the physical noise source chip, high-performance cryptographic operations, device management, key data management, key storage and access control are performed through the encryption control chip;

[0045] Encrypted storage and permission management of key data are performed through the security chip;

[0046] Operator and administrator identity authentication and key data backup are achieved through the intelligent password key.

[0047] Optionally, the key data management includes:

[0048] The encryption control chip encrypts and manages key data through a three-level key structure, wherein the three-level key includes a first-level key, a second-level key, and a third-level key, wherein the first-level key is a protection key, and the second-level key includes a user key, a key encryption key, a backup key, a communication protection key encryption key, a communication protection key, a firmware protection key, a temporary key, a device key, and a device external authentication key, and the third-level key is a session key.

[0049] Optionally, in the three-level key structure, the first-level key encrypts and protects the second-level key, and when the second-level key is stored inside the password card, it is encrypted and stored using the first-level key.

[0050] Optionally, the role-based key access control includes: performing permission management inside the security chip, and synchronizing permission status through an encrypted channel between the encryption control chip and the security chip to achieve collaborative access control between the encryption control chip and the security chip.

[0051] Optionally, the encryption control chip adopts an RSP-S20 chip, the security chip adopts a Z32HUA chip, the smart password key adopts an Utap smart password key, and the physical noise source chip uses two RSP physical noise source chips T10 to realize two random sources that backup each other.

[0052] Figure 2 The overall architecture of the PCI-E interface password card provided by the present invention is as follows: Figure 2 As shown, in the embodiment of the present invention, the password card hardware includes the following five parts:

[0053] RSP-S20 chip: It is the core chip of PCI-E cryptographic card, which realizes PCI-E communication upward and connects various hardware functional modules downward. It mainly obtains random numbers through T10, realizes SM1, SM2, SM3, SM4 and RSA high-performance cryptographic operations, device management, key management, key storage and access control, etc.

[0054] Physical noise source chip: Use two RSP physical noise source chips T10 to realize two-way random sources that backup each other;

[0055] Security chip: Use Z32HUA security chip to implement key negotiation and other functions;

[0056] Smart password key: Use Utap smart password key of Beijing Zhongjin Guoxin Technology Co., Ltd. to realize the identity and key backup of operators and administrators (password supervisors);

[0057] Power management: Convert the PCI-E interface voltage to provide power for each hardware module.

[0058] Specifically, the PCI-E interface password card provided in the embodiment of the present invention is connected to the PC through the PCI-E X16 interface, is implemented by the PCI-E interface module of the RSP-S20 chip, and complies with the PCI Express Base Specification v2.0.

[0059] Optionally, in an embodiment of the present invention, the PCI-E password card provides the user with two operating status indicator lights and one smart password key access indicator light, and the two operating status indicator lights are a power indicator light and a power-on self-test indicator light.

[0060] Specifically, after the PCI-E password card is powered on, if the power supply is normal, the power indicator light (red light) will be on; if the power-on self-test is completed and passed, the power-on self-test indicator light (green light) will be on; when the smart password key is connected to the PCI-E password card, the smart password key access indicator light will be green, otherwise, if the smart password key is not connected, the access indicator light will be yellow.

[0061] Optionally, the PCI-E cryptographic card provided in the embodiment of the present invention realizes the emergency destruction function by means of a button.

[0062] Specifically, when powered on, if a button is detected, the RSP-S20 chip starts the self-destruction program, destroying the temporary key, user key, key encryption key, session key, device external authentication key and private key access control code hash value inside the password card, and the device returns to its initial state.

[0063] In this embodiment, the smart password key interface complies with the USB Mass storage protocol.

[0064] It is understandable that the main function of the PCI-E cryptographic card is the high-performance operation of the cryptographic algorithm, which is completed by the encryption control chip high-speed algorithm engine module and the key cache and algorithm operation module.

[0065] For example, Table 1 shows the types and uses of the PCI-E cryptographic card keys provided by the present invention.

