Cryptographic operation data transmission method, device, equipment and storage medium

Abstract

The present application provides a cryptographic operation data transmission method, device, equipment and storage medium. It is applied to the field of data transmission processing technology. The method includes: when calling the interface of the cryptographic service interface library to send a cryptographic service request to the server, first storing the initialization parameters and cryptographic service pending data corresponding to the cryptographic service request to the set space; if the cryptographic service interface library receives an end interface call request, it sends the cryptographic service request, the stored initialization parameters and cryptographic service pending data to the server at one time, and receives the cryptographic service processing data returned by the server. The above method reduces the number of network transmissions, improves data transmission efficiency, simplifies application layer logic, enhances data security, and improves system flexibility and scalability.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission processing, and in particular to a cryptographic operation data transmission method, device, equipment and storage medium. Background Art

[0002] Server cryptographic machines are server-side cryptographic computing devices that are mainly used to provide cryptographic service functions such as key generation, digital signatures, signature verification, data encryption, and data decryption. With the increasing prominence of cyberspace security and the increasing demand for information security, the server cryptographic machine industry will maintain a rapid growth trend. At the same time, with the continuous advancement and innovation of technology, server cryptographic machines will become more intelligent, integrated, and customized, providing more comprehensive, efficient, and secure services for various information systems.

[0003] In the related technology, the cryptographic system calls the cryptographic service interface library to send a cryptographic service request to the server. Each time the cryptographic system calls the cryptographic service interface library, the interface library sends a network request packet to the server and waits for the request network response packet until it receives the cryptographic service processing result fed back by the server cryptographic machine.

[0004] However, in the above method, the cryptographic service interface library will send and receive packets multiple times in the network for requesting cryptographic services, which consumes a lot of time and seriously reduces the performance of the cryptographic service, resulting in low data processing efficiency. Summary of the invention

[0005] The present application provides a cryptographic operation data transmission method, device, equipment and storage medium, which are used to solve the problem in the prior art that the cryptographic service interface library will send and receive packets multiple times in the network when requesting cryptographic services, which consumes a lot of time and seriously reduces the performance of the cryptographic services, thereby causing low data processing efficiency.

[0006] In a first aspect, the present application provides a cryptographic operation data transmission method, which is applied to a cryptographic system, and the method comprises:

[0007] When calling the interface of the password service interface library to send a password service request to the server, the initialization parameters and the password service pending data corresponding to the password service request are first stored in the setting space; the interface includes an initialization interface, a data processing interface and an end interface; the interface calling sequence is: first the initialization interface, then the data processing interface, if the data processing interface is called to store the password service pending data, then the end interface is called last; the setting space includes a cache field and a pending data cache area;

[0008] If the cryptographic service interface library receives the end interface call request, it sends the cryptographic service request, the stored initialization parameters and the cryptographic service data to be processed to the server at one time;

[0009] Receive the cryptographic service processing data returned by the server.

[0010] In a second aspect, the present application provides a cryptographic operation data transmission device, comprising:

[0011] The storage module is used to call the interface of the cryptographic service interface library to send a cryptographic service request to the server, and first store the initialization parameters and the cryptographic service to-be-processed data corresponding to the cryptographic service request into the setting space; the interface includes an initialization interface, a data processing interface and an end interface; the interface calling sequence is: first the initialization interface, then the data processing interface, and if the data processing interface is called to store the cryptographic service to-be-processed data, then the end interface is called last; the setting space includes a cache field and a cache area for to-be-processed data;

[0012] A first sending module, configured to send the cryptographic service request, the stored initialization parameters and the cryptographic service data to be processed to the server at one time if the cryptographic service interface library receives the end interface call request;

[0013] The receiving module is used to receive the cryptographic service processing data returned by the server.

[0014] In a third aspect, the present application provides a client, comprising: a processor, a memory and a communication interface connected to the processor, wherein a cryptographic system is configured in the client;

[0015] The memory stores computer-executable instructions;

[0016] The processor executes the computer-executable instructions stored in the memory to implement the cryptographic operation data transmission method described in any one of the first aspects.

[0017] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer execution instructions, and when the computer execution instructions are executed by a processor, they are used to implement the cryptographic operation data transmission method described in any of the preceding aspects.

[0018] In a fifth aspect, the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the cryptographic operation data transmission method described in any of the preceding aspects.

[0019] The cryptographic operation data transmission method, device, equipment and storage medium provided by the present application, when calling the interface of the cryptographic service interface library to send a cryptographic service request to the server, first store the initialization parameters and cryptographic service pending data corresponding to the cryptographic service request to the set space, if the cryptographic service interface library receives the end interface call request, then send the cryptographic service request, the stored initialization parameters and cryptographic service pending data to the server at one time, and receive the cryptographic service processing data returned by the server. The above method reduces the number of network transmissions, improves data transmission efficiency, simplifies application layer logic, enhances data security, and improves system flexibility and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0021] Figure 1 An exemplary application scenario diagram of the cryptographic operation data transmission method provided in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of the process of a related technical client performing cryptographic operations through a server;

[0023] Figure 3 A flowchart of a first embodiment of a cryptographic operation data transmission method provided in an embodiment of the present application;

[0024] Figure 4 A flowchart of a second embodiment of a cryptographic operation data transmission method provided in an embodiment of the present application;

[0025] Figure 5 A flowchart of a third embodiment of the cryptographic operation data transmission method provided in an embodiment of the present application;

[0026] Figure 6 A flowchart of a fourth embodiment of a cryptographic operation data transmission method provided in an embodiment of the present application;

[0027] Figure 7 A flowchart of a first specific example of a cryptographic operation data transmission method provided in an embodiment of the present application;

[0028] Figure 8 The diagram is a flow chart of the interface call when the total length of the data to be hashed is less than or equal to 32K bytes;

[0029] Fig. 9 A schematic flow chart of a second specific example of the cryptographic operation data transmission method provided in an embodiment of the present application;

[0030] Fig.10The diagram is a flow chart of the interface call when the total length of the data to be hashed is greater than 32K bytes;

[0031] Fig.11 A schematic diagram of the structure of an embodiment of a cryptographic operation data transmission device provided in an embodiment of the present application;

[0032] Fig.12 A schematic diagram of the structure of the cryptographic system provided in an embodiment of the present application.

