Endogenous security cloud password service management system and method

Abstract

The invention discloses an endogenous security cloud password service management system and method, which realize high-speed calling of password resources and high-efficiency management of password services by adopting a password micro-service architecture and fusing the multi-core high-speed processing capability of a CPU (Central Processing Unit). On the basis of a password acceleration engine SCTO, the security of calling AKSK signature verification by a cloud password service management system service is guaranteed, and the password operation performance of password equipment is improved; based on the trusted computing capability of the PKS, the trusted protection of the whole process of starting, loading, executing, calling and managing of the cloud password service management system and various password devices is realized; a hyper-fusion defense and auditing technology is adopted, more than ten network attacks such as brute force attack, detection scanning and Trojan virus are defended, and risk behaviors are designed.

Description

Technical Field

[0001] The present invention relates to the field of cryptographic security, and in particular to an intrinsically secure cloud cryptographic service management system and method. Background Art

[0002] With the implementation of laws and regulations such as the Cryptography Law and Cryptography Application Security Assessment, cryptography is accelerating its integration with the cloud, and cloud applications are in urgent need of diversified, comprehensive, intensive, and easily scalable cryptographic services. The cloud cryptographic service management system aggregates cryptographic resources, provides transparent services to the outside world, supports dynamic scaling of cryptographic capabilities, and seamlessly connects with cloud computing systems to achieve confidentiality, integrity, non-repudiation, and trusted computing protection. As the network attack and defense situation continues to evolve, the security and availability of the cloud cryptographic service management system itself are directly related to the effectiveness of cryptography;

[0003] However, in traditional cloud cryptographic service management, the cryptographic service management architecture is too complex, resulting in high cryptographic computing pressure, making it impossible to use the CPU processing power most effectively, and thus making the call of cryptographic resources slow;

[0004] Furthermore, traditional API gateways and management platforms usually rely on preset static rules to manage traffic and security policies. This static rule management approach may not be able to flexibly respond to complex network attack patterns and changing security requirements;

[0005] At the same time, due to the limitations of traditional systems, the ability to monitor and respond to security incidents in real time may be insufficient, resulting in delayed security response and possible data leakage risks;

[0006] The traditional single-entry architecture has the risk of single point failure. Once the API gateway or management platform fails, the entire system may become unavailable or security may be compromised.

[0007] As cloud computing applications become more complex and large in scale, traditional single-entry systems may face performance bottlenecks and be unable to meet high load and rapidly growing traffic demands;

[0008] In "CN116781359A", a security management center is established using a microservice architecture, user registration and login information is stored in an internal encrypted database, and an offline deployment method is adopted. The required data and programs are deployed locally before use. The internal encrypted database is encrypted using an asymmetric encryption algorithm, and the configuration data is stored in the internal encrypted database. Only those who have the decryption private key can decrypt the data to ensure the confidentiality and integrity of the data. Virtualization technology is used for network isolation to isolate the client from the external network. At the same time, a strongly typed language is selected for programming and development to make the source code difficult to be reverse cracked, thereby ensuring system security and user privacy. However, this solution cannot provide reasonable defense measures against attack incidents during the encryption process. Summary of the invention

[0009] The purpose of the present invention is to provide an endogenous secure cloud cryptographic service management system and method, which solves the above-mentioned technical problems pointed out in the prior art.

[0010] The present invention provides an endogenous secure cloud cryptographic service management system, including an API gateway and a platform portal, a cryptographic service management module, a monitoring and analysis module, and a security protection module;

[0011] Wherein, the API gateway and platform portal are used to obtain the current service request;

[0012] The cryptographic service management module is used to perform cryptographic service management operations through the PKS system based on the trusted cryptographic resource pool and the service request;

[0013] The cryptographic service management operations include key generation operations, key storage operations, and key distribution operations;

[0014] The monitoring and analysis module is used to monitor and analyze the cryptographic service management operation to obtain analysis results;

[0015] The analysis results represent the activity data and security data in the current cryptographic service management operation process;

[0016] The security protection module is used to send the analysis results to the host and provide security protection to the endogenous security cloud cryptographic service management system.

