Password service management platform and method

Abstract

The invention provides a password service management platform and method, and the platform comprises an access module which is used for enabling an encryption service system to be accessed to a target terminal, and reading the to-be-managed data information of the encryption service system based on the target terminal; the password service management module is used for analyzing the to-be-managed data information and performing password service management according to an analysis result; and the exception monitoring module is used for monitoring background operation data of the target terminal in real time, generating an exception handling mechanism when a background operation fault exists, and performing exception handling on the background operation fault according to the exception handling mechanism. According to the method, safe, efficient and convenient password management service can be provided, the working efficiency and the satisfaction degree of employees can be improved, and meanwhile, the safety and the credibility of services of all mechanisms are enhanced.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a cryptographic service management platform and method. Background Art

[0002] The cryptographic service management platform is an integrated cryptographic service, management, and situational awareness platform. By calling various cryptographic resources supported by the underlying layer, it provides unified, complete, and scalable cryptographic services such as authenticity, confidentiality, integrity, and non-repudiation for upper-layer cryptographic applications.

[0003] However, the current cryptographic service management cannot parse data information in time, which leads to a lag in the cryptographic service management of data, thus reducing management efficiency. When there is a failure in the background, it cannot be replaced in time, so the continuity of business cannot be guaranteed.

[0004] Therefore, the present invention provides a cryptographic service management platform and method. Summary of the invention

[0005] The present invention provides a cryptographic service management platform and method, which can ensure the effectiveness of encryption management of the cryptographic service system by connecting the cryptographic service system to the target terminal. At the same time, by parsing the data information to be managed, the cryptographic service management of the data information to be managed can be effectively realized, thereby improving the efficiency and accuracy of management. When there is a background operation failure, the continuity of the business can be effectively guaranteed based on the exception handling mechanism. Therefore, the present invention can not only provide safe, efficient and convenient cryptographic management services, but also improve the work efficiency and satisfaction of employees, while enhancing the security and credibility of the services of various institutions.

[0006] A cryptographic service management platform, comprising:

[0007] An access module is used to connect the encryption service system to the target terminal and read the data information to be managed of the encryption service system based on the target terminal;

[0008] The password service management module is used to analyze the data information to be managed and perform password service management according to the analysis results;

[0009] The exception monitoring module is used to monitor the background operation data of the target terminal in real time, and when there is a background operation failure, generate an exception handling mechanism, and perform exception handling on the background operation failure according to the exception handling mechanism.

[0010] Preferably, a cryptographic service management platform, access module, comprises:

[0011] The demand acquisition unit is used to obtain the enterprise's cryptographic service management requirements, analyze the enterprise's cryptographic service management requirements, and determine the enterprise's encryption business system;

[0012] An access audit unit is used to perform a security audit on the encryption business system based on the target terminal, and when the encryption business system passes the security audit, the encryption business system is connected to the target terminal;

[0013] The data reading unit is used to read the data information to be managed of the encryption business system based on the target terminal.

[0014] Preferably, a cryptographic service management platform, a demand acquisition unit, comprises:

[0015] The requirement analysis subunit is used to read the enterprise password service management requirements and determine the requirement keywords of the enterprise password service management requirements;

[0016] The sub-unit is used to divide the enterprise password service management requirements according to the requirement keywords to obtain multiple sub-requirement segments;

[0017] A management target determination subunit is used to obtain the semantic vector corresponding to each sub-demand segment, and determine each sub-demand segment for integration according to the semantic vector corresponding to each sub-demand segment and the corresponding demand keyword to obtain the enterprise cryptographic service management demand management target;

[0018] The encryption business system determination subunit is used to determine the encryption business system of the enterprise in the target enterprise according to the management objectives.

[0019] Preferably, a cryptographic service management platform, access audit unit, comprises:

[0020] A dimension determination subunit, used to obtain audit dimensions for security audit of the encryption business system;

[0021] The audit condition acquisition subunit is used to obtain the audit conditions corresponding to each audit dimension. At the same time, it retrieves the data set to be audited corresponding to the encryption business system and obtains the audit type of the data set to be audited.

