Large-flow data processing method and system for password equipment and storage medium

Abstract

The invention provides a large-flow data processing method and system for a cryptographic device and a storage medium, and the method comprises the steps: dividing a received original data stream to obtain a plurality of to-be-processed data streams, distributing a corresponding target processing node for each to-be-processed data stream according to the current load of each processing node in a processing device, the target processing node parses the to-be-processed data streams distributed to the target processing node in parallel to obtain real-time equipment fingerprints, and a matching result is determined and output according to the real-time equipment fingerprints in the to-be-processed data streams and the equipment fingerprints in the equipment fingerprint database; and if the matching result indicates that the password device to which the to-be-processed data stream belongs has the authority of accessing the processing device, processing the service data in the to-be-processed data stream. According to the method, the problem that the fingerprints are easy to copy is solved by setting the fingerprints, the security is improved, and the to-be-processed data streams are processed in parallel by utilizing the plurality of processing nodes, so that the efficiency is improved, and the real-time requirement is met.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, system and storage medium for processing large-volume data of a cryptographic device. Background Art

[0002] With the rapid development of Internet technology, cryptographic devices have been widely used in many fields. Cryptographic devices are specifically used to process sensitive information and ensure data security. Therefore, how to manage and authenticate cryptographic devices is crucial.

[0003] In the prior art, identity authentication mainly relies on the hardware identifier of the cryptographic device, wherein the hardware identifier specifically includes a Media Access Control Address (MAC) address and a serial number.

[0004] However, hardware identifiers are easily copied and forged, which reduces the security of authentication, and single-dimensional authentication information is difficult to fully reflect the true status of the device, resulting in limited authentication accuracy. In addition, in the face of high-traffic environments, traditional methods are inefficient in processing a large number of concurrent requests and cannot meet real-time requirements. Summary of the invention

[0005] The purpose of this application is to provide a large-flow data processing method, system and storage medium for a cryptographic device in response to the above-mentioned deficiencies in the prior art, so as to solve the problems of low security, limited authentication accuracy and inability to meet real-time requirements in the prior art.

[0006] To achieve the above objectives, the technical solutions adopted in this application are as follows: In a first aspect, the present application provides a method for processing large-volume data of a cryptographic device, which is applied to a processing device, and the method includes: Receiving an original data stream, wherein the original data stream includes data sent by at least one cryptographic device; Dividing the original data stream to obtain a plurality of data streams to be processed, each of the data streams to be processed comes from a cryptographic device, and the data streams to be processed include a real-time device fingerprint and business data of the cryptographic device to which the data streams to be processed belong; Allocating a corresponding target processing node to each of the data streams to be processed according to the current load of each processing node in the processing device; The target processing node parses each to-be-processed data stream allocated to the target processing node in parallel to obtain the real-time device fingerprint in the to-be-processed data stream, wherein the real-time device fingerprint includes hardware features, software features, and environment features; The target processing node determines and outputs a matching result according to the real-time device fingerprint in the data stream to be processed and each device fingerprint in the device fingerprint library, wherein the matching result is used to indicate whether the cryptographic device to which the data stream to be processed belongs has the authority to access the processing device, wherein the device fingerprint library is pre-stored in the processing device; If the matching result indicates that the cryptographic device to which the data stream to be processed belongs has the authority to access the processing device, the business data in the data stream to be processed is processed.

[0007] Optionally, the dividing the original data stream to obtain a plurality of data streams to be processed includes: Obtaining at least one cryptographic device identifier in the original data stream; Acquire pre-configured partitioning parameters, where the partitioning parameters include: time period and / or data volume; The original data stream is divided according to the cryptographic device identifier and the division parameter to obtain a plurality of data streams to be processed.

[0008] Optionally, allocating a corresponding target processing node to each of the to-be-processed data streams according to the current load of each processing node in the processing device includes: Traversing each data stream to be processed, and judging whether the current load of each processing node is the same for the traversed current data stream to be processed, wherein the current load is used to indicate the number of data streams being processed; If yes, determine the target processing node according to a preset order, and allocate the current data stream to be processed to the target processing node; If not, the processing node with the smallest current load among the processing nodes is used as the target processing node corresponding to the current data flow to be processed.

[0009] Optionally, determining and outputting a matching result according to the real-time device fingerprint in the data stream to be processed and each device fingerprint in the device fingerprint library includes: Traversing each device fingerprint in the device fingerprint library, and judging whether the current device fingerprint and the real-time device fingerprint match each other for the traversed current device fingerprint; If so, determining that the matching result is that the cryptographic device to which the data stream to be processed belongs has the authority to access the processing device; If there is no device fingerprint matching the real-time device fingerprint in the device fingerprint library, a failure indication is sent to the cryptographic device to which the data stream to be processed belongs, and feature data sent by the cryptographic device to which the data stream to be processed belongs is obtained, the device fingerprint library is updated according to the feature data, and the matching result is re-determined and output based on the real-time device fingerprint and each device fingerprint in the device fingerprint library. Optionally, updating the device fingerprint library according to the feature data includes: Generate a device fingerprint based on the characteristic data and a randomly generated salt value; Update the device fingerprint and the salt value to the record corresponding to the cryptographic device to which the data stream to be processed belongs in the device fingerprint library; Send a registration success message to the user.