[0066] Table 1

[0067]

[0068] As shown in Table 1, in a specific embodiment, the basic operation functions of the national secret algorithm provided by the RSP-S20 chip include: SM2 algorithm signature, signature verification, kP, kG, encryption, decryption, SM3 algorithm operation, SM4 algorithm (ECB, CBC, OFB, CFB and CTR mode). When in use, the key data is mainly obtained through the key cache and algorithm operation module, and the corresponding cryptographic operation function is set using the high-speed algorithm engine to complete the calculation. The SM2, SM3, and SM4 algorithm application functions provided to the upper layer include key management and access control.

[0069] Specifically, the PCI-E password card supports a three-level key structure, the first level is the protection key; the second level is the user key, key encryption key, backup key, communication protection key encryption key, communication protection key, firmware protection key, temporary key, device key and device external authentication key; the third level is the session key. In the three-level key structure, the protection key encrypts and protects the second-level key. That is, when the key is stored inside the password card, it is encrypted with the protection key before being stored.

[0070] In this embodiment, for access control, the PCI-E cryptographic card uses a role-based access control policy.

[0071] Specifically, the operator logs in using the smart password key, performs permission management inside the password card security chip, and synchronizes permission status through the encrypted channel between the password card RSP-S20 chip and the security chip to achieve collaborative access control between the password card RSP-S20 and the security chip.

[0072] In detail, in the development and manufacturing stage of the password card, it mainly involves hardware design, software development and program download. In the initial application stage of the password card, the first step is to generate a protection key, which is controlled by the RSP-S20 chip and sets the life cycle, and prohibits operations outside this life cycle; the second step is to install the device information, which is also controlled by the RSP-S20 chip and sets the life cycle, and prohibits operations outside this life cycle; the third step is to set the initial PIN code for the smart password key; the fourth step is to generate or install a backup key, which also needs to be controlled by the RSP-S20 chip and set the life cycle, and prohibit operations outside this life cycle. In the use stage of the password card, all operations except the first three steps are completed in this stage, which also needs to be controlled by the RSP-S20 chip and set the life cycle, and prohibit operations outside this life cycle. In the abolition stage of the password card, all users in the password card are logged out, and the registered administrator (password supervisor) and operator smart password keys are all locked to achieve safe destruction, and the password card will not be usable afterwards.

[0073] In terms of permission management, the PCI-E password card includes:

[0074] No permission. After the PCI-E password card hardware power-on self-test succeeds, it enters the no permission state.

[0075] User (operator) authority, after successfully logging into the PCI-E password card using the operator smart password key, enters the operator authority state.

[0076] Administrator (password supervisor) authority: After successfully logging into the PCI-E password card using the administrator (password supervisor) smart password key, you will enter the administrator (password supervisor) authority state.

[0077] Super administrator privileges: After successfully logging in more than half of the administrators' (password supervisors') smart password keys, you will enter the super administrator privilege state. You can register up to 3 administrators (password supervisors). If the number of registered administrators' (password supervisors') smart password keys is less than 3, key backup and recovery cannot be performed.

[0078] Based on the above permission management status, a permission status conversion mechanism is set.

[0079] Specifically, according to the power-on status of the PCI-E password card and the login status of the operator and administrator (password supervisor) smart password keys, the RSP-S20 chip implements the conversion of the global permission status, and transmits the unauthorized status, operator permission status and private key access control code verification status to the key cache module of the security chip in a secure manner.

[0080] Optionally, the PCI-E interface password card provided in the embodiment of the present invention further includes a self-check module, and the self-check module specifically includes:

[0081] Equipment self-test module: The PCI-E cryptographic card equipment self-test module mainly completes the power-on self-test and usage self-test functions, and cooperates with the PC software to complete the equipment factory inspection and periodic inspection. The main detection functions of the equipment self-test module include: hardware module interface detection, hardware abnormality self-test, physical noise source chip detection, random number detection, cryptographic algorithm correctness detection, firmware and data integrity detection.

[0082] Self-check of algorithm operation function: The self-check module will perform self-check on the algorithm operation function when the device leaves the factory, is powered on, generates a key pair, and the PC calls the self-check API interface. When the device leaves the factory, is powered on, and the PC calls the self-check API interface, the algorithm operation function is fully checked, and the correctness of the key pair is tested when the key pair is generated.