[0022] A matching subunit is used to match the audit type with the audit dimension, and divide the to-be-audited data set into sub-audit data sets corresponding to each audit dimension according to the matching result;

[0023] Audit subunit, which is used to:

[0024] Perform data audit on the sub-audit data set according to the audit conditions corresponding to the current audit dimension, and output the audit score corresponding to the current audit dimension according to the audit results;

[0025] Obtain the audit weight corresponding to each audit dimension, and calculate the total audit score for the encryption business system based on the audit weight;

[0026] Obtain the pass threshold, and compare the total audit score with the pass threshold to determine whether the encryption business system has passed the access audit;

[0027] If the total audit score is less than or equal to the pass threshold, the encryption business system is judged to have failed the access audit;

[0028] Otherwise, it is determined that the encryption service system has passed the access review.

[0029] Preferably, a cryptographic service management platform, a cryptographic service management module, comprises:

[0030] A parsing unit, used to parse the data information to be managed and determine the information type of the data information to be managed, wherein the information type includes: business information type of cryptographic service management and user information type;

[0031] The management unit is used to manage the management data corresponding to the data information to be managed based on the business information type and user information type managed by the cryptographic service, including: user authority management, data level management, and data encryption management.

[0032] Preferably, a cryptographic service management platform, management unit, includes:

[0033] A data acquisition subunit is used to acquire a first management data set from the data information to be managed according to the business information type of the cryptographic service management, and to acquire a second management data set from the data information to be managed according to the user information type.

[0034] The first division subunit is configured to:

[0035] Obtain the importance level of data in the encryption business system, and determine the data range corresponding to each data level according to the importance level of the data;

[0036] Performing a first division on the first management data set according to a data range corresponding to each data level to obtain a plurality of third management data sets;

[0037] Retrieving a corresponding encryption policy according to the data level, and encrypting each third management data set based on the encryption policy;

[0038] The second division subunit is used for:

[0039] Obtain data reading permissions for users in the encryption business system;

[0040] Firstly associate the data reading permission with the importance level of the data in the encryption business system to obtain the user permission range corresponding to each data level;

[0041] Performing a second division on the second management data set according to the user authority range to obtain a plurality of fourth management data sets;

[0042] Management subunit, used to:

[0043] Performing a second association between the third management data set and the fourth management data set to obtain authorized user information corresponding to each third management data set;

[0044] The authorized user information is bound to the key encrypted by the third management data set to complete the allocation management of user rights.

[0045] Preferably, a cryptographic service management platform, an anomaly monitoring module, comprises:

[0046] A monitoring unit, used to monitor the background operation data of the target terminal in real time;

[0047] The mechanism generation unit is used to match the benchmark operation data with the background operation data, determine whether there is an operation fault in the background, and locate the fault point when the background operation fails, and generate an exception handling mechanism according to the fault point;

[0048] The fault handling unit is used to handle background operation faults according to the exception handling mechanism.

[0049] Preferably, a cryptographic service management platform, a fault audit unit, comprises:

[0050] Matching subunits for:

[0051] Match the benchmark operation data with the background operation data to determine whether there is any operation failure in the background;

[0052] If there is target data where the background operation data is inconsistent with the benchmark operation data, it is determined that there is an operation failure in the background;

[0053] If the background operation data is consistent with the benchmark operation data, it is determined that there is no operation failure in the background;

[0054] The fault point determination subunit is used to:

[0055] When there is an operating failure in the background, based on locating the target data in the benchmark operating data, benchmark target data matching the target data is obtained;

[0056] Determine the corresponding fault point during background operation based on the benchmark target data;

[0057] The mechanism generation subunit is used to read the target information corresponding to the fault point, match the replaceable point corresponding to the fault point in the preset background operation management library according to the target information, and generate an exception handling mechanism according to the replaceable point.