[0010] Optionally, it also includes: Acquire characteristic data of the cryptographic device, the characteristic data including: hardware characteristics, software characteristics and environmental characteristics; Generate a device fingerprint of the cryptographic device according to the characteristic data of the cryptographic device and a salt value corresponding to the cryptographic device; The cryptographic device identification of the cryptographic device, the device fingerprint and the salt value are stored in a device fingerprint library.

[0011] Optionally, generating a device fingerprint according to the characteristic data of the cryptographic device and a salt value corresponding to the cryptographic device includes: Preprocessing the characteristic data of the cryptographic device to obtain processed characteristic data, wherein the preprocessing includes: clearing invalid data, clearing null values, and deduplication processing; Randomly generate a salt value corresponding to the cryptographic device; Based on the encryption conversion algorithm, the processed feature data of the cryptographic device and the salt value are encrypted and converted to obtain a device fingerprint.

[0012] Optionally, the method further comprises: Receiving a deregistration instruction sent by a target cryptographic device, wherein the deregistration instruction includes an identification of the target cryptographic device; The corresponding record of the target password device in the device fingerprint library is deleted according to the identification of the target password device.

[0013] In the second aspect, the present application provides a cryptographic device large-flow data processing system, which includes a processing device and multiple cryptographic devices, the processing device includes multiple processing nodes, the processing device is connected to the multiple cryptographic devices, and the processing device is used to execute the cryptographic device large-flow data processing method described in the first aspect to perform data processing.

[0014] In a third aspect, the present application provides a processing device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the processing device is running, the processor and the storage medium communicate via the bus, and the processor executes the machine-readable instructions to perform the steps of the method of the first aspect described above.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method of the first aspect are executed.

[0016] The beneficial effect of the present application is: by dividing the received original data stream, and distributing the obtained multiple data streams to be processed according to the current load of each processing node, so that each processing node can process multiple data streams to be processed in parallel, thereby improving processing efficiency and response speed. And reduce the delay and error rate in the authentication process of the cryptographic device, improve the user experience, and enable users to safely and smoothly use the cryptographic device to process and transmit sensitive data. After the data stream to be processed is distributed to the corresponding target processing node, the target processing node analyzes each data stream to be processed allocated to the target processing node in parallel to obtain the real-time device fingerprint, and determines and outputs the matching result according to the real-time device fingerprint and each device fingerprint pre-stored in the device fingerprint library. If the matching result indicates that the cryptographic device has the right to access the processing device, the business data in the data stream to be processed is processed. This embodiment determines whether the cryptographic device has access rights through the real-time device fingerprint in the data sent by the cryptographic device, and the real-time device fingerprint includes features of multiple dimensions, so that while ensuring that the identity of the cryptographic device cannot be copied and forged, and ensuring that the authentication dimension is comprehensive, it can support a variety of application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a schematic diagram of an application scenario of a method for processing large-volume data of a cryptographic device provided in an embodiment of the present application; Figure 2 It is a flowchart of a method for processing large-volume data of a cryptographic device provided in an embodiment of the present application; Figure 3 It is a schematic diagram of a process for obtaining multiple data streams to be processed provided by an embodiment of the present application; Figure 4 It is a flowchart of allocating a target processing node provided by an embodiment of the present application; Figure 5 It is a schematic diagram of a process for determining and outputting a matching result provided by an embodiment of the present application; Figure 6It is a schematic diagram of a process for generating a corresponding record of a password device provided in an embodiment of the present application; Figure 7 It is a schematic diagram of a process of building a device fingerprint library provided by an embodiment of the present application; Figure 8 It is a schematic diagram of a process of generating a device fingerprint provided in an embodiment of the present application; Fig. 9 It is a structural schematic diagram of a processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0020] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0021] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0022] In the existing technology, identity authentication mainly relies on the hardware identifier of the cryptographic device. However, the hardware identifier is easy to be copied and forged, which reduces the security of authentication, and the single-dimensional authentication information is difficult to fully reflect the true status of the device, resulting in limited authentication accuracy. In addition, in the face of high-traffic environments, traditional methods are inefficient in processing a large number of concurrent requests and cannot meet real-time requirements.