[0017] The security protection adopts hyper-converged defense technology and audit technology.

[0018] Preferably, the system further comprises a trusted cryptographic resource pool establishment module;

[0019] The trusted password resource pool establishing module is used to establish a trusted password resource pool;

[0020] The trusted cryptographic resource pool is a list representing the mapping relationship between the electronic certificate server ID, the key management server ID, the signature server ID, the security authentication gateway ID, the server cryptographic machine ID and the timestamp server ID;

[0021] The trusted cryptographic resource pool establishment module is specifically used to obtain the electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID of the cloud cryptographic service management system corresponding to the current service request;

[0022] The electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID are mapped based on network topology to obtain a trusted cryptographic resource pool;

[0023] Preferably, the security protection module is specifically used to audit the analysis result to obtain an audit result;

[0024] Based on the audit results, security protection is provided through hyper-converged defense.

[0025] Preferably, the security protection module is used to determine the audit type according to the data characteristics of the analysis result during the specific implementation process;

[0026] Based on the audit type, the audit result is obtained by comparing the preset expected analysis result with the analysis result.

[0027] The expected analysis results are sample activity data and sample security data under different conditions of the initially preset cryptographic service management operations.

[0028] Accordingly, the present invention also proposes a method for managing an intrinsically secure cloud cryptographic service, comprising the following steps:

[0029] Get the current service request;

[0030] Execute cryptographic service management operations through the PKS system based on the service request based on the trusted cryptographic resource pool;

[0031] The cryptographic service management operations include key generation operations, key storage operations, and key distribution operations;

[0032] Monitoring and analyzing the cryptographic service management operation to obtain analysis results;

[0033] Based on the analysis result, it is sent to the host and provides security protection to the endogenous security cloud cryptographic service management system.

[0034] The security protection adopts hyper-converged defense technology and audit technology;

[0035] Preferably, the analysis results represent active data and security data during the current cryptographic service management operation.

[0036] Preferably, the method for managing an intrinsically secure cloud cryptographic service further includes establishing a trusted cryptographic resource pool.

[0037] Preferably, the trusted cryptographic resource pool is a list representing the mapping relationship between the electronic certificate server ID, the key management server ID, the signature server ID, the security authentication gateway ID, the server cryptographic machine ID and the timestamp server ID.

[0038] Preferably, the establishment of a trusted password resource pool includes the following steps:

[0039] Get the electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID of the cloud cryptographic service management system corresponding to the current service request;

[0040] The electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID are mapped based on network topology to obtain a trusted cryptographic resource pool;

[0041] Preferably, providing security protection to the endogenous secure cloud cryptographic service management system comprises the following steps:

[0042] Auditing the analysis results to obtain audit results;

[0043] Based on the audit results, security protection is provided through hyper-converged defense.

[0044] Preferably, the auditing of the analysis results to obtain the audit results comprises the following steps:

[0045] Determining the audit type based on the data characteristics of the analysis results;

[0046] Based on the audit type, the audit result is obtained by comparing the preset expected analysis result with the analysis result.

[0047] The expected analysis results are sample activity data and sample security data under different conditions of the initially preset cryptographic service management operation;

[0048] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0049] It can be seen from the analysis of the above-mentioned intrinsically secure cloud cryptographic service management system and method provided by the present invention that, in specific applications, the current service request is obtained through the API gateway and the platform portal; the API gateway and the platform portal ensure secure external access and effective traffic management;

[0050] The micro-cryptographic service architecture based on the PKS system dynamically dispatches cryptographic resources according to service requests, including encryption, decryption, signature and other services, to ensure efficient resource utilization and response speed;