[0058] Preferably, a cryptographic service management platform, a cryptographic service management module, comprises:

[0059] An extension management unit, used to generate a horizontal encryption service extension instruction at a target terminal when performing cryptographic service management and when the cryptographic service management needs to be extended, and to extend the horizontal cryptographic service management at the target terminal according to the horizontal encryption service extension instruction;

[0060] The transmission storage unit encrypts the data information to be managed, generates an encrypted data packet, and transmits the encrypted data packet to the target terminal to complete the encrypted transmission management of the data information to be managed when the data information to be managed in the encryption business system is transmitted to the target terminal.

[0061] A cryptographic service management method, comprising:

[0062] Step 1: Connect the encryption business system to the target terminal, and read the data information to be managed of the encryption business system based on the target terminal;

[0063] Step 2: Analyze the data information to be managed, and manage the password service according to the analysis results;

[0064] Step 3: Monitor the background operation data of the target terminal in real time, and when there is a background operation failure, generate an exception handling mechanism, and perform exception handling on the background operation failure according to the exception handling mechanism.

[0065] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures specifically pointed out in this application document.

[0066] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0068] Figure 1 This is a structural diagram of a cryptographic service management platform in an embodiment of the present invention;

[0069] Figure 2This is a structural diagram of an access module in a cryptographic service management platform in an embodiment of the present invention;

[0070] Figure 3 The present invention is a flowchart of a cryptographic service management method in an embodiment of the present invention. DETAILED DESCRIPTION

[0071] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0072] Embodiment 1:

[0073] This embodiment provides a cryptographic service management platform, such as Figure 1 As shown, including:

[0074] An access module is used to connect the encryption service system to the target terminal and read the data information to be managed of the encryption service system based on the target terminal;

[0075] The password service management module is used to analyze the data information to be managed and perform password service management according to the analysis results;

[0076] The exception monitoring module is used to monitor the background operation data of the target terminal in real time, and when there is a background operation failure, generate an exception handling mechanism, and perform exception handling on the background operation failure according to the exception handling mechanism.

[0077] In this embodiment, the encryption business system can be a system that needs to perform encryption business processing when there is a need to protect the massive amount of data in corporate organizations, financial institutions and government agencies.

[0078] In this embodiment, the target terminal is a terminal that can implement cryptographic service management.

[0079] In this embodiment, the data information to be managed may include: business data requiring cryptographic service management and user information data.

[0080] In this embodiment, the data information to be managed is parsed, and cryptographic service management is performed based on the parsing results, including: user authority management, cryptographic service management of data (including data polymorphic key storage, sensitive data encrypted transmission and storage), and management of horizontally expanded cryptographic application services and cryptographic hardware devices.

[0081] In this embodiment, the exception handling mechanism may be to implement automatic switching processing of the part corresponding to the background operation failure.

[0082] The working principle and beneficial effects of the above technical solution are: by connecting the encryption business system to the target terminal, the effectiveness of encryption management of the encryption business system can be guaranteed. At the same time, by parsing the data information to be managed, the cryptographic service management of the data information to be managed can be effectively realized, thereby improving the efficiency and accuracy of management. When there is a background operation failure, the continuity of the business can be effectively guaranteed based on the exception handling mechanism. Therefore, the present invention can not only provide safe, efficient and convenient password management services, but also improve the work efficiency and satisfaction of employees, while enhancing the security and credibility of the services of various institutions.

[0083] Embodiment 2:

[0084] Based on Example 1, this example provides a cryptographic service management platform, such as Figure 2 As shown, the access module includes:

[0085] The demand acquisition unit is used to obtain the enterprise's cryptographic service management requirements, analyze the enterprise's cryptographic service management requirements, and determine the enterprise's encryption business system;

[0086] An access audit unit is used to perform a security audit on the encryption business system based on the target terminal, and when the encryption business system passes the security audit, the encryption business system is connected to the target terminal;

[0087] The data reading unit is used to read the data information to be managed of the encryption business system based on the target terminal.