[0023] Based on this, the present application proposes a method for processing large-flow data of a cryptographic device, which receives the original data stream, and then divides the original data stream of the large flow to obtain multiple data streams to be processed, and assigns the corresponding target processing node to each data stream to be processed according to the current load of each processing node in the processing device, and the target processing node parses each data stream to be processed in parallel, and matches the implementation device fingerprint and the device fingerprint obtained by the parsing, and processes the business data in the data stream to be processed according to the matching result. In the above process, by judging whether the cryptographic device has access rights according to the real-time device fingerprint and the pre-stored device fingerprint of each cryptographic device, the real-time device fingerprint and the pre-stored device fingerprint are not easy to be copied and forged in the process of managing the cryptographic device, so that the authentication is safe. In addition, the original data stream of the large flow is divided into multiple data streams to be processed and then assigned to each processing node for parallel processing, so as to realize efficient processing of a large number of concurrent requests, improve processing efficiency and response speed.

[0024] Before introducing the specific steps of the large-flow data processing method of the cryptographic device, its application scenarios are introduced first. Figure 1 Schematic diagram of an application scenario of a method for processing large-volume data of a cryptographic device provided in an embodiment of the present application. Figure 1 The cryptographic device high-volume data processing method is applied to a processing device in a cryptographic device high-volume data system. The cryptographic device high-volume data system also includes multiple cryptographic devices. The processing device includes multiple processing nodes. The processing device is connected to the multiple cryptographic devices. Each cryptographic device is used to encrypt the data sent by the corresponding user and then send it to the processing device. Optionally, the processing device can be deployed at the enterprise network end to determine whether the user has access rights.

[0025] Next, refer to Figure 2 The specific steps of the method for processing large-flow data of cryptographic equipment are introduced. Figure 2 It is a flow chart of a method for processing large-volume data of a cryptographic device provided in an embodiment of the present application.

[0026] S201. Receive an original data stream, where the original data stream includes data sent by at least one cryptographic device.

[0027] When a user needs to access the network where the processing device is located, data is sent to the processing device through the cryptographic device. The cryptographic device is used to encrypt the data sent by the user. During the encryption process, the data will be identified, and the identification can be extracted as a real-time device fingerprint. The real-time device fingerprint includes hardware features, software features, and environmental features.

[0028] It should be understood that the processing device can be connected to a large number of cryptographic devices, so as to receive data with a large amount of original data flow. The cryptographic device can be, for example, a virtual private network (VPN) cryptographic device.

[0029] S202, dividing the original data stream to obtain multiple data streams to be processed, each of which comes from a cryptographic device, and the data stream to be processed includes the real-time device fingerprint and business data of the cryptographic device to which the data stream to be processed belongs.

[0030] Optionally, the original data stream of large traffic volume can be divided according to a pre-configured division strategy to obtain multiple data streams to be processed. Each data stream to be processed comes from a cryptographic device, and since the original data stream includes data sent by at least one cryptographic device, the data sent by each cryptographic device includes real-time device fingerprint and business data. Among them, business data is data used when a user accesses the network where the processing device is located and performs related data processing.

[0031] As an optional implementation, the original data stream of the large flow data can be divided according to the identification of each cryptographic device. It is worth noting that after the original data stream is divided, multiple data streams to be processed correspond to the complete data of one cryptographic device, and one cryptographic device cannot correspond to multiple data streams to be processed.

[0032] S203 . Allocate a corresponding target processing node to each data stream to be processed according to the current load of each processing node in the processing device.

[0033] The load of each processing node can be determined according to the number of data streams currently processed by the processing node. As an optional implementation, the processing node with the smallest current load is used as the target processing node, and the target data stream to be processed is allocated to the target processing node. The target data stream to be processed is one of the data streams to be processed.

[0034] As an optional implementation, the processing device also includes: a load balancer. The load balancer is connected to each cryptographic device and to each processing node. The load balancer is used to receive the original data stream sent by the cryptographic device, divide the original data stream, obtain multiple data streams to be processed, and then obtain the load status of each processing node, and distribute each data stream to be processed to each processing node for processing according to the load status of each processing node. Among them, the load balancer can maintain a dynamically updated list according to the load status, so as to record and update the current load status of each processing node. When a new processing node appears, the load balancer can add the new processing node to the list and start distributing new data streams.

[0035] As another optional implementation, a monitoring system may be deployed in the processing device, the monitoring system being used to monitor the load condition of each processing node, and to distribute each data stream to be processed to each processing node for processing according to the load condition of each processing node.

[0036] It is worth noting that if a processing node fails or its performance degrades, the data stream to be processed may not be allocated to the processing node.

[0037] S204 , the target processing node parses the data streams to be processed allocated to the target processing node in parallel to obtain real-time device fingerprints in the data streams to be processed.

[0038] Optionally, each processing node may process each data stream to be processed in parallel to improve data processing efficiency.

[0039] As an optional implementation, the target processing node may parse each data stream to be processed, thereby parsing out the real-time device fingerprint corresponding to the cryptographic device corresponding to the data stream to be processed, wherein the real-time device fingerprint obtained by the parsing may be a JSON string.