[0033] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0034] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0035] The server cryptographic machine is a server-side cryptographic computing device, which is mainly used to provide cryptographic service functions such as key generation, digital signature, signature verification, data encryption, and data decryption. With the increasing prominence of the security status of cyberspace and the increasing demand for information security, the server cryptographic machine industry will maintain a rapid growth trend. At the same time, with the continuous advancement and innovation of technology, the server cryptographic machine will be more intelligent, integrated, and customized, providing more comprehensive, efficient, and secure services for various information systems. In the related technology, when the cryptographic system calls the cryptographic service interface library to send a cryptographic service request to the server, each time the cryptographic system calls the cryptographic service interface library, the interface library sends a network request packet to the server and waits for the request network response packet until it receives the cryptographic service processing result fed back by the server cryptographic machine. However, the cryptographic service interface library will send and receive packets in the network for multiple times to request cryptographic services, which consumes a lot of time and seriously reduces the performance of the cryptographic service, resulting in low data processing efficiency.

[0036] In view of the above problems, the present application provides a cryptographic operation data transmission method, device, equipment and storage medium, thereby reducing the number of times the cryptographic service interface library sends and receives packets in the network for requesting cryptographic services, thereby saving time and improving the performance and data processing efficiency of the cryptographic service. Specifically, when calling the server for cryptographic services, the service interface is usually called in sequence according to the interface call order. Each interface call sends a network request packet to the server and waits for a network response packet until the cryptographic service result fed back by the server is received. The sending and receiving of packets is processed multiple times in the network, which consumes a lot of time and seriously reduces the performance of the cryptographic service. In view of these problems, the inventor studied whether it is possible to store or cache the initialization parameters and the cryptographic service to-be-processed data corresponding to the cryptographic service request locally when the cryptographic system sends a cryptographic service request to the server through the cryptographic service interface library. After calling the end interface, the cryptographic service request, the initialization parameters and the cryptographic service to-be-processed data are sent to the server at one time, reducing the number of sending and receiving packets, saving time and improving the efficiency of the cryptographic service. Based on this, the technical solution of the present application is proposed.

[0037] The cryptographic operation data transmission method provided in the embodiment of the present application can be applied to the password card scenario and the server password machine scenario, wherein the password card scenario is that the password card and the password service interface library are deployed locally, that is, the password service interface library is a local call to the password card. For example, in some high-performance computing environments or specific security devices. In the server password machine scenario, since the server can provide higher encryption and decryption performance, it can support more clients to send requests to the server password machine through the password service interface library. This scenario is suitable for environments that need to process a large number of concurrent requests and have high requirements for encryption and decryption performance. For example, large enterprise networks, financial institutions, and other environments that need to process a large amount of sensitive data. It can also be applied to cloud scenarios and virtualization scenarios, that is, the client can be a cloud scenario or a virtualization end. In the cloud scenario, the client can be a virtual machine or container in the cloud, and communicate with the password service interface library through the network interface provided by the cloud service provider. It is mainly suitable for environments where the password service needs to be migrated to the cloud in order to utilize the elastic computing and storage resources of the cloud. For example, SaaS (Software as a Service) providers, cloud storage providers, etc. In the virtualization scenario, the client can be a virtual machine or container in the virtualization environment, and communicates with the cryptographic service interface library through the network interface provided by the virtualization platform. This scenario is suitable for environments that need to provide cryptographic services in a virtualized environment, such as virtualized data centers and cloud desktops.

[0038] Figure 1 An exemplary application scenario diagram of the cryptographic operation data transmission method provided in the embodiment of the present application, such as Figure 1As shown, the scenario includes at least a client and a server. Among them, the client is configured with a cryptographic system. The client is usually an electronic device that has the ability to communicate and transmit data with the server, such as a laptop, a smart phone, a tablet computer and other electronic devices. It can also be an embedded system or an IoT device, a server or a data center device. The client is configured with an application system and a cryptographic service interface library, such as a Security Development Framework (SDF) library, which is equivalent to a software package SDK. The essence of SDF is to allow the client to send a cryptographic service request to the server cryptographic machine through a standard interface to obtain the cryptographic service function. The server is usually a device with high-performance computing power and security, such as a high-performance computing server, a server cryptographic machine, a cloud computing platform, encryption hardware, an edge computing device, etc. The scenario can also include a switch / router for connecting the client and the server, so that data communication can be achieved through a network connection. And it can be connected through any type of network, such as a local area network, a wide area network, a virtual private network, the Internet, etc.

[0039] Figure 2 A flowchart of the process of the relevant technical client performing password services through the server, such as Figure 2 As shown, when the client needs a cryptographic service, it can request the server to perform a cryptographic service operation, wherein the cryptographic service may include: multi-packet symmetric encryption, multi-packet symmetric decryption, multi-packet message authentication code (MAC), multi-packet identifiable encryption, multi-packet identifiable decryption, multi-packet hashing, etc. Specifically, the application system deployed on the client calls the initialization interface of the cryptographic service interface library in accordance with the interface call sequence, sends the initialization parameters, and then the cryptographic service interface library sends the initialization parameters to the server through the internal implementation of the initialization interface until the server feedbacks a response, and then continues to call the data processing interface multiple times to send the cryptographic service to-be-processed data. Similarly, each time the data processing interface is called, the cryptographic service interface library sends the cryptographic service to-be-processed data to the server through the internal implementation of the data processing interface until the server feedbacks a response, and then makes the next call, and finally calls the end interface, the cryptographic service interface library sends the cryptographic service request to the server through the internal implementation of the end interface, and the server performs a cryptographic service operation on the received cryptographic service to-be-processed data according to the cryptographic service request, and obtains the cryptographic service processed data and feeds it back to the client.