[0088] In this embodiment, the enterprise cryptographic service management requirements may be obtained by uploading in advance according to management requirements.

[0089] The working principle and beneficial effects of the above technical solution are: by reading the enterprise's cryptographic service management requirements, the encryption business system can be effectively acquired, and a security audit of the encryption business system can be conducted to ensure the effectiveness and security of the reading of management information data and the access to the encryption business system.

[0090] Embodiment 3:

[0091] Based on Example 2, this embodiment provides a cryptographic service management platform, a demand acquisition unit, including:

[0092] The requirement analysis subunit is used to read the enterprise password service management requirements and determine the requirement keywords of the enterprise password service management requirements;

[0093] The sub-unit is used to divide the enterprise password service management requirements according to the requirement keywords to obtain multiple sub-requirement segments;

[0094] A management target determination subunit is used to obtain the semantic vector corresponding to each sub-demand segment, and determine each sub-demand segment for integration according to the semantic vector corresponding to each sub-demand segment and the corresponding demand keyword to obtain the enterprise cryptographic service management demand management target;

[0095] The encryption business system determination subunit is used to determine the encryption business system of the enterprise in the target enterprise according to the management objectives.

[0096] In this embodiment, the demand keyword may be a key word representing the enterprise's cryptographic service management demand.

[0097] In this embodiment, the semantic vector corresponding to the sub-demand segment may be semantic information used to describe the sub-demand segment.

[0098] In this embodiment, the enterprise cryptographic service management requirement management target is the final management state.

[0099] The working principle and beneficial effects of the above technical solution are: by reading the enterprise's cryptographic service management requirements, the demand keywords are effectively obtained, and by dividing the enterprise's cryptographic service management requirements according to the demand keywords, multiple sub-demand segments are obtained. By determining the semantic vector corresponding to each sub-demand segment, the management objectives of the enterprise's cryptographic service management requirements can be effectively obtained, and then the encryption business system in the target enterprise is determined according to the management objectives, effectively ensuring the accuracy and effectiveness of access to the encryption business system.

[0100] Embodiment 4:

[0101] Based on Example 2, this embodiment provides a cryptographic service management platform, an access audit unit, including:

[0102] A dimension determination subunit, used to obtain audit dimensions for security audit of the encryption business system;

[0103] The audit condition acquisition subunit is used to obtain the audit conditions corresponding to each audit dimension. At the same time, it retrieves the data set to be audited corresponding to the encryption business system and obtains the audit type of the data set to be audited.

[0104] A matching subunit is used to match the audit type with the audit dimension, and divide the to-be-audited data set into sub-audit data sets corresponding to each audit dimension according to the matching result;

[0105] Audit subunit, which is used to:

[0106] Perform data audit on the sub-audit data set according to the audit conditions corresponding to the current audit dimension, and output the audit score corresponding to the current audit dimension according to the audit results;

[0107] Obtain the audit weight corresponding to each audit dimension, and calculate the total audit score for the encryption business system based on the audit weight;

[0108] Obtain the pass threshold, and compare the total audit score with the pass threshold to determine whether the encryption business system has passed the access audit;

[0109] If the total audit score is less than or equal to the pass threshold, the encryption business system is judged to have failed the access audit;

[0110] Otherwise, it is determined that the encryption service system has passed the access review.

[0111] In this embodiment, the audit dimensions may include: identity authentication, qualification review (such as industry qualification), reputation assessment, association review (such as partner), etc.

[0112] In this embodiment, the review conditions may be set in advance.

[0113] In this embodiment, the audit type is the audit category of the data set to be audited, which corresponds to the audit dimension.

[0114] In this embodiment, the pass limit threshold may be a standard set in advance and used to determine whether the encryption service system has passed the access review.