[0040] It is worth noting that before parsing each data stream to be processed, the real-time device fingerprint in the data stream to be processed may be a device information identifier. The target processing node determines the real-time device fingerprint according to the device information identifier in the data stream to be processed.

[0041] S205. The target processing node determines and outputs a matching result based on the real-time device fingerprint in the data stream to be processed and the device fingerprints in the device fingerprint library, where the matching result is used to indicate whether the cryptographic device to which the data stream to be processed belongs has the authority to access the processing device, wherein the device fingerprint library is pre-stored in the processing device.

[0042] The fingerprints of each device in the device fingerprint library are pre-stored in the processing device, including the records of each cryptographic device. The records include the device fingerprint of the cryptographic device, the cryptographic device identifier, and the salt value. The salt value is a randomly generated number. The processing device can update the device fingerprint library in real time, including generating new records of cryptographic devices and deleting records of target devices.

[0043] As an optional implementation, the target processing node compares the real-time device fingerprint in each data stream to be processed with each device fingerprint in the device fingerprint library, and determines the matching result of the cryptographic device corresponding to each real-time device fingerprint according to the comparison result. Specifically, if there is a device fingerprint in a record in the device fingerprint library that matches the real-time device fingerprint, the cryptographic device to which the data stream to be processed belongs has the authority to access the processing device; if there is no record in the device fingerprint library that matches the real-time device fingerprint, the cryptographic device to which the data stream to be processed belongs does not have the authority to access the processing device.

[0044] S206: If the matching result indicates that the cryptographic device to which the data flow to be processed belongs has the authority to access the processing device, the business data in the data flow to be processed is processed.

[0045] Optionally, if the matching result indicates that the cryptographic device to which the data flow to be processed belongs has the authority to access the processing device, the business data corresponding to the data flow to be processed is processed.

[0046] Optionally, if the matching result indicates that the cryptographic device to which the data flow to be processed belongs has the authority to access the processing device, the corresponding cryptographic device needs to be notified, and the cryptographic device needs to be re-registered and matched so that the user can access the network where the processing device is located.

[0047] In this embodiment, the received original data stream is divided, and the obtained multiple data streams to be processed are distributed according to the current load of each processing node, so that each processing node can process multiple data streams to be processed in parallel, thereby improving processing efficiency and response speed. And reduce the delay and error rate in the authentication process of the cryptographic device, improve user experience, and enable users to safely and smoothly use the cryptographic device to process and transmit sensitive data. After the data stream to be processed is distributed to the corresponding target processing node, the target processing node analyzes each data stream to be processed allocated to the target processing node in parallel to obtain the real-time device fingerprint, and then determines and outputs the matching result according to the real-time device fingerprint and each device fingerprint pre-stored in the device fingerprint library. If the matching result indicates that the cryptographic device has the right to access the processing device, the business data in the data stream to be processed is processed. In this embodiment, the real-time device fingerprint in the data sent by the cryptographic device determines whether the cryptographic device has access rights, and the real-time device fingerprint includes features of multiple dimensions, so that while ensuring that the identity of the cryptographic device cannot be copied and forged, and ensuring that the authentication dimension is comprehensive, it can support a variety of application scenarios.

[0048] On this basis, we will refer to Figure 3 The specific steps of dividing the original data stream in the above step S202 to obtain multiple data streams to be processed are introduced. Figure 3It is a flowchart of obtaining multiple data streams to be processed provided in an embodiment of the present application.

[0049] S301. Obtain at least one cryptographic device identifier in an original data stream.

[0050] Specifically, the original data stream contains a cryptographic device identifier, which is used to represent the identity of the cryptographic device.

[0051] S302: Obtain pre-configured partitioning parameters, where the partitioning parameters include: time period and / or data volume.

[0052] The time period may be a preset time length, and the unit of the time length may be minutes or seconds. The data volume may be a data length, such as every 1 megabyte or every 1000 data streams.

[0053] It is worth noting that the partitioning parameter can be determined according to the data stream size of the current original data stream.

[0054] S303: Divide the original data stream according to the cryptographic device identifier and the division parameter to obtain multiple data streams to be processed.

[0055] Specifically, the original data stream may be first divided according to the cryptographic device identifier to obtain a plurality of data streams to be processed, and then the data streams to be processed may be classified according to the division parameters so that at least one data stream to be processed may be allocated to a target processing node.

[0056] As an optional implementation, each data stream to be processed is classified according to the time period, and the data stream to be processed in the time period of the partition parameter before the current moment is classified and allocated to the target processing node. Exemplarily, the data stream to be processed within 1 minute before the current moment is classified and allocated to the target processing node.

[0057] As another optional implementation, each data stream to be processed is classified according to the data volume, and the data to be processed whose total data volume before the current moment is equal to the data volume in the partition parameter is classified and allocated to the target processing node. Exemplarily, the 100 data to be processed before the current moment are classified and allocated to the target processing node.

