Cipher machine key smooth transition system based on time window

Abstract

The invention discloses a cipher machine key smooth transition system based on a time window, and relates to the technical field of key distribution. Firstly, relevant operation data of the cipher machine are collected, time window parameters of key smooth transition of the cipher machine are obtained through analysis, whether the time window parameters of key smooth transition of the cipher machine need to be adjusted or not can be assessed, and the time window parameters are optimized and adjusted. The condition that the performance of the cipher machine is reduced due to improper key transition can be reduced, then the key transition process of the cipher machine is analyzed, the security of the key can be evaluated, and the key needing to be updated in advance can be found as early as possible, so that the key is updated before being possibly leaked, and the security of the cipher machine is improved. And finally, analyzing to obtain a key smooth updating result of the cipher machine, and updating the key according to the key smooth updating result of the cipher machine, so that the security of the cipher machine in the whole key life cycle can be improved, and security vulnerabilities caused by non-compliance of key updating are reduced.

Description

Technical Field

[0001] The invention relates to the technical field of key distribution, in particular to a cryptographic machine key smooth transition system based on a time window. Background Art

[0002] In the field of cryptographic machine key transition technology, real-time processing technology can be used to monitor and process the data of the cryptographic machine and perform the key transition of the cryptographic machine in a timely manner. An unreasonable method of key transition of the cryptographic machine will directly affect the use of the cryptographic machine, and may cause high data interaction delays and high packet loss rates during the key transition process, which will in turn affect the stability and reliability of the cryptographic machine and affect the performance of the cryptographic machine.

[0003] The prior art, such as a key update method and a key update system announced in the invention patent with announcement number: CN109802827B, includes: when the first terminal device receives the key update command, it sends a key update command to the second terminal device; after receiving the key update command, the second terminal device obtains the key flag of the first terminal device, and determines whether the key flag of the first terminal device is the same as the key flag of the second terminal device. If they are the same, the key of the second terminal device and the key flag of the second terminal device are updated, and an update success message is sent to the first terminal device; after receiving the update success message, the first terminal device updates the key of the first terminal device and the key flag of the first terminal device.

[0004] The prior art, such as a key updating method announced in the invention patent with announcement number: CN101562521B, includes the following steps: a. reading an even key as an initialization vector; inputting the initialization vector into a cryptographic system; b. intercepting a key stream of a predetermined length output by the cryptographic system to update an odd key; c. encrypting and decrypting data using the even key; d. when the scheduled key update time arrives, reading an odd key as an initialization vector; inputting the initialization vector into the cryptographic system; e. intercepting a key stream of a predetermined length output by the cryptographic system to update an even key; f. encrypting and decrypting data using the odd key; g. when the scheduled key update time arrives, returning to step a.

[0005] Combining the above solutions, it is found that currently in the field of cryptographic machine key transition technology, there are usually two key update schemes, namely fixed time replacement scheme and negotiated replacement scheme. The fixed time replacement scheme has the problem that the key transition is not smooth enough, the replacement data is too long and packet loss is easy to occur, and both parties of the cryptographic machine rely on accurate time synchronization. The negotiated replacement scheme relies on data interaction between the two parties of the cryptographic machine, and is no longer applicable to scenarios with high data interaction delay and high packet loss rate. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a cryptographic machine key smooth transition system based on a time window, which can effectively solve the problems involved in the above-mentioned background technology.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a time window-based cipher machine key smooth transition system, including a data analysis module, used to collect relevant operating data of the cipher machine, analyze and obtain the key transition index value of the cipher machine, and then analyze and obtain the adjustment result of the cipher machine time window parameters.

[0008] The key transition module is used to obtain the time window parameters for the smooth transition of the key of the cipher machine according to the adjustment results of the time window parameters of the cipher machine, and perform the key transition of the cipher machine in combination with the time window parameters for the smooth transition of the key of the cipher machine.

[0009] The key transition process analysis module is used to analyze the key transition process of the cryptographic machine, obtain the key security index value of the cryptographic machine, and then analyze and obtain the key smoothing update result of the cryptographic machine, and update the key according to the key smoothing update result of the cryptographic machine, analyze the key within the key update time period, and provide prompts for adjustment.