[0083] Specifically, the password card RSP-S20 chip implements SM2 key pair consistency self-test, SM2 algorithm signature verification self-test, SM2 algorithm encryption and decryption self-test, SM3 algorithm self-test, SM4 ECB mode algorithm self-test, SM4 CBC mode algorithm self-test, SM4 MAC mode algorithm self-test, SM4 OFB mode algorithm self-test, SM4 CFB mode algorithm self-test, and SM4 CTR mode algorithm self-test by giving preset data; the password card Z32HUA security chip implements SM1 ECB mode algorithm self-test, SM1 CBC mode algorithm self-test, SM1 OFB mode algorithm self-test, SM1 CFB mode algorithm self-test, SM1 MAC mode algorithm self-test, RSA2048 key pair consistency self-test, RSA2048 signature verification algorithm self-test, and RSA2048 encryption and decryption algorithm self-test.

[0084] Furthermore, during the algorithm operation function self-test, only if SM1, SM2, SM3, SM4 and RSA2048 all pass the self-test, the password card is considered to have passed the algorithm operation self-test. If any algorithm is inconsistent with the expected result during the self-test, it is considered that the algorithm operation function self-test has failed, and the password card algorithm operation function self-test has failed. When the algorithm operation function self-test fails, the password card can only provide the functions of querying hardware fault codes and obtaining device information.

[0085] Firmware integrity self-check: The PCI-E password card firmware is divided into the embedded COS firmware inside the RSP-S20 chip and the Z32HUA security chip. Before leaving the factory, they are burned into the FLASH inside the RSP-S20 chip and the Z32HUA security chip respectively. During use, the internal firmware of the PCI-E password card cannot be erased or modified, and the embedded firmware only runs inside the RSP-S20 chip and the security chip.

[0086] Specifically, firmware integrity is achieved by using a firmware protection key, which is generated by a production smart password key (SJK1977 smart password key).

[0087] Before the PCI-E password card leaves the factory, after the password card RSP-S20 chip and Z32HUA security chip download the COS firmware, the production tool software first obtains the hash value of the COS firmware, and then calls the "SM2 Signature" application interface of the production-specific smart password key to sign the firmware hash value using the production key. Finally, the signature result and the production key public key are imported into the RSP-S20 chip and Z32HUA security chip respectively and saved in the internal storage area.

[0088] Each time the device is powered on, it determines whether a firmware integrity self-check is needed based on the life cycle status. If the life cycle is a state after the manufacturing stage, the device will perform a firmware integrity self-check.

[0089] After the factory device is powered on, the embedded COS firmware in the RSP-S20 chip and the Z32HUA security chip will read the code area and calculate the hash value, then read the signature result and production key public key of the production device, and finally verify the signature. If the signature verification passes, the integrity check of the firmware passes, otherwise the integrity check of the firmware fails and the device enters an error state.

[0090] The PCI-E cryptographic card RSP-S20 chip and Z32HUA security chip firmware do not provide an interface for exporting or modifying production key data and internal firmware. The device mainly combines the security protection functions of the RSP-S20 chip and Z32HUA security chip and the security control measures of the embedded COS firmware to ensure the integrity and confidentiality of the firmware and sensitive security parameters stored internally, making it difficult to be illegally stolen and tampered with.

[0091] Static storage data integrity self-check: Z32HUA chip data integrity self-check is performed when the device is powered on. The key data and sensitive data stored in the PCI-E password card are saved with the SM3 result of the data. SM3 is recalculated after decrypting the key data and sensitive data, and then the calculated result is compared with the stored original value to determine the integrity of the data.

[0092] Hardware module interface self-test: The self-test module confirms that each hardware module interface can communicate normally through test instructions. The test instructions mainly include the test instructions between RSP-S20 and the security chip, the test instructions between RSP-S20 and the smart password key adapter, etc.