[0040] Optionally, in order to improve the performance of the server-side cryptographic service and thus improve data processing efficiency, the initialization interface is called through the application system, and after sending the initialization parameters, the initialization parameters are stored or cached in the cache field of the set space, and then the data processing interface is called multiple times through the application system to send the cryptographic service pending data, and the cryptographic service pending data is cached in the pending data cache area of ​​the set space. After calling the end interface, the cryptographic service request, initialization parameters and cryptographic service pending data are sent to the server at one time through the one-time sending interface set by the cryptographic service interface library.

[0041] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0042] Figure 3 A flowchart of a cryptographic operation data transmission method according to an embodiment of the present application is shown in FIG. Figure 3 As shown, the method can be applied to a cryptographic system, wherein the cryptographic system can be applied in a client, a cloud or a local device. Taking the client as an example, the client can be configured with an application system and a cryptographic service interface library. Optionally, the cryptographic service interface library can also be configured in the application system, or can be configured in the client as an independent module like the application system. The method specifically includes:

[0043] S301: When calling the interface of the cryptographic service interface library to send a cryptographic service request to the server, firstly store the initialization parameters and cryptographic service to-be-processed data corresponding to the cryptographic service request into the setting space.

[0044] In this step, in order to ensure the security of data, the client can perform cryptographic service calculations through the server, and then send a cryptographic service request to the server through the cryptographic service interface library. When or before the cryptographic service request occurs, it is also necessary to send the initialization parameters and cryptographic service pending data for cryptographic calculations to the server in advance, and in order to reduce the number of network packets with the server, the initialization parameters and cryptographic service pending data are stored or cached in the set space.

[0045] Specifically, the initialization parameters are stored or cached in a cache field, and the cryptographic service data to be processed is stored or cached in a data to be processed cache area.

[0046] The calling sequence of the interface is: first the initialization interface, then the data processing interface. If the data processing interface is called to store the data to be processed by the cryptographic service, the end interface is called last. The setting space includes the cache field and the cache area for the data to be processed. The client application system calls the initialization interface of the cryptographic service interface library, sends the initialization parameters, and the application system calls the data processing interface of the cryptographic service interface library at least once, sends the data to be processed by the cryptographic service, calls the end interface, and sends the cryptographic service request.

[0047] It should be noted that different cryptographic service types call different interfaces (same type and function), and each interface sends different data (same type and function).

[0048] Exemplarily, the cryptographic service types may include: multi-packet symmetric encryption, multi-packet symmetric decryption, multi-packet MAC, multi-packet authenticated encryption, multi-packet authenticated decryption, and multi-packet hashing.

[0049] S302: When the cryptographic service interface library receives the end interface call request, it sends the cryptographic service request, the stored initialization parameters and the cryptographic service data to be processed to the server at one time.

[0050] In this step, after the client calls the end interface, it means that the cryptographic service data to be processed has been stored, and the initialization parameters, the cryptographic service data to be processed and the cryptographic service request are sent to the server at one time.

[0051] Specifically, the one-time sending interface set by the cryptographic service interface library is called to send initialization parameters, cryptographic service pending data and cryptographic service requests to the server.

[0052] For example, for different types of cryptographic services, the names of the one-time sending interfaces are set differently, but the functions that can be implemented are the same, for example: multi-packet symmetric encryption is Send_EncryptOnetime, multi-packet symmetric decryption is Send_DecryptOnetime, multi-packet MAC is Send_CalculateMACOnetime, multi-packet authenticatable encryption is Send_AuthEncOnetime, multi-packet authenticatable decryption is Send_AuthDecOnetime, and multi-packet hashing is Send_HashOnetime.

[0053] S303: Receive the cryptographic service processing data returned by the server.

[0054] In this step, after receiving the initialization parameters, cryptographic service data to be processed and cryptographic service request sent by the set one-time sending interface, the server performs cryptographic service calculation according to the cryptographic service request, obtains cryptographic service processing data and feeds it back to the client.

[0055] Specifically, the server performs cryptographic operations on the cryptographic service data to be processed according to the initialization parameters, obtains cryptographic service processing data, and then feeds back to the client through a one-time interface.

[0056] The cryptographic operation data transmission method provided in this embodiment, when calling the interface of the cryptographic service interface library to send a cryptographic service request to the server, first stores the initialization parameters and cryptographic service pending data corresponding to the cryptographic service request in the set space, and if the cryptographic service interface library receives the end interface call request, it sends the cryptographic service request, the stored initialization parameters and cryptographic service pending data to the server at one time, and receives the cryptographic service processing data returned by the server. The above method reduces the number of network transmissions, improves data transmission efficiency, simplifies application layer logic, enhances data security, and improves system flexibility and scalability.

[0057] Figure 4 The flowchart of the second embodiment of the cryptographic operation data transmission method provided in the embodiment of the present application is as follows: Figure 4 As shown, based on the above embodiment, step S301 specifically includes:

[0058] S401: Store the initialization parameters into the cache field.

[0059] S402: Storing the cryptographic service data to be processed in a buffer area for data to be processed.

[0060] In order to reduce the number of times network packets are sent to the server and thus improve data transmission efficiency, the relevant data used for cryptographic service operations is stored and then sent to the server at one time after storage.

[0061] Specifically, when requesting a password service, after the client establishes contact with the server, the server returns a session handle to the client. In the communication between the client and the server, it is a common practice to use a session handle to manage password services. A session handle is a unique identifier generated by the server and returned to the client, which is used to identify and track a specific session or connection established between the client and the server. Using a session handle for password service management helps the server manage multiple concurrent sessions and ensure data security and consistency. A cache field is preset in the session handle to store or cache initialization parameters, and a processing data cache area is applied in advance in the session handle to store or cache data to be processed by the password service.