[0010] Furthermore, the relevant operation data of the cryptographic machine includes the data flow of the cryptographic machine, the data processing volume of the cryptographic machine and the total number of key calls of the cryptographic machine.

[0011] The time window parameters of the key smooth transition of the cryptographic machine include the maximum clock error of the cryptographic machine, the maximum network delay of the cryptographic machine, the key activation time of the cryptographic machine, the key deactivation time of the cryptographic machine, the key pre-activation time of the cryptographic machine and the key expiration time of the cryptographic machine.

[0012] Furthermore, the analysis obtains the key transition index value of the cryptographic machine, and the specific analysis process is: setting several supervision cycles, and taking the ratio of the total number of key calls of the cryptographic machine in each supervision cycle to the duration of the supervision cycle as the key call frequency of the cryptographic machine in each supervision cycle.

[0013] The data flow and data processing volume of the cryptographic machine in each regulatory cycle are counted, and combined with the key call frequency of the cryptographic machine in each regulatory cycle, a comprehensive analysis is performed to obtain the key transition index value of the cryptographic machine. The key transition index value of the cryptographic machine is used to comprehensively quantify the influence of the data flow and data processing volume of the cryptographic machine on the key transition quality of the cryptographic machine.

[0014] Furthermore, the analysis obtains the adjustment result of the cipher machine time window parameter, and the specific analysis process is: comparing the key transition index value of the cipher machine with the set key transition index threshold of the cipher machine to obtain the adjustment result of the cipher machine time window parameter.

[0015] The adjustment results of the cipher machine time window parameters include need for adjustment and no need for adjustment. If the key transition index value of the cipher machine is higher than or equal to the set key transition index threshold of the cipher machine, then the adjustment result of the cipher machine time window parameters is need for adjustment; if the key transition index value of the cipher machine is lower than the set key transition index threshold of the cipher machine, then the adjustment result of the cipher machine time window parameters is no need for adjustment.

[0016] Furthermore, according to the adjustment result of the time window parameter of the cipher machine, the time window parameter of the key smooth transition of the cipher machine is obtained, and the specific analysis process is: if the adjustment result of the time window parameter of the cipher machine is that adjustment is required, then the time window correction parameter of the key smooth transition of the cipher machine is obtained according to the key transition index value of the cipher machine, and the time window correction parameter of the key smooth transition of the cipher machine is added to the time window parameter of the key smooth transition of the corresponding cipher machine stored in the cipher machine key transition database as the time window parameter of the key smooth transition of the cipher machine.

[0017] If the adjustment result of the cipher machine time window parameter is that no adjustment is required, the time window parameter of the key smooth transition of the cipher machine stored in the cipher machine key transition database is used as the time window parameter of the key smooth transition of the cipher machine.

[0018] Furthermore, the key transition of the cipher machine is performed in combination with the time window parameters of the key smooth transition of the cipher machine. The specific process is: designing the time window of the key according to the time window parameters of the key smooth transition of the cipher machine.

[0019] The specific process of designing the key time window is to arrange the time window parameters of the smooth transition of the key of the adjusted cipher machine in chronological order as pre-activation time, activation time, deactivation time and expiration time, and divide the key of the cipher machine into an unactivated state, a to-be-activated state, an activated state, a to-be-expired state and an expired state to obtain the key time window.

[0020] The key transition of the cipher machine is carried out in combination with the key time window. The specific process is to obtain the key information on the current cipher machine, including the key pre-activation time, activation time, deactivation time and expiration time of the current cipher machine, design a new key time window for the new key of the cipher machine, determine the new key pre-activation time, activation time, deactivation time and expiration time of the cipher machine, and set the key deactivation time of the current cipher machine as the new key activation time of the cipher machine.

[0021] Furthermore, the key transition process of the cryptographic machine is analyzed, and the specific analysis process is: the key transition process of the cryptographic machine is analyzed including the response time of the decryption operation of the cryptographic machine, the total number of decryption failures of the cryptographic machine and the key call frequency of the cryptographic machine.