[0051] Through real-time monitoring and analysis, we can quickly discover and respond to abnormal activities and security threats, and improve the security and reliability of the system;

[0052] The security mechanism provided by the microservice architecture ensures the security of each microservice and prevents malicious attacks and data leakage;

[0053] When cloud computing becomes inevitable, security is bound to follow closely. Cloud applications urgently need diversified, comprehensive, intensive and easily scalable cryptographic services. The cloud cryptographic service management system can be widely used in party and government, finance, industry and other scenarios to build a cryptographic cloud application service infrastructure, provide identity authentication, access control, data confidentiality protection, data integrity protection, program trust security, communication data protection and other functions, and support cloud platforms, cloud applications and other information systems to meet the requirements of commercial cryptographic application security assessment.

[0054] The security and availability of the cloud cryptographic service management system are the core keys to ensuring the effectiveness of cryptographic resources. Based on the high-performance computing, trusted computing and cryptographic acceleration capabilities of the PKS system, it innovatively integrates the commercial cryptographic technology system; based on the trusted execution environment, it realizes the trusted startup of basic cryptographic equipment and cloud cryptographic service management system to resist software and hardware tampering attacks; based on the cryptographic acceleration engine, it improves the performance of various cryptographic operations of basic cryptographic equipment; based on high-performance computing, it realizes the cryptographic microservice architecture, realizes flexible calling, dynamic scaling and efficient management of cryptographic services; based on hyper-converged defense technology, it supports the cloud cryptographic service management system and basic cryptographic equipment to resist network attacks, and improves security and availability; it can fully meet the multi-level, multi-scenario, high-security and high-efficiency cryptographic needs of cloud application cryptography.

[0055] The cloud cryptographic service management system is the first innovative solution and cryptographic product in the commercial cryptography field that is truly intrinsically integrated into the PKS system. It has achieved innovative applications in national cryptographic reforms, innovation projects, and model tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0057] Figure 1 A schematic diagram of the overall architecture of an intrinsically secure cloud cryptographic service management system provided in Embodiment 1 of the present invention;

[0058] Figure 2 A schematic diagram of the overall operation steps of an intrinsically secure cloud cryptographic service management method provided in Embodiment 2 of the present invention;

[0059] Figure 3 A schematic diagram of the operation steps for establishing a trusted cryptographic resource pool in a method for managing an intrinsically secure cloud cryptographic service provided in Embodiment 2 of the present invention;

[0060] Figure 4 A schematic diagram of the operation steps of providing security protection to an intrinsically secure cloud cryptographic service management system in a method for managing an intrinsically secure cloud cryptographic service provided in Embodiment 2 of the present invention;

[0061] Figure 5 A schematic diagram of the operational steps for obtaining audit results of an intrinsically secure cloud cryptographic service management method provided in Example 2 of the present invention.

[0062] Figure numerals: API gateway and platform portal 10; cryptographic service management module 20; monitoring and analysis module 30; security protection module 40; trusted cryptographic resource pool establishment module 50. DETAILED DESCRIPTION

[0063] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] The present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0065] Embodiment 1

[0066] like Figure 1 As shown, the present invention proposes an endogenous secure cloud cryptographic service management system, including an API gateway and platform portal 10, a cryptographic service management module 20, a monitoring and analysis module 30, and a security protection module 40;

[0067] Wherein, the API gateway and platform portal 10 are used to obtain the current service request;

[0068] The cryptographic service management module 20 is used to perform cryptographic service management operations through the PKS system based on the trusted cryptographic resource pool according to the service request;

[0069] The cryptographic service management operations include key generation operations, key storage operations, and key distribution operations;

[0070] The monitoring and analysis module 30 is used to monitor and analyze the cryptographic service management operation to obtain analysis results;

[0071] The analysis results represent the activity data and security data in the current cryptographic service management operation process;

[0072] The security protection module 40 is used to send the analysis result to the host and provide security protection to the endogenous security cloud cryptographic service management system.