[0062] Exemplarily, different cryptographic service types have different initialization parameters, so the preset cache fields in the session handle are also different. For example, if the cryptographic service request is a multi-packet symmetric encryption request, the initialization parameters include the multi-packet symmetric encryption identifier, the initialization vector corresponding to the multi-packet symmetric encryption, and the length of the initialization vector. Correspondingly, multi-packet symmetric encryption: uiAlgID, pucIV, and uiIVLength are defined in the session key handle to cache the initialization parameters of multi-packet symmetric encryption. Among them, uiAlgID is used to cache the identifier of multi-packet symmetric encryption, pucIV is used to cache the initialization vector, and uiIVLength is used to cache the length of the initialization vector.

[0063] If the cryptographic service request is a multi-packet symmetric decryption request, the initialization parameters include the multi-packet symmetric decryption identifier, the initialization vector corresponding to the multi-packet symmetric decryption, and the length of the initialization vector. Correspondingly, multi-packet symmetric decryption: uiAlgID, pucIV, and uiIVLength are defined in the session key handle to cache the initialization parameters of multi-packet symmetric decryption. Among them, uiAlgID is used to cache the identifier of multi-packet symmetric decryption, pucIV is used to cache the initialization vector, and uiIVLength is used to cache the length of the initialization vector.

[0064] If the cryptographic service request is a multi-packet MAC request, the initialization parameters include the multi-packet MAC identifier, the initialization vector corresponding to the multi-packet MAC, and the length of the initialization vector. Accordingly, uiAlgID, pucIV, and uiIVLength are defined in the multi-packet MAC: session key handle to cache the initialization parameters of the multi-packet MAC. Among them, uiAlgID is used to cache the identifier of the multi-packet MAC, pucIV is used to cache the initialization vector, and uiIVLength is used to cache the length of the initialization vector.

[0065] If the cryptographic service request is a multi-packet authenticatable encryption request, the initialization parameters include the multi-packet authenticatable encryption identifier, the starting variable corresponding to the multi-packet authenticatable encryption, the length of the starting variable, the additional authentication data corresponding to the multi-packet authenticatable encryption, and the length of the additional authentication data. Correspondingly, multi-packet authenticatable encryption: uiAlgID, pucStartVar, uiStartVarLength, pucAad, and uiAadLength are defined in the session key handle to cache the initialization parameters of multi-packet authenticatable encryption. Among them, uiAlgID is used to cache the identifier, pucStartVar is used to cache the starting variable, uiStartVarLength is used to cache the length of the starting variable, pucAad is used to cache the additional authentication data, and uiAadLength is used to cache the length of the additional authentication data.

[0066] If the cryptographic service request is a multi-packet authenticatable decryption request, the initialization parameters include the multi-packet authenticatable decryption identifier, the starting variable corresponding to the multi-packet authenticatable decryption, the length of the starting variable, the authentication data, the length of the authentication data, the additional authentication data corresponding to the multi-packet authenticatable decryption, and the length of the additional authentication data. Correspondingly, multi-packet authenticatable decryption: uiAlgID, pucStartVar, uiStartVarLength, pucAad, uiAadLength, pucAuthData, and uiAuthDataLength are defined in the session key handle to cache the initialization parameters of the multi-packet authenticatable decryption. Among them, uiAlgID is used to cache the identifier, pucStartVar is used to cache the starting variable, uiStartVarLength is used to cache the length of the starting variable, pucAad is used to cache the additional authentication data and uiAadLength is used to cache the length of the additional authentication data, pucAuthData is used to cache the authentication data, and uiAuthDataLength is used to cache the length of the authentication data.

[0067] If the cryptographic service request is a multi-packet hash request, the initialization parameters include the hash algorithm identifier, public key and client identifier. Correspondingly, the hash operation: uiAlgID, pucPublicKey and pucID are defined in the session handle to cache the initialization parameters for the hash operation. Among them, uiAlgID is used to cache the hash algorithm identifier, pucPublicKey is used to cache the public key and pucID is used to cache the client identifier.

[0068] Apply for a buffer area of ​​preset bytes in the session handle to store or cache the data to be processed by the cryptographic service.

[0069] Since the amount of data transmitted by calling the data processing interface once is limited, multiple calls can be made to transmit a large amount of cryptographic service data to be processed.

[0070] The cryptographic operation data transmission method provided in this embodiment stores the initialization parameters in the cache field and stores the cryptographic service pending data in the pending data cache area. By caching the cryptographic service request related data, the number of network packet transmissions with the server is reduced, thereby improving the data transmission efficiency.

[0071] Figure 5 The flowchart of the third embodiment of the cryptographic operation data transmission method provided in the embodiment of the present application is as follows: Figure 5 As shown, based on the above embodiment, the method further includes:

[0072] S501: before the cryptographic service interface library receives the request to end the interface call, if the data cached in the buffer area reaches the set storage space threshold of the buffer area for data to be processed, the data stored in the set space is sent to the server.

[0073] In this step, the cache area for pending data of the set space is applied for in advance, so the cache area has an upper limit on the amount of cached data, that is, it can only store data of the set storage space threshold. When the total length of the pending data of the cryptographic service corresponding to the cryptographic service requested by the client is greater than the set storage space threshold, before the end interface is called, the data stored or cached in the cache area for pending data reaches the set storage space threshold. The cryptographic service interface library sends the data already stored in the set space to the server through the internally implemented interface.

[0074] Specifically, if the initialization parameters are not sent, the initialization parameters are sent to the server by calling the internal initialization interface through the cryptographic service interface library, and the cryptographic service data to be processed that has been cached in the data buffer area to be processed is sent to the server by calling the internal data processing interface through the cryptographic service interface library.

[0075] If the initialization parameters have been sent, the cryptographic service data to be processed that has been cached in the data buffer area to be processed is sent to the server only through the cryptographic service interface library calling the internal data processing interface.

[0076] It should be noted that when the amount of data stored in the cache area of ​​data to be processed reaches the set storage space threshold for the first time, the initialization parameters and the cryptographic service data to be processed already cached in the cache area are sent to the server. When the set storage space threshold is reached for the second time or more, only the cryptographic service interface library calls the internal data processing interface to send the cryptographic service data to be processed already cached in the cache area of ​​data to be processed to the server.

[0077] S502: After the cryptographic service interface library receives the end interface call request, the cryptographic service interface library sends a cryptographic service request to the server.