[0058] In this embodiment, at least one cryptographic device identifier in the original data stream is first obtained, and the original data stream is divided according to the cryptographic device identifier and the obtained division parameter to obtain multiple data streams to be processed. In this embodiment, the division is performed according to the cryptographic device identifier, so that the data of the same cryptographic device is not processed by multiple processing nodes, thereby ensuring the integrity of the real-time device fingerprint. At the same time, the division according to the division parameter can enable multiple processing nodes to process large flow data in parallel, thereby ensuring processing efficiency.

[0059] Figure 4 is a flow chart of allocating a target processing node provided by an embodiment of the present application. Figure 4 As shown, the specific steps of allocating the corresponding target processing node to each data stream to be processed according to the current load of each processing node in the processing device in the above step S203 are introduced.

[0060] S401, traversing each data stream to be processed, and judging whether the current load of each processing node is the same for the traversed current data stream to be processed, where the current load is used to indicate the number of data streams being processed.

[0061] Specifically, it is determined whether the number of data flows being processed by each processing node is the same.

[0062] S402: If yes, determine the target processing node according to a preset order, and allocate the current data flow to be processed to the target processing node.

[0063] Specifically, if the number of data flows being processed by each processing node is the same, it means that the load of each processing node is balanced. Then, each processing node is sorted according to a preset order, and a target processing node is determined according to the sorting result.

[0064] Exemplarily, if the node identifier of each processing node is identified by a number, the processing nodes are sorted according to their node identifiers, and the processing node with the smallest node identifier is used as the target processing node.

[0065] S403: If not, the processing node with the smallest current load among the processing nodes is used as the target processing node corresponding to the current data flow to be processed.

[0066] Specifically, if the number of data flows being processed by each processing node is different, it means that the load of each processing node is not balanced. Therefore, the processing node with the smallest current load is used as the target processing node corresponding to the current data flow to be processed.

[0067] It is worth noting that in the above step S202, the original data stream is divided to obtain multiple data streams to be processed. If the current data stream to be processed and the data stream to be processed after the current data stream to be processed are divided into the same category according to the division parameters, all data streams to be processed of the same category can be allocated to the target processing node.

[0068] In this embodiment, by judging whether the current loads of each processing node are the same, the target processing node is determined, and the traversed current data stream to be processed is allocated to the corresponding target processing node, thereby reasonably allocating computing resources and achieving the purpose of efficient data processing.

[0069] As an example, if the processing device includes three processing nodes: node A, node B and node C, in the initial state, the loads of node A, node B and node C are all 0, so data stream 1, data stream 2 and data stream 3 are sequentially allocated to node A, node B and node C for processing. Before receiving data stream 4, node B finishes processing first, and at this time, the loads of node A, node B and node C are 1, 0 and 1 respectively, so the received data stream 4 is allocated to node B for processing.

[0070] Figure 5 is a flow chart of determining and outputting matching results provided by an embodiment of the present application. Figure 5 As shown, the specific steps of determining and outputting the matching result according to the real-time device fingerprint in the data stream to be processed and each device fingerprint in the device fingerprint library in the above step S205 are as follows: S501, traversing each device fingerprint in the device fingerprint library, and judging whether the current device fingerprint and the real-time device fingerprint match with each other for the traversed current device fingerprint.

[0071] Specifically, the step of determining whether the current device fingerprint and the real-time device fingerprint match includes: parsing the current device fingerprint according to the salt value corresponding to the current device fingerprint in the device fingerprint library to obtain the device feature fingerprint, and calculating whether the difference between the device feature fingerprint and the real-time device fingerprint is less than a preset threshold. If so, the current device fingerprint and the real-time device fingerprint match. The device fingerprint library contains multiple records, each of which includes a cryptographic device identifier, a device fingerprint, and a salt value. The preset threshold is used to avoid mis-sampling or null values ​​in the current device fingerprint and the real-time device fingerprint during the parsing and conversion process.

[0072] The current device fingerprint may be a hash value.

[0073] S502: If yes, determine that the matching result is that the cryptographic device to which the data stream to be processed belongs has the authority to access the processing device.

[0074] Specifically, if the current device fingerprint matches the real-time device fingerprint, it means that the cryptographic device to which the data to be processed belongs has the authority to access the processing device and the network to which it is located.

[0075] S503. If there is no device fingerprint matching the real-time device fingerprint in the device fingerprint library, a failure indication is sent to the cryptographic device to which the data stream to be processed belongs, and feature data sent by the cryptographic device to which the data stream to be processed belongs is obtained, the device fingerprint library is updated according to the feature data, and the matching result is re-determined and output based on the real-time device fingerprint and each device fingerprint in the device fingerprint library.