[0073] The security protection adopts hyper-converged defense technology and audit technology.

[0074] Preferably, the system further comprises a trusted cryptographic resource pool establishing module 50;

[0075] The trusted cryptographic resource pool establishing module 50 is used to establish a trusted cryptographic resource pool;

[0076] The trusted cryptographic resource pool is a list representing the mapping relationship between the electronic certificate server ID, the key management server ID, the signature server ID, the security authentication gateway ID, the server cryptographic machine ID and the timestamp server ID;

[0077] The trusted cryptographic resource pool establishment module 50 is specifically used to obtain the electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID of the cloud cryptographic service management system corresponding to the current service request;

[0078] The electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID are mapped based on network topology to obtain a trusted cryptographic resource pool;

[0079] Preferably, the security protection module 40 is specifically used to audit the analysis result to obtain an audit result;

[0080] Based on the audit results, security protection is provided through hyper-converged defense.

[0081] Preferably, the security protection module 40 is used to determine the audit type according to the data characteristics of the analysis result during the specific implementation process;

[0082] Based on the audit type, the audit result is obtained by comparing the preset expected analysis result with the analysis result.

[0083] The expected analysis results are sample activity data and sample security data under different conditions of the initially preset cryptographic service management operation;

[0084] In summary, the above-mentioned intrinsically secure cloud cryptographic service management system provided by the present invention focuses on the requirements of trusted calling of cryptographic services, improved cryptographic processing performance, trusted operation of cryptographic devices, and trusted security against network attacks. By combining API gateways and platform portals, cryptographic service management modules, monitoring and analysis modules, and security protection modules, and innovatively based on the trusted computing capabilities and cryptographic acceleration processing capabilities of the PKS system, high-security and high-efficiency commercial cryptographic devices are developed to build a cloud cryptographic service management system, so as to provide high-efficiency full-stack cryptographic services for cloud applications on the basis of intrinsic security and risk immunity.

[0085] By adopting the cryptographic microservice architecture and integrating the high-speed processing capabilities of CPU multi-cores, high-speed invocation of cryptographic resources and efficient management of cryptographic services can be achieved;

[0086] Based on the cryptographic acceleration engine SCTO, the security of AKSK signature verification in the cloud cryptographic service management system service call is guaranteed, and the cryptographic operation performance of cryptographic devices is improved;

[0087] Based on the trusted computing capability of PKS, the whole process of starting, loading, executing, calling and managing cloud cryptographic service management system and various cryptographic devices can be trusted.

[0088] It uses hyper-converged defense and auditing technology to defend against more than 10 types of network attacks such as brute force cracking, detection scanning, Trojans and viruses, and designs risky behaviors.

[0089] Embodiment 2

[0090] like Figure 2 As shown, accordingly, the present invention also proposes a method for managing an intrinsically secure cloud cryptographic service, comprising the following steps:

[0091] Step S10: Obtain the current service request;

[0092] It should be noted that in the above-mentioned embodiment of the present application, the current service request is obtained through the API gateway and the platform portal; the above-mentioned API gateway and the platform portal provide a unified entry and management interface, including reverse proxy, attack protection, access control, and service routing forwarding functions to ensure secure external access and effective traffic management;

[0093] Step S20: performing cryptographic service management operations through the PKS system according to the service request based on the trusted cryptographic resource pool;

[0094] The cryptographic service management operations include key generation operations, key storage operations, and key distribution operations;

[0095] It should be noted that the above-mentioned embodiment of the present application dynamically schedules cryptographic resources according to service requests, including encryption, decryption, signature and other services, to ensure efficient resource utilization and response speed;

[0096] The above-mentioned PKS system is a micro-cryptographic service architecture, which has the ability to accelerate commercial cryptographic algorithms and realize the advantages of trusted protection of cryptographic devices throughout the entire life cycle. At the same time, the above-mentioned PKS system adopts a cryptographic microservice + front-end and back-end separation architecture, and is built based on cloud-native technology, which can seamlessly connect to the cloud computing platform.