[0115] The working principle and beneficial effects of the above technical solution are: by obtaining the audit dimensions for security audit of the encryption business system, the audit conditions corresponding to each audit dimension are obtained, and then the data set to be audited corresponding to the encryption business system is effectively retrieved, and the audit type of the data set to be audited is obtained, by matching the audit type with the audit dimension, and dividing the data set to be audited into sub-audit data sets corresponding to each audit dimension according to the matching result, the sub-audit data sets are audited according to the audit conditions corresponding to the current audit dimension, and the audit score corresponding to the current audit dimension is output according to the audit result; the audit weight corresponding to each audit dimension is obtained, so as to improve the accuracy and objectivity of calculating the total audit score of the encryption business system; the passing limit threshold is obtained, and the total audit score is compared with the passing limit threshold to determine whether the encryption business system has passed the access audit; if the total audit score is less than or equal to the passing limit threshold, it is determined that the encryption business system has not passed the access audit; otherwise, it is determined that the encryption business system has passed the access audit, which effectively improves the accuracy of the audit, thereby ensuring the effectiveness, accuracy and security of the access of the encryption business system.

[0116] Embodiment 5:

[0117] Based on Example 1, this embodiment provides a cryptographic service management platform, a cryptographic service management module, including:

[0118] A parsing unit, used to parse the data information to be managed and determine the information type of the data information to be managed, wherein the information type includes: business information type of cryptographic service management and user information type;

[0119] The management unit is used to manage the management data corresponding to the data information to be managed based on the business information type and user information type managed by the cryptographic service, including: user authority management, data level management, and data encryption management.

[0120] In this embodiment, the information type includes: business information type of cryptographic service management and user information type.

[0121] In this embodiment, management includes: user authority management, data level management, and data encryption management.

[0122] The working principle and beneficial effects of the above technical solution are: to parse the data information to be managed, determine the information type of the data information to be managed, manage the management data corresponding to the data information to be managed based on the business information type and user information type of the cryptographic service management, thereby improving the comprehensiveness, effectiveness and security of data management in the encryption business system.

[0123] Embodiment 6:

[0124] Based on Example 5, this embodiment provides a cryptographic service management platform, a management unit, including:

[0125] A data acquisition subunit is used to acquire a first management data set from the data information to be managed according to the business information type of the cryptographic service management, and to acquire a second management data set from the data information to be managed according to the user information type.

[0126] The first division subunit is configured to:

[0127] Obtain the importance level of data in the encryption business system, and determine the data range corresponding to each data level according to the importance level of the data;

[0128] Performing a first division on the first management data set according to a data range corresponding to each data level to obtain a plurality of third management data sets;

[0129] Retrieving a corresponding encryption policy according to the data level, and encrypting each third management data set based on the encryption policy;

[0130] The second division subunit is used for:

[0131] Obtain data reading permissions for users in the encryption business system;

[0132] Firstly associate the data reading permission with the importance level of the data in the encryption business system to obtain the user permission range corresponding to each data level;

[0133] Performing a second division on the second management data set according to the user authority range to obtain a plurality of fourth management data sets;

[0134] Management subunit, used to:

[0135] Performing a second association between the third management data set and the fourth management data set, and obtaining authorized user information corresponding to each third management data set;

[0136] The authorized user information is bound to the key encrypted by the third management data set to complete the allocation management of user rights.

[0137] In this embodiment, the importance level is defined according to actual needs and is defined by the business department itself.

[0138] In this embodiment, the first set of management data may be all management data that is obtained from the data information to be managed according to the business information type and is consistent with the business information type.

[0139] In this embodiment, the second management data set may be all management data that is screened out from the data information to be managed and is consistent with the user information type.

[0140] In this embodiment, the importance level may be the importance of different data in the encryption service system.

[0141] In this embodiment, the data range may be a quantization parameter interval for different data pairs determined according to the importance level.

[0142] In this embodiment, the third management data set may be a result obtained by splitting the first management data set according to data ranges corresponding to data importance levels.

[0143] In this embodiment, the first association may be to associate the data reading permission with the importance level of the data in the encryption service system.