[0093] When the password card leaves the factory, is powered on, and the PC calls the self-check API interface, the algorithm operation function is checked, and when the key pair is generated, the correctness of the key pair is checked to achieve self-check of the algorithm operation function;

[0094] Verify the embedded COS firmware in the encryption control chip and security chip to achieve firmware integrity self-check;

[0095] The integrity of the statically stored data can be self-checked by performing decryption calculations on the key data and sensitive data stored inside the password card and comparing them with the original stored values ​​to determine the integrity of the data.

[0096] Figure 3 : is a flowchart of the power-on self-test of the password card provided by the embodiment of the present invention, such as Figure 3 As shown, the power-on self-test mainly performs: hardware interface self-test, physical noise source chip self-test, random number self-test, algorithm self-test, security chip firmware integrity self-test, RSP-S20 firmware and key integrity self-test. After all the power-on self-tests pass, the RSP-S20 chip controls the lighting of the password card working status light. If a self-test fails, the working status light will not light up, and the fault status bit will be set. Only some functions of querying hardware fault codes and obtaining device information are executed, and other functions such as password operations are prohibited. The detailed process of the password card power-on self-test is as follows:

[0097] Step 301: Hardware interface self-check:

[0098] In this step, the hardware interface self-test mainly detects the SPI communication interface between the password card RSP-S20 and the security chip, the RSP-S20 PCI-E communication interface, and the SPI communication interface between the RSP-S20 and the smart password key controller;

[0099] Step 302: Physical noise source chip self-test:

[0100] In this step, the password card RSP-S20 obtains random numbers through a single physical noise source chip, and performs randomness detection on the random numbers, and determines whether the physical noise source chip is in normal working condition based on the detection results. In serial mode, two physical noise source chips are self-tested separately. If any physical noise source chip fails the self-test, the power-on self-test of the physical noise source chip fails;

[0101] Step 303: Random number self-check:

[0102] In this step, the password card RSP-S20 performs XOR calculation on the random numbers generated by the two physical noise source chips, and performs a random number self-test on the XOR calculation results;

[0103] Step 304: Algorithm self-check:

[0104] In this step, the algorithm self-test is completed by Z32HUA, and the algorithm operation function is self-tested according to the algorithm self-test process in this article. If any algorithm fails the self-test, the algorithm power-on self-test fails;

[0105] Step 305: Security chip firmware integrity self-check:

[0106] In this step, the cryptographic card security chip implements a firmware integrity self-check;

[0107] Step 306, RSP-S20 firmware and key integrity self-check:

[0108] In this step, the RSP-S20 chip of the password card implements firmware integrity self-check and key integrity self-check;

[0109] Step 307: The password card RSP-S20 establishes an encrypted channel for data transmission with the security chip.

[0110] Optionally, the PCI-E interface cryptographic card provided by the embodiment of the present invention further includes a key management module.

[0111] Specifically, the Z32HUA chip defines a key storage structure internally to securely store keys. The Z32HUA chip uses a protection key to encrypt and store key data. The key data format is the same as the SM2 key pair and symmetric key data structure defined in the relevant standards of the National Cryptography Administration.

[0112] In a specific embodiment, data transmission between the PCI-E cryptographic card RSP-S20 chip and the security chip is implemented using the internal SPI interface of the cryptographic card. The RSP-S20 and the security chip encrypt the key through a communication protection key, and the communication protection key between the RSP-S20 and the security chip is shared in a digital envelope to ensure the security of data transmission between the RSP-S20 and the security chip.

[0113] Specifically, before the password card leaves the factory, it is necessary to use the device initialization tool to generate a communication protection key encryption key and encrypt and store it in the RSP-S20 chip. When the password card is used, the security chip generates a set of random numbers as the communication protection key between the security chip and the RSP-S20. The security chip reads the public key of the communication protection key encryption key from the RSP-S20 and uses a digital envelope mechanism to share the communication protection key. Except for the hardware interface detection instructions, all data transmitted between the RSP-S20 and the security chip are encrypted using the communication protection key.

[0114] In this embodiment, the authority management and access control functions are mainly completed by the authority management control module of RSP-S20 and some authority control modules of the security chip. RSP-S20 synchronizes the current authority status to the security chip through the RSP-S20 and security chip encryption channel inside the password card.