[0097] Step S30: monitoring and analyzing the cryptographic service management operation to obtain analysis results;

[0098] The analysis results represent the activity data and security data in the current cryptographic service management operation process;

[0099] It should be noted that the above embodiments of the present application implement real-time monitoring and analysis to quickly discover and respond to abnormal activities and security threats, thereby improving the security and reliability of the system;

[0100] Step S40: Send the analysis result to the host and provide security protection to the endogenous security cloud cryptographic service management system.

[0101] The security protection adopts hyper-converged defense technology and audit technology;

[0102] It should be noted that the above embodiments of the present application use a security mechanism provided by a microservice architecture to ensure the security of each microservice and prevent malicious attacks and data leakage;

[0103] The above hosts include software and hardware resources such as CPU, Kylin OS, and database. Based on the high performance of CPU multi-core, dynamic cryptographic resource scheduling can be performed according to business conditions to provide real-time, elastic, and scalable cryptographic services, and can achieve fine-grained on-demand adjustment and efficient management of cryptographic processing capabilities.

[0104] The above security protection defends against more than 10 types of network attacks such as brute force cracking, detection scanning, Trojans and viruses, and designs risky behaviors to improve password security.

[0105] It should be noted that the above embodiments of the present application focus on the needs of trusted calling of cryptographic services, improved cryptographic processing performance, trusted operation of cryptographic devices, and trusted security against network attacks. Based on the trusted computing capabilities and cryptographic acceleration processing capabilities of the PKS system, high-security and high-performance commercial cryptographic devices are developed to build a cloud cryptographic service management system, so as to provide high-performance full-stack cryptographic services for cloud applications on the basis of inherent security and risk immunity.

[0106] Obtain current service requests through the API gateway and platform portal; the API gateway and platform portal ensure secure external access and effective traffic management;

[0107] The micro-cryptographic service architecture based on the PKS system dynamically dispatches cryptographic resources according to service requests, including encryption, decryption, signature and other services, to ensure efficient resource utilization and response speed;

[0108] Through real-time monitoring and analysis, we can quickly discover and respond to abnormal activities and security threats, and improve the security and reliability of the system;

[0109] The security mechanism provided by the microservice architecture ensures the security of each microservice and prevents malicious attacks and data leakage.

[0110] Specifically, before step S20, it also includes establishing a trusted cryptographic resource pool;

[0111] The trusted cryptographic resource pool is a list representing the mapping relationship between the electronic certificate server ID, the key management server ID, the signature server ID, the security authentication gateway ID, the server cryptographic machine ID and the timestamp server ID.

[0112] Specifically, Figure 3 As shown, the establishment of a trusted password resource pool includes the following steps:

[0113] Get the electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID of the cloud cryptographic service management system corresponding to the current service request;

[0114] The electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID are mapped based on network topology to obtain a trusted cryptographic resource pool;

[0115] The above-mentioned network topology-based approach is because in the same cloud cryptographic service management system, each server has a specific network topology. By establishing a mapping relationship between each server ID based on the network topology, the physical or logical connection relationship between servers can be fully considered to more effectively process the routing of data or requests;

[0116] Specific description: In a cloud cryptographic service management system, servers may be deployed in different physical locations or logical clusters. There are specific physical or logical connection relationships between these locations and clusters. For example, servers may be connected together in a star, ring, tree or mesh topology. This topology can affect the transmission path and efficiency of data or requests; by establishing a mapping relationship between server IDs, the system can determine which server each request should be sent to for processing; considering the physical or logical connection relationship between servers, the best server can be selected more effectively to reduce latency, optimize data transmission paths, and even improve system reliability and availability.