[0144] In this embodiment, the user authority range may be determined data reading authority of different users.

[0145] In this embodiment, the fourth management data set may be a result obtained by dividing the second management data set according to user authority ranges.

[0146] In this embodiment, the second association may be binding the third management data set with the fourth management data set.

[0147] The working principle and beneficial effects of the above technical solution are: by obtaining a first management data set in the data information to be managed according to the business information type of the cryptographic service management, and obtaining a second management data set in the data information to be managed according to the user information type, by obtaining the importance level of the data in the encryption business system, the first management data set is effectively divided into a first part to obtain multiple third management data sets; the corresponding encryption policy is retrieved according to the data level, and each third management data set is encrypted based on the encryption policy; the data reading permission of the user in the encryption business system is obtained; the data reading permission is first associated with the importance level of the data in the encryption business system to obtain the user permission range corresponding to each data level; the second management data set is secondly divided according to the user permission range to obtain multiple fourth management data sets; the third management data set is secondly associated with the fourth management data set to obtain the permission user information corresponding to each third management data set; the permission user information is bound to the encryption key of the third management data set to complete the allocation management of user permissions; not only the data security is enhanced and the precise permission allocation is realized, but also the efficiency and accuracy of the cryptographic service management of the data information to be managed can be effectively realized.

[0148] Embodiment 7:

[0149] Based on Example 1, this embodiment provides a cryptographic service management platform, an abnormality monitoring module, including:

[0150] A monitoring unit, used to monitor the background operation data of the target terminal in real time;

[0151] The mechanism generation unit is used to match the benchmark operation data with the background operation data, determine whether there is an operation fault in the background, and locate the fault point when the background operation fails, and generate an exception handling mechanism according to the fault point;

[0152] The fault handling unit is used to handle background operation faults according to the exception handling mechanism.

[0153] In this embodiment, the fault audit unit includes: a matching subunit, which is used to match the benchmark operation data with the background operation data to determine whether there is an operation fault in the background; if there is target data that is inconsistent between the background operation data and the benchmark operation data, it is determined that there is an operation fault in the background; if the background operation data and the benchmark operation data are consistent, it is determined that there is no operation fault in the background; a fault point determination subunit, which is used to obtain benchmark target data that matches the target data based on locating the target data in the benchmark operation data when there is an operation fault in the background; determine the corresponding fault point during the background operation according to the benchmark target data; a mechanism generation subunit, which is used to read the target information corresponding to the fault point, and match the replaceable point corresponding to the fault point in the preset background operation management library according to the target information, and generate an exception handling mechanism according to the replaceable point.

[0154] In this embodiment, the reference operation data is known in advance and is used to characterize the operation parameters corresponding to the normal operation of the target terminal.

[0155] In this embodiment, the exception handling mechanism may be a method or strategy for clearing the fault point.

[0156] The working principle and beneficial effects of the above technical solution are: by real-time monitoring of the background operation data of the target terminal, matching the benchmark operation data with the background operation data, judging whether there is an operation failure in the background, and locating the fault point when a background operation failure occurs, and generating an exception handling mechanism based on the fault point, and performing exception handling on the background operation failure according to the exception handling mechanism, the continuity of the business can be effectively guaranteed.

[0157] Embodiment 8:

[0158] Based on Example 1, this embodiment provides a cryptographic service management platform, a cryptographic service management module, including:

[0159] An extension management unit, used to generate a horizontal encryption service extension instruction at a target terminal when performing cryptographic service management and when the cryptographic service management needs to be extended, and to extend the horizontal cryptographic service management at the target terminal according to the horizontal encryption service extension instruction;

[0160] The transmission storage unit encrypts the data information to be managed, generates an encrypted data packet, and transmits the encrypted data packet to the target terminal to complete the encrypted transmission management of the data information to be managed when the data information to be managed in the encryption business system is transmitted to the target terminal.