[0115] Specifically, the user authority management control module of RSP-S20 mainly combines life cycle management, uses smart password keys for registration and login, and divides and controls the functions of each authority to realize the authority management control function. The partial authority control module of the security chip realizes the key usage authority control function according to the authority status synchronized to the security chip by the security chip and the RSP-S20 data security transmission channel of the security chip.

[0116] Figure 4 It is the PCB layout of the PCI-E interface password card provided by the present invention, such as Figure 4 As shown, the present invention designs a PCI-E interface password card based on the RSP_S20 chip. The number of PCI-E interface channels of the password card is X16, and the maximum transmission rate of each channel is 4Gb / s, which solves the problems of few channels and low communication rate of existing PCI-E interface password cards, meets the high-speed encryption requirements of devices such as cloud cryptographic machines, and has stronger applicability and wider usage scenarios.

[0117] Figure 5 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 5As shown, the electronic device 500 may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the PCI-E interface password card design method, which includes: obtaining random numbers through the physical noise source chip; based on the random numbers obtained by the physical noise source chip, performing high-performance cryptographic operations, device management, key data management, key storage and access control through the encryption control chip; encrypting and storing key data and managing permissions through the security chip; and realizing operator and administrator identity authentication and key data backup through the smart password key.

[0118] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0119] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute a PCI-E interface password card design method, which includes: obtaining a random number through the physical noise source chip; based on the random number obtained by the physical noise source chip, performing high-performance cryptographic operations, device management, key data management, key storage and access control through the encryption control chip; encrypting and storing key data and managing permissions through the security chip; and realizing operator and administrator identity authentication and key data backup through the smart password key.

[0120] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute a PCI-E interface password card design method, the method comprising: obtaining a random number through the physical noise source chip; based on the random number obtained by the physical noise source chip, performing high-performance cryptographic operations, device management, key data management, key storage and access control through the encryption control chip; encrypting and storing key data and performing permission management through the security chip; and realizing operator and administrator identity authentication and key data backup through the smart password key.

[0121] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0122] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A PCI-E interface password card design method, characterized in that: The PCI-E interface password card includes an encryption control chip, a security chip, a physical noise source chip, and an intelligent password key. The number of interface channels of the PCI-E interface password card is X16, and the maximum transmission rate of each channel is 4Gb / s. The encryption control chip is electrically connected to the security chip, the physical noise source chip, and the intelligent password key respectively. The encryption control chip adopts an RSP-S20 chip, obtains key data through a key cache and an algorithm operation module, and uses a high-speed algorithm engine to set a corresponding cryptographic operation function to complete the calculation; The method comprises: Obtaining random numbers through the physical noise source chip; Based on the random number obtained by the physical noise source chip, SM1, SM2, SM3, SM4 and RSA high-performance cryptographic operations, device management, key data management, key storage and access control are performed through the encryption control chip; Encrypted storage and permission management of key data are performed through the security chip; Operator and administrator identity authentication and key data backup are achieved through the smart password key; The method further comprises: Role-based key access control, including: Performing permission management inside the security chip, and synchronizing permission status through an encrypted channel between the encryption control chip and the security chip, so as to achieve collaborative access control between the encryption control chip and the security chip; Based on the status of permission management, set the permission status conversion mechanism, including: According to the power-on status of the PCI-E password card and the login status of the operator and administrator smart password keys, the encryption control chip is used to realize the conversion of the global permission status, and the unauthorized status, operator permission status and private key access control code verification status are transmitted to the key cache module of the security chip in a secure manner; When the password card is used, the security chip generates a set of random numbers as the communication protection key between the security chip and RSP-S20. The security chip reads the public key of the communication protection key encryption key from RSP-S20 and uses the digital envelope mechanism to realize the communication protection key sharing.

2. The PCI-E interface password card design method according to claim 1, characterized in that: The key data management includes: The encryption control chip encrypts and manages key data through a three-level key structure, wherein the three-level key includes a first-level key, a second-level key, and a third-level key, wherein the first-level key is a protection key, and the second-level key includes a user key, a key encryption key, a backup key, a communication protection key encryption key, a communication protection key, a firmware protection key, a temporary key, a device key, and a device external authentication key, and the third-level key is a session key.