[0117] Specifically, Figure 4 As shown, in step S40, providing security protection to the endogenous security cloud cryptographic service management system includes the following steps:

[0118] Step S41: auditing the analysis result to obtain an audit result;

[0119] Step S42: Perform security protection through hyper-converged defense based on the audit results.

[0120] It should be noted that the above embodiments of the present application can reveal any possible data processing errors, security or other abnormal situations by conducting detailed inspections and verifications on the above analysis results to ensure their accuracy and completeness; through auditing, the reliability of the system and the accuracy of data processing can be improved, providing a reliable basis for further decision-making. This helps to identify potential security threats or errors and make corrections and improvements in a timely manner;

[0121] The above-mentioned hyper-converged defense is a comprehensive security strategy that usually combines multiple security technologies (such as firewalls, intrusion detection systems, anti-virus software, etc.) to deal with diverse threats. Through hyper-converged defense, appropriate security measures can be quickly deployed based on the threats found in the audit results, including automated response, real-time monitoring, threat intelligence sharing and other functions to improve the detection rate and response speed of security incidents.

[0122] Hyper-converged defense can adjust and strengthen security measures based on security threats or anomalies found in audit results. Audit results provide a detailed inspection and verification of the system security status, ensuring the accuracy and integrity of data processing, while revealing possible errors or; this information is the basis for deploying hyper-converged defense so that the system can respond to actual security challenges more accurately;

[0123] Based on the audit results, hyper-converged defense can automatically deploy appropriate security measures, such as blocking attack sources, updating security policies, adjusting permissions, etc. This automated response can greatly improve the detection rate and response speed of security incidents and reduce delays or errors caused by human intervention;

[0124] The accuracy and completeness of data and analysis results are ensured through auditing, and potential security threats are quickly responded to and prevented through hyper-converged defense technology, thereby improving the overall security and stability of the system.

[0125] Specifically, Figure 5 As shown, in step S41, the analysis result is audited to obtain an audit result, including the following steps:

[0126] Step S411: Determine the audit type according to the data characteristics of the analysis result;

[0127] Step S412: Based on the audit type, a preset expected analysis result is compared with the analysis result to obtain an audit result.

[0128] The expected analysis results are sample activity data and sample security data (usually obtained through experience) of the initially preset cryptographic service management operations under different conditions;

[0129] It should be noted that the above-mentioned embodiment of the present application identifies potential security issues by analyzing data features in password service management operations, such as the frequency of password reset requests, the mode of password modification, abnormal password operations, etc. By analyzing the data features, the security risks or abnormal operations in the password service management can be accurately located; determining the audit type based on the data features helps to quickly respond to security incidents or problems and reduce potential security risks; assuming that the password service management system of the current server encounters security issues, such as user accounts frequently encounter unauthorized password reset requests, based on the analysis of data features, we found the following problems: the data shows that several accounts have experienced multiple password reset requests in a short period of time, and these requests have no successful login records or other reasonable explanations; based on these data features, we determine the audit type as "abnormal password reset operation audit";

[0130] By comparing the preset expected analysis results with the actual analysis results, abnormal activities or potential security incidents, such as forgotten passwords, malicious access or internal threat behaviors, can be effectively detected. Based on the audit results obtained by comparative analysis, appropriate measures can be taken to enhance the security and compliance of password services, such as improving password policies, encryption standards and security audit processes. Continuing with the above example, by comparing the preset sample activity data and security data, when the sample data shows that under normal circumstances, password reset requests should match the activity pattern of the user account, such as in a few cases after forgetting the password, the actual data shows that some accounts have suffered frequent and unauthorized password reset requests, which is inconsistent with the analysis results of the normal pattern. By analyzing the data characteristics, the security issues in password service management, namely frequent unauthorized password reset requests, are accurately located. By comparing the expected and actual results, abnormal activities, namely unauthorized password reset requests, are effectively detected, which may indicate that the account has been attacked or has internal security issues. Based on the audit results obtained by comparative analysis, we can quickly take measures, such as temporarily disabling the password reset function of the affected account, and further investigate the root cause of the security incident.