[0076] Specifically, if all device fingerprints in the device fingerprint library cannot match the real-time device fingerprint, a failure indication is sent to the cryptographic device to which the data stream to be processed belongs. As an optional implementation, a failure indication can be sent to the user's mobile terminal based on the user information corresponding to the cryptographic device identifier of the cryptographic device to which the data stream to be processed belongs.

[0077] When the user receives the failure indication, the cryptographic device sends data to the processing device, specifically, sends feature data to the processing device, and the feature data includes hardware features, software features, and environmental features of the cryptographic device. When the processing device receives the feature data, it updates the device fingerprint library according to the feature data. Specifically, a new device fingerprint is generated according to the feature data and a randomly generated salt value, and the new device fingerprint, salt value, and cryptographic device identifier are stored as a new record in the device fingerprint library.

[0078] Optionally, determining and outputting the matching result again based on the real-time device fingerprint and each device fingerprint in the device fingerprint library may be the same as the above step S501.

[0079] In this embodiment, each device fingerprint in the device fingerprint is traversed, and for the current device fingerprint traversed, it is determined whether the current device fingerprint matches the real-time device fingerprint. If so, it is determined that the cryptographic device has the authority to access the processing device. If not, a failure instruction is sent to the cryptographic device to which the data stream to be processed belongs, and the feature data sent by the cryptographic device to which the data stream to be processed belongs is obtained, and the feature data is re-matched to determine and output the matching result. This embodiment reduces the complicated process in the device authentication process by obtaining feature data from the user and re-matching, thereby improving the user experience and enabling users to use cryptographic devices more smoothly and securely to process and transmit sensitive data.

[0080] Next, refer to Figure 6 The process of updating the device fingerprint library according to the feature data in the above step S503 is introduced. This process is applied when there is no device fingerprint matching the real-time device fingerprint in the device fingerprint library. Figure 6 It is a flow chart of generating a corresponding record of a password device provided in an embodiment of the present application.

[0081] S601: Generate a device fingerprint according to feature data and a randomly generated salt value.

[0082] The salt value is used to distinguish the values ​​of each cryptographic device when the characteristic data of multiple cryptographic devices are the same.

[0083] S602: Update the device fingerprint and the salt value to the record corresponding to the cryptographic device to which the data flow to be processed belongs in the device fingerprint library.

[0084] Specifically, the target record in the device fingerprint library is determined according to the device identification of the cryptographic device corresponding to the feature data, and the device fingerprint and the salt value are updated to the target record in the device fingerprint library to replace the original record.

[0085] S603: Send a registration success message to the user.

[0086] Specifically, after the device fingerprint and the salt value are stored in the device fingerprint library, a registration success message is sent to the user. As an optional implementation, the registration success message may include a confirmation verification code. After the user receives the registration success message, the confirmation verification code in the registration success message is sent to the processing device, so that the processing device confirms that the user has received the registration success message.

[0087] In this embodiment, a device fingerprint is generated based on feature data and salt value, the device fingerprint and salt value are updated to the device fingerprint library, and a registration success message is sent to the user, thereby improving adaptability, ensuring the timeliness and accuracy of the device fingerprint, and simplifying the user access process.

[0088] As an optional implementation, refer to Figure 7 As shown, the method for building a device fingerprint library is as follows. Figure 7 It is a schematic diagram of a process for building a device fingerprint library provided in an embodiment of the present application.

[0089] S701. Acquire characteristic data of a cryptographic device, where the characteristic data includes: hardware characteristics, software characteristics, and environmental characteristics.

[0090] Specifically, in the feature data, the hardware features include the central processing unit (CPU) serial number and the motherboard serial number. The hardware features of the cryptographic device can be collected according to the dedicated interface. Specifically, the cpuinfo virtual file in proc in the file collected by the interface is read to obtain the CPU serial number, the desktop management interface (DMI) is read to obtain the motherboard serial number, and the file in the net directory in the class in sys is read to obtain the network card MAC address.

[0091] Software features include operating system version and browser type. Specifically, the operating system version of the cryptographic device can be detected by a software scanning tool. The operating system version is obtained through the platform module, the installed software list is obtained by reading the information of the package manager, and the psutil library is used to obtain the list of running services.

[0092] Environmental characteristics include Internet Protocol (IP) addresses and connection timestamps. Use the socket and netifaces libraries to obtain network configuration information, and use the datetime module to record connection timestamps.

[0093] S702: Generate a device fingerprint of the cryptographic device according to the characteristic data of the cryptographic device and the salt value corresponding to the cryptographic device.

[0094] Optionally, a device fingerprint of the cryptographic device can be generated based on the characteristic data of the cryptographic device and the salt value corresponding to the cryptographic device based on a secure hash algorithm. Where the characteristic data is a 128-bit JSON string, and the salt value is also a 128-bit JSON string, a 256-bit hash value is generated based on the characteristic data and the salt value, and the hash value is used as the unique device fingerprint of the cryptographic device.