[0078] After the client calls the end interface, the cryptographic service interface library receives the cryptographic service request, and the cryptographic service interface library sends the cryptographic service request to the server through the internal end port corresponding to the end interface. Then the server can perform corresponding cryptographic service operations on the received initialization parameters and cryptographic service data to be processed according to the cryptographic service request.

[0079] The cryptographic operation data transmission method provided in this embodiment sends the data stored in the set space to the server end before the cryptographic service interface library receives the end interface call request if the data cached in the buffer area reaches the set storage space threshold of the buffer area for the data to be processed, and sends the cryptographic service request to the server end through the cryptographic service interface library after the cryptographic service interface library receives the end interface call request. By combining the cache area status and network transmission requirements, flexible control of the data transmission process is achieved, thereby improving the efficiency, reliability and user experience of data transmission, and optimizing the utilization of system resources.

[0080] Figure 6 A flowchart of a fourth embodiment of a cryptographic operation data transmission method provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, based on the above embodiments, step S501 specifically includes:

[0081] S601: If the initialization parameters are not sent, the initialization parameters are sent to the server by calling the internal initialization interface through the cryptographic service interface library.

[0082] S602: Calling the internal data processing interface through the cryptographic service interface library sends the cryptographic service data to be processed that has been cached in the data cache area to be processed to the server.

[0083] S603: If the initialization parameters have been sent, the cryptographic service data to be processed that has been cached in the data buffer area to be processed is sent to the server only through the cryptographic service interface library calling the internal data processing interface.

[0084] Since the initialization parameters and the cryptographic service data to be processed are sent by calling different interfaces, when the data stored or cached in the data cache area to be processed reaches the set storage space threshold, the cache field is checked, and when the initialization parameters cached in the cache field are not sent, the internal initialization interface is called through the cryptographic service interface library to send the initialization parameters to the server, and the cryptographic service data to be processed stored or cached in the data cache area to be processed is sent to the server through the data processing interface implemented internally in the cryptographic service interface library.

[0085] It should be noted that the initialization parameters are only sent to the server once when the data stored or cached in the data cache area to be processed reaches the set storage space threshold for the first time. After sending, if the cache area reaches the set storage space threshold again, only the internal data processing interface is called to send the cryptographic service data to be processed cached in the data cache area to be processed to the server.

[0086] The cryptographic operation data transmission method provided in this embodiment, if the initialization parameter is not sent, the initialization parameter is sent to the server by calling the internal initialization interface through the cryptographic service interface library, and the cryptographic service data to be processed that has been cached in the data buffer area to be processed is sent to the server by calling the internal data processing interface through the cryptographic service interface library. If the initialization parameter has been sent, only the cryptographic service data to be processed that has been cached in the data buffer area to be processed is sent to the server by calling the internal data processing interface through the cryptographic service interface library. This method realizes effective control and management of the data processing process through an orderly data processing flow, ensuring data consistency and accuracy, and enhancing system stability and reliability.

[0087] Based on the foregoing embodiments, the following describes the specific implementation of cryptographic operation data transmission by taking different cryptographic services as examples.

[0088] If the cryptographic service request is a multi-package symmetric encryption request, when the total data volume of the multi-package symmetric encryption operation data is greater than the set storage space threshold of the data cache to be processed, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_EncryptInit interface to send initialization parameters to the server, calls the Send_EncryptUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_EncryptFinal interface to send the cryptographic service request to the server; or, when the total data volume of the multi-package symmetric encryption operation data is less than or equal to the set storage space threshold of the data cache to be processed, the cryptographic service interface library calls the set Send_EncryptOnetime interface to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0089] If the cryptographic service request is a multi-packet symmetric decryption request, when the total data volume of the multi-packet symmetric decryption operation data is greater than the set storage space threshold of the data cache to be processed, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_DecryptInit interface to send initialization parameters to the server, calls the Send_DecryptUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_DecryptFinal interface to send the cryptographic service request to the server; or, when the total data volume of the multi-packet symmetric decryption operation data is less than or equal to the set storage space threshold of the data cache to be processed, the cryptographic service interface library calls the set Send_DecryptOnetime interface to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0090] If the cryptographic service request is a multi-packet MAC request, when the total data volume of the multi-packet MAC calculation data is greater than the set storage space threshold of the buffer area for data to be processed, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_CalculateMACInit interface to send initialization parameters to the server, calls the Send_CalculateMACUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_CalculateMACFinal interface to send the cryptographic service request to the server; or, when the total data volume of the multi-packet MAC calculation data is less than or equal to the set storage space threshold of the buffer area for data to be processed, the cryptographic service interface library calls the set Send_CalculateMACOnetime interface to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0091] If the cryptographic service request is a multi-package identifiable encryption request, when the total data volume of the multi-package identifiable encryption operation data is greater than the set storage space threshold of the data cache to be processed, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_AuthEncInit interface to send initialization parameters to the server, calls the Send_AuthEncUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_AuthEncFinal interface to send the cryptographic service request to the server; or, when the total data volume of the multi-package identifiable encryption operation data is less than or equal to the set storage space threshold of the data cache to be processed, the cryptographic service interface library calls the set Send_AuthEncOnetime interface to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0092] If the cryptographic service request is a multi-package identifiable decryption request, when the total data volume of the multi-package identifiable decryption operation data is greater than the set storage space threshold of the buffer area for data to be processed, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_AuthDecInit interface to send initialization parameters to the server, calls the Send_AuthDecUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_AuthDecFinal interface to send the cryptographic service request to the server; or, when the total data volume of the multi-package identifiable decryption operation data is less than or equal to the set storage space threshold of the buffer area for data to be processed, the cryptographic service interface library calls the set Send_AuthDecOnetime interface to send initialization parameters, cryptographic service data to be processed, and cryptographic service request to the server.