[0131] In summary, the example of the present invention proposes an endogenous secure cloud cryptographic service management system and method, which obtains the current service request through the API gateway and the platform portal; the API gateway and the platform portal ensure secure external access and effective traffic management;

[0132] The micro-cryptographic service architecture based on the PKS system dynamically dispatches cryptographic resources according to service requests, including encryption, decryption, signature and other services, to ensure efficient resource utilization and response speed;

[0133] Through real-time monitoring and analysis, we can quickly discover and respond to abnormal activities and security threats, and improve the security and reliability of the system;

[0134] The security mechanism provided by the microservice architecture ensures the security of each microservice and prevents malicious attacks and data leakage;

[0135] When cloud computing becomes inevitable, security is bound to follow closely. Cloud applications urgently need diversified, comprehensive, intensive and easily scalable cryptographic services. The cloud cryptographic service management system can be widely used in party and government, finance, industry and other scenarios to build a cryptographic cloud application service infrastructure, provide identity authentication, access control, data confidentiality protection, data integrity protection, program trust security, communication data protection and other functions, and support cloud platforms, cloud applications and other information systems to meet the requirements of commercial cryptographic application security assessment.

[0136] The security and availability of the cloud cryptographic service management system are the core keys to ensuring the effectiveness of cryptographic resources. Based on the high-performance computing, trusted computing and cryptographic acceleration capabilities of the PKS system, it innovatively integrates the commercial cryptographic technology system; based on the trusted execution environment, it realizes the trusted startup of basic cryptographic devices and cloud cryptographic service management systems to resist software and hardware tampering attacks; based on the cryptographic acceleration engine, it improves the performance of various cryptographic operations of basic cryptographic devices, independently implements the AKSK signature verification function of cryptographic service calls, and improves the security of cryptographic service calls; based on high-performance computing, it realizes the cryptographic microservice architecture, realizes flexible calling, dynamic scaling and efficient management of cryptographic services; based on hyper-converged defense technology, it supports the cloud cryptographic service management system and basic cryptographic devices to resist network attacks, and improves security and availability; it can fully meet the multi-level, multi-scenario, high-security and high-efficiency cryptographic needs of cloud application passwords.

[0137] The Cloud Cryptography Service Management System is the first innovative solution and cryptography product in the commercial cryptography field that is truly endogenously integrated into the PKS system, and has achieved innovative applications in national cryptography reforms, innovative projects, and model tasks;

[0138] Furthermore, by conducting detailed inspections and verifications on the analysis results to ensure their accuracy and completeness, any possible data processing errors, security or other abnormalities can be revealed; through auditing, the reliability of the system and the accuracy of data processing can be improved, providing a reliable basis for further decision-making, identifying potential security threats or errors, and making corrections and improvements in a timely manner; through hyper-converged defense, a variety of security technologies (such as firewalls, intrusion detection systems, anti-virus software, etc.) can be combined to respond to diverse threats; through hyper-converged defense, according to the threats or discovered in the audit results, appropriate security measures can be quickly deployed, including automated response, real-time monitoring, threat intelligence sharing and other functions, to improve the detection rate and response speed of security incidents;

[0139] Ensure the accuracy and completeness of data and analysis results through auditing, and quickly respond to and prevent potential security threats through hyper-converged defense technology, thereby improving the overall security and stability of the system;