[0095] S703: Store the cryptographic device identifier, device fingerprint, and salt value of the cryptographic device in a device fingerprint library.

[0096] The salt value is the salt value used when generating the device fingerprint of the password device. The purpose of recording the salt value is to use the salt value to parse the current device fingerprint when judging the real-time device fingerprint and the current device fingerprint, and compare the parsing result with the real-time device fingerprint.

[0097] As an optional implementation, the device fingerprint library may also store the registration time of each password device, that is, the time when the record is saved.

[0098] In this embodiment, the characteristic data of the cryptographic device is obtained, and then the device fingerprint of the cryptographic device is generated according to the characteristic data of the cryptographic device and the salt value corresponding to the cryptographic device, and the cryptographic device identification, device fingerprint and salt value of the cryptographic device are stored in the device fingerprint library. This embodiment collects hardware features, software features and environmental features to improve the recognition accuracy, thereby building a comprehensive, multi-dimensional and difficult-to-copy device fingerprint system, which significantly improves the recognition accuracy of the cryptographic device.

[0099] Further, refer to Figure 8 In the above step S702, the specific method for generating the device fingerprint according to the characteristic data of the password device and the salt value corresponding to the password device is as follows. Figure 8 It is a schematic diagram of a process for generating a device fingerprint provided in an embodiment of the present application.

[0100] S801. Preprocess the characteristic data of the cryptographic device to obtain processed characteristic data, wherein the preprocessing includes: clearing invalid data, clearing null values, and deduplication.

[0101] Specifically, the preprocessing process can clear invalid data or inconsistent data of the characteristic data of the cryptographic device, remove control or invalid values, and remove data that does not conform to the expected format. For list data, sets can be used to remove duplicates. In addition, the data format can be standardized, such as unifying the date format to YYYY-MM-DD. Unify the IP address format (192.168.50.1) and the MAC address format (00:1A:2B:3C:4D:5E).

[0102] S802. Randomly generate a salt value corresponding to the cryptographic device.

[0103] The salt value may be a 16-byte salt value, that is, a 128-bit salt value.

[0104] S803: Based on the encryption conversion algorithm, the processed feature data and the salt value of the cryptographic device are encrypted and converted to obtain a device fingerprint.

[0105] Among them, the encryption conversion algorithm can be an SM3 algorithm, which uses the SM3 algorithm to encrypt and convert the processed feature data and the salt value to obtain a 128-bit hash value, and uses the hash value as the unique device fingerprint of the cryptographic device.

[0106] In this embodiment, the cryptographic device is preprocessed and a salt value corresponding to the cryptographic device is randomly generated. Based on the encryption conversion algorithm, the processed feature data of the cryptographic device and the salt value are encrypted and converted to obtain a device fingerprint, thereby avoiding the generation of the same device fingerprint when the feature information of multiple cryptographic devices is the same, and preventing rainbow table attacks.

[0107] As an optional implementation, the method for processing large-volume data of a cryptographic device also includes a method for canceling a record of a cryptographic device, and the specific steps are as follows: Optionally, a deregistration instruction sent by a target cryptographic device is received, where the deregistration instruction includes an identifier of the target cryptographic device.

[0108] Specifically, when the user does not need to access the processing device, the password device used by the user is the target password device, and the user sends a logout instruction through the target password device.

[0109] Optionally, the corresponding record of the target cryptographic device in the device fingerprint library is deleted according to the identifier of the target cryptographic device.

[0110] Optionally, according to the identifier of the target cryptographic device, the corresponding record of the target cryptographic device in the device fingerprint library is traversed and the record is deleted.

[0111] In this embodiment, by deleting the corresponding record of the target password device in the device fingerprint library according to the deregistration instruction, the storage pressure of the device fingerprint library is reduced and the storage space of the processing device is saved.

[0112] The present application also provides a processing device, such as Fig. 9 As shown, it is a structural diagram of a processing device provided in an embodiment of the present application, including: a processor 901, a memory 902 and a bus. The memory 902 stores machine-readable instructions executable by the processor 901. When the processing device is running, the processor 901 communicates with the memory 902 through the bus, and when the machine-readable instructions are executed by the processor 901, the processing of the large-volume data processing method of the cryptographic device is performed.

[0113] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned cryptographic device large-flow data processing method are executed.

[0114] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0115] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or part of the technical solution that contributes to the prior art or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program code.