3. The PCI-E interface password card design method according to claim 2, characterized in that: In the three-level key structure, the first-level key encrypts and protects the second-level key. When the second-level key is stored inside the password card, it is encrypted and stored using the first-level key.

4. A PCI-E interface password card obtained by a PCI-E interface password card design method, characterized in that: The PCI-E interface password card interface has a channel number of X16, and the maximum transmission rate of each channel is 4Gb / s, including: The encryption control chip is used to realize SM1, SM2, SM3, SM4 and RSA high-performance cryptographic operations based on random numbers obtained by the physical noise source chip, and realize device management, key data management, key storage and access control functions. The encryption control chip adopts the RSP-S20 chip, obtains key data through the key cache and algorithm operation module, and uses the high-speed algorithm engine to set the corresponding cryptographic operation function to complete the calculation; Security chip, used for encrypted storage and permission management of key data processed by the encryption control chip; Physical noise source chip, used to obtain random numbers; Intelligent password key, used to realize operator and administrator identity authentication and back up the key data processed by the encryption control chip; The method further comprises: Role-based key access control, including: Performing permission management inside the security chip, and synchronizing permission status through an encrypted channel between the encryption control chip and the security chip, so as to achieve collaborative access control between the encryption control chip and the security chip; Based on the status of permission management, set the permission status conversion mechanism, including: According to the power-on status of the PCI-E password card and the login status of the operator and administrator smart password keys, the encryption control chip is used to realize the conversion of the global permission status, and the unauthorized status, operator permission status and private key access control code verification status are transmitted to the key cache module of the security chip in a secure manner; When the password card is used, the security chip generates a set of random numbers as the communication protection key between the security chip and RSP-S20. The security chip reads the public key of the communication protection key encryption key from RSP-S20 and uses the digital envelope mechanism to realize the communication protection key sharing.

5. The PCI-E interface password card according to claim 4, characterized in that: The physical noise source chip specifically includes: a first physical noise source chip and a second physical noise source chip, and the first physical noise source chip and the second physical noise source chip are electrically connected to the encryption control chip respectively.

6. The PCI-E interface password card according to claim 4, characterized in that: It also includes a power control chip, which is electrically connected to the encryption control chip and is used to convert the PCI-E interface voltage and provide power to other modules of the password card.

7. The PCI-E interface password card according to claim 6, characterized in that: The physical noise source chip uses two RSP physical noise source chips T10 to realize two random sources that back up each other.

8. The PCI-E interface password card according to claim 4, characterized in that: The PCI-E interface password card is connected to the PC via a PCI-E X16 interface.

9. The PCI-E interface password card according to claim 4, characterized in that: It also includes a key destruction module, which is electrically connected to the encryption control chip and the security chip through a key destruction interface and is used for key destruction and key initialization operations.

10. The PCI-E interface password card according to claim 9, characterized in that: The key destruction and key initialization operations include: When the power is on, if a button is pressed, the encryption control chip starts the self-destruction program, destroys the temporary key inside the secondary key inside the password card, the user key, the password encryption key, the session key, the device external authentication key and the private key access control code hash value, and the device returns to the initial state.

11. The PCI-E interface password card according to claim 4, characterized in that: The encryption control chip is electrically connected to a temperature sensor, and the temperature sensor is used to monitor the temperature of the encryption control chip; The encryption control chip is electrically connected to the indicator light through an I / O interface, and the indicator light includes a first status indicator light, a second status indicator light and a smart password key access indicator light, wherein the first status indicator light is used to indicate whether the power supply is normal after the password card is powered on, the second status indicator light is used to indicate whether the power-on self-test of the password card has passed, and the smart password key access indicator light is used to indicate whether the smart password key is accessed to the password card.

12. The PCI-E interface password card according to claim 4, characterized in that: The security chip adopts the Z32HUA chip, and the smart password key adopts the Utap smart password key.

Images