[0161] In this embodiment, the horizontal encryption service extension instruction may be used to expand the management type of the cryptographic service management when the cryptographic management service needs to be expanded, that is, to increase the type of cryptographic service management.

[0162] The beneficial effect of the above technical solution is that it can effectively ensure the comprehensive management of the cryptographic services for managing data information and thus improve the efficiency and accuracy of management.

[0163] Embodiment 9:

[0164] This embodiment provides a cryptographic service management method, such as Figure 3 As shown, including:

[0165] Step 1: Connect the encryption business system to the target terminal, and read the data information to be managed of the encryption business system based on the target terminal;

[0166] Step 2: Analyze the data information to be managed, and manage the password service according to the analysis results;

[0167] Step 3: Monitor the background operation data of the target terminal in real time, and when there is a background operation failure, generate an exception handling mechanism, and perform exception handling on the background operation failure according to the exception handling mechanism.

[0168] The working principle and beneficial effects of the above technical solution are: by connecting the encryption business system to the target terminal, the effectiveness of encryption management of the encryption business system can be guaranteed. At the same time, by parsing the data information to be managed, the cryptographic service management of the data information to be managed can be effectively realized, thereby improving the efficiency and accuracy of management. When there is a background operation failure, the continuity of the business can be effectively guaranteed based on the exception handling mechanism. Therefore, the present invention can not only provide safe, efficient and convenient password management services, but also improve the work efficiency and satisfaction of employees, while enhancing the security and credibility of the services of various institutions.

[0169] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A cryptographic service management platform, characterized in that: include: An access module is used to connect the encryption service system to the target terminal and read the data information to be managed of the encryption service system based on the target terminal; The password service management module is used to analyze the data information to be managed and perform password service management according to the analysis results; The exception monitoring module is used to monitor the background operation data of the target terminal in real time, and when there is a background operation failure, generate an exception handling mechanism, and perform exception handling on the background operation failure according to the exception handling mechanism.

2. A cryptographic service management platform according to claim 1, characterized in that: Access module, including: The demand acquisition unit is used to obtain the enterprise's cryptographic service management requirements, analyze the enterprise's cryptographic service management requirements, and determine the enterprise's encryption business system; An access audit unit is used to perform a security audit on the encryption business system based on the target terminal, and when the encryption business system passes the security audit, the encryption business system is connected to the target terminal; The data reading unit is used to read the data information to be managed of the encryption business system based on the target terminal.

3. A cryptographic service management platform according to claim 2, characterized in that: Demand acquisition unit, including: The requirement analysis subunit is used to read the enterprise password service management requirements and determine the requirement keywords of the enterprise password service management requirements; The sub-unit is used to divide the enterprise password service management requirements according to the requirement keywords to obtain multiple sub-requirement segments; A management target determination subunit is used to obtain the semantic vector corresponding to each sub-demand segment, and determine each sub-demand segment for integration according to the semantic vector corresponding to each sub-demand segment and the corresponding demand keyword to obtain the enterprise cryptographic service management demand management target; The encryption business system determination subunit is used to determine the encryption business system of the enterprise in the target enterprise according to the management objectives.

4. A cryptographic service management platform according to claim 2, characterized in that: Access audit unit, including: A dimension determination subunit, used to obtain audit dimensions for security audit of the encryption business system; The audit condition acquisition subunit is used to obtain the audit conditions corresponding to each audit dimension. At the same time, it retrieves the data set to be audited corresponding to the encryption business system and obtains the audit type of the data set to be audited. A matching subunit is used to match the audit type with the audit dimension, and divide the to-be-audited data set into sub-audit data sets corresponding to each audit dimension according to the matching result; Audit subunit, which is used to: Perform data audit on the sub-audit data set according to the audit conditions corresponding to the current audit dimension, and output the audit score corresponding to the current audit dimension according to the audit results; Obtain the audit weight corresponding to each audit dimension, and calculate the total audit score for the encryption business system based on the audit weight; Obtain the pass threshold, and compare the total audit score with the pass threshold to determine whether the encryption business system has passed the access audit; If the total audit score is less than or equal to the pass threshold, the encryption business system is judged to have failed the access audit; Otherwise, it is determined that the encryption service system has passed the access review.