[0116] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A method for processing large-volume data of a cryptographic device, characterized in that: Applied to a processing device, the method comprises: Receiving an original data stream, wherein the original data stream includes data sent by at least one cryptographic device; Dividing the original data stream to obtain a plurality of data streams to be processed, each of the data streams to be processed comes from a cryptographic device, and the data streams to be processed include a real-time device fingerprint and business data of the cryptographic device to which the data streams to be processed belong; Allocating a corresponding target processing node to each of the data streams to be processed according to the current load of each processing node in the processing device; The target processing node parses each to-be-processed data stream allocated to the target processing node in parallel to obtain the real-time device fingerprint in the to-be-processed data stream, wherein the real-time device fingerprint includes hardware features, software features, and environment features; The target processing node determines and outputs a matching result according to the real-time device fingerprint in the data stream to be processed and each device fingerprint in the device fingerprint library, wherein the matching result is used to indicate whether the cryptographic device to which the data stream to be processed belongs has the authority to access the processing device, wherein the device fingerprint library is pre-stored in the processing device; If the matching result indicates that the cryptographic device to which the data stream to be processed belongs has the authority to access the processing device, the business data in the data stream to be processed is processed.

2. The method for processing large-volume data of a cryptographic device according to claim 1, characterized in that: The original data stream is divided to obtain a plurality of data streams to be processed, including: Obtaining at least one cryptographic device identifier in the original data stream; Acquire pre-configured partitioning parameters, where the partitioning parameters include: time period and / or data volume; The original data stream is divided according to the cryptographic device identifier and the division parameter to obtain a plurality of data streams to be processed.

3. A method for processing large-volume data of a cryptographic device according to claim 1, characterized in that: The allocating a corresponding target processing node to each of the to-be-processed data streams according to the current load of each processing node in the processing device comprises: Traversing each data stream to be processed, and judging whether the current load of each processing node is the same for the traversed current data stream to be processed, wherein the current load is used to indicate the number of data streams being processed; If yes, determine the target processing node according to a preset order, and allocate the current data stream to be processed to the target processing node; If not, the processing node with the smallest current load among the processing nodes is used as the target processing node corresponding to the current data flow to be processed.

4. A method for processing large-volume data of a cryptographic device according to claim 1, characterized in that: The determining and outputting a matching result according to the real-time device fingerprint in the data stream to be processed and each device fingerprint in the device fingerprint library includes: Traversing each device fingerprint in the device fingerprint library, and judging whether the current device fingerprint and the real-time device fingerprint match each other for the traversed current device fingerprint; If so, determining that the matching result is that the cryptographic device to which the to-be-processed data stream belongs has the authority to access the processing device; If there is no device fingerprint matching the real-time device fingerprint in the device fingerprint library, a failure indication is sent to the cryptographic device to which the data stream to be processed belongs, and feature data sent by the cryptographic device to which the data stream to be processed belongs is obtained, the device fingerprint library is updated according to the feature data, and the matching result is re-determined and output based on the real-time device fingerprint and each device fingerprint in the device fingerprint library.

5. A method for processing large flow data of a cryptographic device according to claim 4, characterized in that: The updating of the device fingerprint library according to the feature data includes: Generate a device fingerprint based on the characteristic data and a randomly generated salt value; Update the device fingerprint and the salt value to the record corresponding to the cryptographic device to which the data stream to be processed belongs in the device fingerprint library; Send a registration success message to the user.

6. A method for processing large-volume data of a cryptographic device according to claim 1, characterized in that: Also includes: Acquire characteristic data of the cryptographic device, the characteristic data including: hardware characteristics, software characteristics and environmental characteristics; Generate a device fingerprint of the cryptographic device according to the characteristic data of the cryptographic device and a salt value corresponding to the cryptographic device; The cryptographic device identification of the cryptographic device, the device fingerprint and the salt value are stored in a device fingerprint library.

7. A method for processing large-volume data of a cryptographic device according to claim 6, characterized in that: The generating a device fingerprint according to the characteristic data of the cryptographic device and the salt value corresponding to the cryptographic device includes: Preprocessing the characteristic data of the cryptographic device to obtain processed characteristic data, wherein the preprocessing includes: clearing invalid data, clearing null values, and deduplication processing; Randomly generate a salt value corresponding to the cryptographic device; Based on the encryption conversion algorithm, the processed feature data of the cryptographic device and the salt value are encrypted and converted to obtain a device fingerprint.

8. A method for processing large-volume data of a cryptographic device according to any one of claims 1 to 7, characterized in that: The method further comprises: Receiving a deregistration instruction sent by a target cryptographic device, wherein the deregistration instruction includes an identification of the target cryptographic device; The corresponding record of the target password device in the device fingerprint library is deleted according to the identification of the target password device.

9. A cryptographic device high-volume data processing system, characterized in that: The cryptographic device large-flow data processing system includes a processing device and multiple cryptographic devices, the processing device includes multiple processing nodes, the processing device is connected to the multiple cryptographic devices, and the processing device is used to execute the cryptographic device large-flow data processing method as described in any one of claims 1-8 to perform data processing.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of the method for processing large-volume data of a cryptographic device as described in any one of claims 1 to 8.

Images