[0093] If the cryptographic service request is a multi-packet hash request, when the total data volume of the multi-packet hash operation data is greater than the set storage space threshold of the data buffer area to be processed, and when the total data volume of the multi-packet identifiable decryption operation data is greater than the set storage space threshold of the data buffer area to be processed, then according to the data volume stored in the set space, the cryptographic service interface library calls the Send_HashInit interface to send initialization parameters to the server, calls the Send_HashUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_HashFinal interface to send the cryptographic service request to the server; or, when the total data volume of the multi-packet hash operation data is less than or equal to the set storage space threshold of the data buffer area to be processed, the cryptographic service interface library calls the set Send_HashOnetime interface to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0094] Figure 7 The flowchart of the first specific example of the cryptographic operation data transmission method provided in the embodiment of the present application is as follows: the cryptographic service is a hash operation, the cryptographic service interface library is an SDF library, the amount of data stored in the buffer area is 32K bytes, the total length of the data to be hashed is 32K bytes, and each time the SDF_HashUpdate interface is called to input 4K bytes of data, the cryptographic operation data transmission method provided in the embodiment of the present application is illustrated by way of example. Figure 8 This is a schematic diagram of the interface call flow when the total length of the data to be hashed is less than or equal to 32K bytes. Figure 7 and Figure 8 , the method comprising:

[0095] S701: Call the SDF_HashFinal interface of the SDF library, input initialization parameters, and cache them to the session handle.

[0096] S702: Call the SDF_HashUpdate interface of the SDF library 8 times, input the data to be hashed, and cache it in the cache area.

[0097] S703: calling the SDF_HashFinal interface of the SDF library. The SDF library adds the cached data to the hash operation request through the set send_HashOnetime interface, sends it to the server, and receives the hash result fed back by the server.

[0098] The cryptographic operation data transmission method provided in this embodiment caches the data to be hashed in the cache area, and after the data is transmitted, calls the set send_HashOnetime interface to add the cached data to the hash operation request, sends it to the server, and receives the hash result fed back by the server. By reducing the number of network transmissions between the client host and the server, time is saved and the efficiency of hash data processing is improved.

[0099] Fig. 9 A flow chart of a second specific example of a cryptographic operation data transmission method provided in an embodiment of the present application, wherein the cryptographic service is a hash operation, the cryptographic service interface library is an SDF library, the amount of data stored in the buffer area is 32K bytes, the total length of the data to be hashed is 128K bytes, and each time the SDF_HashUpdate interface is called to input 4K bytes of data, as an example, Fig.10 This is a schematic diagram of the interface call flow when the total length of the hashed data is greater than 32K bytes. Fig. 9 and Fig.10 , the method comprising:

[0100] S901: Call the SDF_HashFinal interface of the SDF library, input initialization parameters, and cache them to the session handle.

[0101] S902: Call the SDF_HashUpdate interface of the SDF library 8 times, input the data to be hashed, and cache it in the cache area.

[0102] S903: Send the initialization parameters to the server by calling the send_HashFinal interface, and send the 32K data to be hashed in the current buffer to the server by calling the send_HashUpdate interface.

[0103] S904: Continue to call the SDF_HashUpdate interface of the SDF library 8 times through the application system, input the data to be hashed, and cache it in the cache area.

[0104] S905: Send the 32K data to be hashed in the current buffer to the server by calling the send_HashUpdate interface.

[0105] S906: Continue to call the SDF_HashUpdate interface of the SDF library 8 times, input the data to be hashed, and cache it in the cache area.

[0106] S907: Send the 32K data to be hashed in the current buffer to the server by calling the send_HashUpdate interface.

[0107] S908: Continue to call the SDF_HashUpdate interface of the SDF library 8 times through the application system, input the data to be hashed, and cache it in the cache area.

[0108] S909: Send the 32K data to be hashed in the current buffer to the server by calling the send_HashUpdate interface.

[0109] S910: The application system calls the SDF_HashFinal interface of the SDF library, and the SDF library sends the hash operation request to the server through the send_HashFinal interface, and receives the hash result fed back by the server.

[0110] The cryptographic operation data transmission method provided in this embodiment caches the data to be hashed in a cache area, and after the data cached in the cache area reaches the storage data volume, the cached data is sent to the server until the hash result fed back by the server is received. By reducing the number of network transmissions between the client host and the server, time is saved and the efficiency of hash data processing is improved.

[0111] Fig.11 A schematic diagram of the structure of an embodiment of a cryptographic operation data transmission device provided in an embodiment of the present application, such as Fig.11 As shown, the cryptographic operation data transmission device 1100 includes:

[0112] Storage module 1101 is used to call the interface of the cryptographic service interface library to send a cryptographic service request to the server, and first store the initialization parameters corresponding to the cryptographic service request and the cryptographic service pending data to the setting space; the interface includes an initialization interface, a data processing interface and an end interface; the interface calling sequence is: first the initialization interface, then the data processing interface, if the data processing interface is called to store the cryptographic service pending data, then the end interface is called last; the setting space includes a cache field and a pending data cache area.

[0113] The first sending module 1102 is used to send the cryptographic service request, the stored initialization parameters and the cryptographic service data to be processed to the server at one time if the cryptographic service interface library receives the end interface call request.

[0114] The receiving module 1103 is used to receive the cryptographic service processing data returned by the server.

[0115] Optionally, the storage module 1101 is specifically used for:

[0116] Store initialization parameters into cache fields;

[0117] The cryptographic service pending data is stored in the pending data buffer area.

[0118] In a possible implementation, the cryptographic operation data transmission device 1100 further includes:

[0119] The second sending module 1104 is used to send the data stored in the set space to the server if the data cached in the buffer area reaches the set storage space threshold of the buffer area for data to be processed before the cryptographic service interface library receives the end interface call request.

[0120] The third sending module 1105 is used to send a cryptographic service request to the server through the cryptographic service interface library after the cryptographic service interface library receives the end interface call request.

[0121] Optionally, the first sending module 1102 is specifically configured to:

[0122] The one-time sending interface set by the cryptographic service interface library is called to send the cryptographic service request, the stored initialization parameters and the cryptographic service data to be processed to the server.