5. A cryptographic service management platform according to claim 1, characterized in that: Password service management module, including: A parsing unit, used to parse the data information to be managed and determine the information type of the data information to be managed, wherein the information type includes: business information type of cryptographic service management and user information type; The management unit is used to manage the management data corresponding to the data information to be managed based on the business information type and user information type managed by the cryptographic service, including: user authority management, data level management, and data encryption management.

6. A cryptographic service management platform according to claim 5, characterized in that: Management unit, including: A data acquisition subunit is used to acquire a first management data set from the data information to be managed according to the business information type of the cryptographic service management, and to acquire a second management data set from the data information to be managed according to the user information type. The first division subunit is configured to: Obtain the importance level of data in the encryption business system, and determine the data range corresponding to each data level according to the importance level of the data; Performing a first division on the first management data set according to a data range corresponding to each data level to obtain a plurality of third management data sets; Retrieving a corresponding encryption policy according to the data level, and encrypting each third management data set based on the encryption policy; The second division subunit is used for: Obtain data reading permissions for users in the encryption business system; Firstly associate the data reading permission with the importance level of the data in the encryption business system to obtain the user permission range corresponding to each data level; Performing a second division on the second management data set according to the user authority range to obtain a plurality of fourth management data sets; Management subunit, used to: Performing a second association between the third management data set and the fourth management data set, and obtaining authorized user information corresponding to each third management data set; The authorized user information is bound to the key encrypted by the third management data set to complete the allocation management of user rights.

7. A cryptographic service management platform according to claim 1, characterized in that: Abnormal monitoring module, including: A monitoring unit, used to monitor the background operation data of the target terminal in real time; The mechanism generation unit is used to match the benchmark operation data with the background operation data, determine whether there is an operation fault in the background, and locate the fault point when the background operation fails, and generate an exception handling mechanism according to the fault point; The fault handling unit is used to handle background operation faults according to the exception handling mechanism.

8. A cryptographic service management platform according to claim 7, characterized in that: Fault audit unit, including: Matching subunits for: Match the benchmark operation data with the background operation data to determine whether there is any operation failure in the background; If there is target data where the background operation data is inconsistent with the benchmark operation data, it is determined that there is an operation failure in the background; If the background operation data is consistent with the benchmark operation data, it is determined that there is no operation failure in the background; The fault point determination subunit is used to: When there is an operating failure in the background, based on locating the target data in the benchmark operating data, benchmark target data matching the target data is obtained; Determine the corresponding fault point during background operation based on the benchmark target data; The mechanism generation subunit is used to read the target information corresponding to the fault point, match the replaceable point corresponding to the fault point in the preset background operation management library according to the target information, and generate an exception handling mechanism according to the replaceable point.

9. A cryptographic service management platform according to claim 1, characterized in that: Password service management module, including: An extension management unit, used to generate a horizontal encryption service extension instruction at a target terminal when performing cryptographic service management and when the cryptographic service management needs to be extended, and to extend the horizontal cryptographic service management at the target terminal according to the horizontal encryption service extension instruction; The transmission storage unit encrypts the data information to be managed, generates an encrypted data packet, and transmits the encrypted data packet to the target terminal to complete the encrypted transmission management of the data information to be managed when the data information to be managed in the encryption business system is transmitted to the target terminal.

10. A cryptographic service management method, characterized in that: include: Step 1: Connect the encryption business system to the target terminal, and read the data information to be managed of the encryption business system based on the target terminal; Step 2: Analyze the data information to be managed, and manage the password service according to the analysis results; Step 3: Monitor the background operation data of the target terminal in real time, and when there is a background operation failure, generate an exception handling mechanism, and perform exception handling on the background operation failure according to the exception handling mechanism.

Images