[0140] Furthermore, by determining the specific audit type based on the data characteristics of the analysis results, the audit will be classified and analyzed according to the nature and key characteristics of the data, so as to more accurately locate problems or potential risks. Through accurate audit type determination, unnecessary waste in the audit process can be avoided, and focus can be placed on key data characteristics to improve the efficiency and accuracy of the audit. Further, by comparing the preset expected analysis results with the actual analysis results, potential deviations, errors or anomalies in the analysis process can be identified. By comparing the actual results with the expected results, possible problems in the data processing or analysis process can be discovered, such as data loss, error processing, model deviation, etc. The audit results obtained through comparative analysis can enhance their credibility and persuasiveness.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. A person skilled in the art may modify the technical solutions described in the above embodiments, or replace part or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intrinsically secure cloud cryptographic service management system, characterized in that: Includes API gateway and platform portal, password service management module, monitoring and analysis module, and security protection module; Wherein, the API gateway and platform portal are used to obtain the current service request; The cryptographic service management module is used to perform cryptographic service management operations through the PKS system based on the trusted cryptographic resource pool according to the service request; The cryptographic service management operations include key generation operations, key storage operations, and key distribution operations; The monitoring and analysis module is used to monitor and analyze the cryptographic service management operation to obtain analysis results; The analysis results represent the activity data and security data in the current cryptographic service management operation process; The security protection module is used to send the analysis results to the host and provide security protection to the endogenous security cloud cryptographic service management system.

2. According to claim 1, an intrinsically secure cloud cryptographic service management system is characterized in that: The system further comprises a trusted cryptographic resource pool establishing module 50; The trusted cryptographic resource pool establishing module 50 is used to establish a trusted cryptographic resource pool; The trusted cryptographic resource pool is a list representing the mapping relationship between the electronic certificate server ID, the key management server ID, the signature server ID, the security authentication gateway ID, the server cryptographic machine ID and the timestamp server ID.

3. A method for managing an intrinsically secure cloud cryptographic service, characterized in that: The steps are as follows: Get the current service request; Execute cryptographic service management operations through the PKS system based on the service request based on the trusted cryptographic resource pool; The cryptographic service management operations include key generation operations, key storage operations, and key distribution operations; Monitoring and analyzing the cryptographic service management operation to obtain analysis results; Based on the analysis results, the analysis results are sent to the host and provide security protection to the endogenous security cloud cryptographic service management system; The security protection adopts hyper-converged defense technology and audit technology.

4. A method for managing an intrinsically secure cloud cryptographic service according to claim 3, characterized in that: The analysis results represent the active data and security data during the current cryptographic service management operation.

5. A method for managing an intrinsically secure cloud cryptographic service according to claim 4, characterized in that: The method for managing an intrinsically secure cloud cryptographic service also includes establishing a trusted cryptographic resource pool.

6. A method for managing an intrinsically secure cloud cryptographic service according to claim 5, characterized in that: The trusted cryptographic resource pool is a list representing the mapping relationship between the electronic certificate server ID, the key management server ID, the signature server ID, the security authentication gateway ID, the server cryptographic machine ID and the timestamp server ID.

7. A method for managing an intrinsically secure cloud cryptographic service according to claim 6, characterized in that: The step of establishing a trusted password resource pool includes the following steps: Get the electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID of the cloud cryptographic service management system corresponding to the current service request; The electronic certificate server ID, key management server ID, signature server ID, security authentication gateway ID, server cryptographic machine ID and timestamp server ID are mapped based on network topology to obtain a trusted cryptographic resource pool.

8. A method for managing an intrinsically secure cloud cryptographic service according to claim 7, characterized in that: Providing security protection to the endogenous secure cloud cryptographic service management system includes the following steps: Auditing the analysis results to obtain audit results; Based on the audit results, security protection is provided through hyper-converged defense.

9. A method for managing an intrinsically secure cloud cryptographic service according to claim 8, characterized in that: The step of auditing the analysis result to obtain the audit result includes the following steps: Determining an audit type based on data characteristics of the analysis results; Based on the audit type, the audit result is obtained by comparing the preset expected analysis result with the analysis result. The expected analysis results are sample activity data and sample security data under different conditions of the initially preset cryptographic service management operations.

Images