[0123] The second sending module 1104 is specifically configured to:

[0124] If the initialization parameters are not sent, the initialization parameters are sent to the server by calling the internal initialization interface through the cryptographic service interface library;

[0125] Calling the internal data processing interface through the cryptographic service interface library sends the cryptographic service data to be processed that has been cached in the data buffer area to be processed to the server;

[0126] If the initialization parameters have been sent, the cryptographic service data to be processed that has been cached in the data buffer area to be processed is sent to the server only through the cryptographic service interface library calling the internal data processing interface.

[0127] Optionally, the cryptographic operation data transmission device 1100 further includes:

[0128] The fourth sending module 1106 is used to send initialization parameters to the server through the cryptographic service interface library, call the Send_EncryptInit interface to send cryptographic service data to be processed to the server, and call the Send_EncryptFinal interface to send the cryptographic service request to the server if the cryptographic service request is a multi-package symmetric encryption request, according to the amount of data stored in the set space; or, call the set Send_EncryptOnetime interface through the cryptographic service interface library to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0129] The fifth sending module 1107 is used to send initialization parameters to the server through the cryptographic service interface library, call the Send_DecryptInit interface to send cryptographic service data to be processed to the server, and call the Send_DecryptFinal interface to send the cryptographic service request to the server if the cryptographic service request is a multi-packet symmetric decryption request, according to the amount of data stored in the set space; or, call the set Send_DecryptOnetime interface through the cryptographic service interface library to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0130] The sixth sending module 1108 is used to send initialization parameters to the server through the cryptographic service interface library by calling the Send_CalculateMACInit interface, send cryptographic service pending data to the server by calling the Send_CalculateMACUpdate interface, and send cryptographic service request to the server by calling the Send_CalculateMACFinal interface if the cryptographic service request is a multi-packet MAC request, according to the amount of data stored in the set space; or, send initialization parameters, cryptographic service pending data and cryptographic service request to the server by calling the set Send_CalculateMACOnetime interface through the cryptographic service interface library.

[0131] The seventh sending module 1109 is used to send initialization parameters to the server through the cryptographic service interface library, call the Send_AuthEncInit interface to send the cryptographic service data to be processed to the server, and call the Send_AuthEncFinal interface to send the cryptographic service request to the server if the cryptographic service request is a multi-packet identifiable encryption request, according to the amount of data stored in the set space; or, call the set Send_AuthEncOnetime interface through the cryptographic service interface library to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0132] The eighth sending module 1110 is used to send initialization parameters to the server through the cryptographic service interface library, call the Send_AuthDecInit interface to send the cryptographic service data to be processed to the server, and call the Send_AuthDecFinal interface to send the cryptographic service request to the server if the cryptographic service request is a multi-packet identifiable decryption request, according to the amount of data stored in the set space; or, call the set Send_AuthDecOnetime interface through the cryptographic service interface library to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0133] The ninth sending module 1111 is used for, if the cryptographic service request is a multi-packet hash request, then according to the amount of data stored in the set space, calling the Send_HashInit interface through the cryptographic service interface library to send initialization parameters to the server, calling the Send_HashUpdate interface to send the cryptographic service data to be processed to the server, calling the Send_HashFinal interface to send the cryptographic service request to the server; or, calling the set Send_HashOnetime interface through the cryptographic service interface library to send initialization parameters, cryptographic service data to be processed and cryptographic service request to the server.

[0134] The cryptographic operation data transmission device provided in the above embodiment is used to execute the cryptographic operation data transmission method in any of the above method embodiments. Its implementation principle and technical effect are similar and will not be repeated here.

[0135] Fig.12 A schematic diagram of the structure of the client provided in the embodiment of the present application, such as Fig.12 As shown, the client 1200 includes: a processor 1202, a memory 1201 connected to the processor 1202, and a communication interface 1203. The client 1200 is configured with a cryptographic system;

[0136] The memory 1201 stores computer executable instructions;

[0137] The processor 1202 executes the computer-executable instructions stored in the memory 1201 to implement the cryptographic operation data transmission method in any method embodiment.

[0138] The communication interface 1203 is used for communication connection with external devices.

[0139] An embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to execute the cryptographic operation data transmission methods provided in the above-mentioned various embodiments.

[0140] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0141] Optionally, a readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0142] An embodiment of the present application also provides a computer program product, which includes a computer program. The computer program is stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When at least one processor executes the computer program, the technical solution provided by any of the above method embodiments can be implemented.

[0143] In this application, "at least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship; in the formula, the character " / " indicates that the previous and next associated objects are in a "division" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0144] It is to be understood that the various numerical numbers involved in the embodiments of the present application are only for the convenience of description and are not intended to limit the scope of the embodiments of the present application. In the embodiments of the present application, the size of the sequence number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0145] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0146] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A cryptographic operation data transmission method, characterized in that: Applied to a cryptographic system, the method comprises: When calling the interface of the cryptographic service interface library to send a cryptographic service network request to the server, the initialization parameters and the cryptographic service to-be-processed data corresponding to the cryptographic service network request are first stored in the setting space; the interface includes an initialization interface, a data processing interface and an end interface; the interface calling sequence is: first calling the initialization interface, then calling the data processing interface, and if the data processing interface is called to store the cryptographic service to-be-processed data, then calling the end interface last; the setting space includes a cache field and a cache area for to-be-processed data; when the cryptographic service network request is a multi-packet hash request, the initialization parameters include an identifier of the hash algorithm, a public key and an identifier of the cryptographic system; If the cryptographic service interface library receives the end interface call request, it sends the cryptographic network service request, the stored initialization parameters and the cryptographic service to-be-processed data to the server at one time; Receive the cryptographic service processing data returned by the server.

2. The method according to claim 1, characterized in that The storing of the initialization parameters and the cryptographic service to-be-processed data corresponding to the cryptographic service network request into the setting space includes: Storing the initialization parameters in the cache field; The cryptographic service data to be processed is stored in the data to be processed buffer area.

3. The method according to claim 1, characterized in that The method further comprises: Before the cryptographic service interface library receives the end interface call request, if the data cached in the buffer area reaches the set storage space threshold of the to-be-processed data buffer area, the data stored in the set space is sent to the server; After the cryptographic service interface library receives the end interface call request, the cryptographic service network request is sent to the server through the cryptographic service interface library.

4. The method according to claim 1, characterized in that The one-time sending of the cryptographic service network request, the stored initialization parameters and the cryptographic service data to be processed to the server includes: The one-time sending interface set by the cryptographic service interface library is called to send the cryptographic service network request, the stored initialization parameters and the cryptographic service data to be processed to the server.

5. The method according to claim 3, characterized in that: The sending the data stored in the setting space to the server includes: If the initialization parameter is not sent, the initialization parameter is sent to the server through the cryptographic service interface library; then, the cryptographic service data to be processed that has been cached in the cache area of ​​the data to be processed is sent to the server through the cryptographic service interface library; If the initialization parameter has been sent, only the cryptographic service data to be processed that has been cached in the data to be processed buffer area is sent to the server through the cryptographic service interface library.

6. The method according to claim 5, characterized in that The method further comprises: If the cryptographic service network request is a multi-packet symmetric encryption request, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_EncryptInit interface to send the initialization parameters to the server, calls the Send_EncryptUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_EncryptFinal interface to send the cryptographic service network request to the server; or, calls the set Send_EncryptOnetime interface through the cryptographic service interface library to send the initialization parameters, the cryptographic service data to be processed and the cryptographic service network request to the server; If the cryptographic service network request is a multi-packet symmetric decryption request, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_DecryptInit interface to send the initialization parameters to the server, calls the Send_DecryptUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_DecryptFinal interface to send the cryptographic service network request to the server; or, calls the set Send_DecryptOnetime interface through the cryptographic service interface library to send the initialization parameters, the cryptographic service data to be processed and the cryptographic service network request to the server; If the cryptographic service network request is a multi-packet message authentication code MAC request, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_CalculateMACInit interface to send the initialization parameters to the server, calls the Send_CalculateMACUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_CalculateMACFinal interface to send the cryptographic service network request to the server; or, calls the set Send_CalculateMACOnetime interface through the cryptographic service interface library to send the initialization parameters, the cryptographic service data to be processed and the cryptographic service network request to the server; If the cryptographic service network request is a multi-packet identifiable encryption request, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_AuthEncInit interface to send the initialization parameters to the server, calls the Send_AuthEncUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_AuthEncFinal interface to send the cryptographic service network request to the server; or, calls the set Send_AuthEncOnetime interface through the cryptographic service interface library to send the initialization parameters, the cryptographic service data to be processed, and the cryptographic service network request to the server; If the cryptographic service network request is a multi-packet identifiable decryption request, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_AuthDecInit interface to send the initialization parameters to the server, calls the Send_AuthDecUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_AuthDecFinal interface to send the cryptographic service network request to the server; or, calls the set Send_AuthDecOnetime interface through the cryptographic service interface library to send the initialization parameters, the cryptographic service data to be processed, and the cryptographic service network request to the server; If the cryptographic service network request is a multi-packet hash request, then according to the amount of data stored in the set space, the cryptographic service interface library calls the Send_HashInit interface to send the initialization parameters to the server, calls the Send_HashUpdate interface to send the cryptographic service data to be processed to the server, and calls the Send_HashFinal interface to send the cryptographic service network request to the server; or, the cryptographic service interface library calls the set Send_HashOnetime interface to send the initialization parameters, the cryptographic service data to be processed and the cryptographic service network request to the server.

7. The method according to any one of claims 1 to 6, characterized in that: If the cryptographic service network request is a multi-packet symmetric encryption request, the initialization parameter includes an identifier of the multi-packet symmetric encryption, an initialization vector corresponding to the multi-packet symmetric encryption, and a length of the initialization vector; If the cryptographic service network request is a multi-packet symmetric decryption request, the initialization parameter includes an identifier of the multi-packet symmetric decryption, an initialization vector corresponding to the multi-packet symmetric decryption, and a length of the initialization vector; If the cryptographic service network request is a multi-packet MAC request, the initialization parameter includes an identifier of the multi-packet MAC, an initialization vector corresponding to the multi-packet MAC, and a length of the initialization vector; If the cryptographic service network request is a multi-packet authenticatable encryption request, the initialization parameters include an identifier of the multi-packet authenticatable encryption, a starting variable corresponding to the multi-packet authenticatable encryption, a length of the starting variable, additional authentication data corresponding to the multi-packet authenticatable encryption, and a length of the additional authentication data; If the cryptographic service network request is a multi-packet authenticatable decryption request, the initialization parameters include an identifier of the multi-packet authenticatable decryption, a starting variable corresponding to the multi-packet authenticatable decryption, a length of the starting variable, authentication data, a length of the authentication data, additional authentication data corresponding to the multi-packet authenticatable decryption, and a length of the additional authentication data.

8. A cryptographic operation data transmission device, characterized in that: include: The storage module is used to call the interface of the cryptographic service interface library to send a cryptographic service network request to the server, and first store the initialization parameters and cryptographic service to-be-processed data corresponding to the cryptographic service network request into the setting space; the interface includes an initialization interface, a data processing interface and an end interface; the interface calling sequence is: first calling the initialization interface, then calling the data processing interface, and if the data processing interface is called to store the cryptographic service to-be-processed data, then calling the end interface last; the setting space includes a cache field and a to-be-processed data cache area; when the cryptographic service network request is a multi-packet hash request, the initialization parameters include the hash algorithm identifier, the public key and the cryptographic system identifier; A first sending module, configured to send the cryptographic service network request, the stored initialization parameters and the cryptographic service to-be-processed data to the server at one time if the cryptographic service interface library receives the end interface call request; The receiving module is used to receive the cryptographic service processing data returned by the server.

9. A client, characterized in that: include: A processor, a memory and a communication interface connected to the processor, and a cryptographic system is configured in the client; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the cryptographic operation data transmission method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the cryptographic operation data transmission method according to any one of claims 1 to 7.

Images