[0022] Monitor the response time of the decryption operation of the cryptographic machine and the total number of decryption failures of the cryptographic machine in each regulatory cycle, and combine the key call frequency of the cryptographic machine in each regulatory cycle to obtain the key security index value of the cryptographic machine in each regulatory cycle. The key security index value of the cryptographic machine in each regulatory cycle is used to comprehensively quantify the impact of the response time of the decryption operation of the cryptographic machine and the total number of decryption failures on the key security quality of the cryptographic machine.

[0023] Furthermore, the analysis obtains a key smoothing update result of the cryptographic machine, and the specific analysis process is: the key smoothing update result of the cryptographic machine includes a key that needs to be updated and a key that does not need to be updated.

[0024] The key security index value of the cipher machine in each supervision cycle is compared with the set key security index threshold of the cipher machine to obtain the key smoothing update result of the cipher machine. If the key security index value of the cipher machine in a certain supervision cycle is higher than or equal to the set key security index threshold of the cipher machine, the key smoothing update result of the cipher machine in this supervision cycle is set to no need to update.

[0025] If the key security index value of the cryptographic machine within a certain supervision period is lower than the set key security index threshold of the cryptographic machine, the key smoothing update result of the cryptographic machine within the supervision period is set as needing to be updated, and then the key is updated based on the key smoothing update result and the adjusted time window parameter of the key smoothing transition of the cryptographic machine.

[0026] Furthermore, the key is updated according to the key smoothing update result in combination with the adjusted time window parameters of the key smoothing transition of the cryptographic machine. The specific analysis process is: if the key smoothing update result of the cryptographic machine is that updating is required, the key setting is updated, and the time window of the updated key is designed in combination with the adjusted time window parameters of the key smoothing transition of the cryptographic machine, the original key is updated to the updated key, the updated key activation time is set to the original key deactivation time, the original key original deactivation time is set to the updated key deactivation time, and the original key original expiration time is set to the updated key expiration time.

[0027] Furthermore, the key transition index value of the cipher machine is specifically analyzed under the following conditions:

[0028] In the formula, α represents the key transition index value of the cipher machine, A 1→i represents the data flow of the cipher machine in the i-th supervision cycle, Indicates the weight factor corresponding to the set data flow, A 2→i represents the data processing volume of the cipher machine in the i-th supervision cycle, Indicates the weight factor corresponding to the set data processing amount, A3→i represents the key call frequency of the cipher machine in the i-th supervision cycle, It represents the weight factor corresponding to the set key call frequency, i represents the number of each supervision cycle, i=1,2,3,…n, and n represents the total number of supervision cycles.

[0029] The present invention has the following beneficial effects:

[0030] (1) The present invention provides a cryptographic machine key smooth transition system based on a time window. First, the adjustment result of the cryptographic machine time window parameter is analyzed to accurately evaluate whether the cryptographic machine time window parameter needs to be adjusted. Then, the time window parameter of the cryptographic machine key smooth transition is analyzed to improve the smoothness and stability of the key transition process. Finally, the key smooth update result of the cryptographic machine is analyzed to perform key update, which can improve the security of the key.

[0031] (2) The present invention can reduce key transition errors caused by parameter mismatch by analyzing the adjustment results of the time window parameters of the cipher machine, improve the accuracy of the key transition operation, reduce the interruptions or instability that may occur during the key transition process, improve the stability and reliability of the cipher machine, reduce the risks of security vulnerabilities or operation interruptions that may occur during the key transition period, and enhance the security of the cipher machine.

[0032] (3) The present invention performs key transition of the cryptographic machine in combination with the time window parameters of the cryptographic machine's key smooth transition. By accurately setting the time window parameters, the error rate in the key transition of the cryptographic machine is reduced, thereby improving the accuracy of the key replacement operation, reducing repeated adjustments caused by the poor key transition of the cryptographic machine, improving the efficiency of the key transition operation, saving time and resources, and enhancing the reliability of the cryptographic machine.

[0033] (4) The present invention obtains the key smoothing update result of the cryptographic machine through analysis, and performs key update according to the key smoothing update result of the cryptographic machine, which helps to reduce the service interruption of the cryptographic machine that may occur due to key leakage. At the same time, timely and accurate key updates reduce the security risks caused by key leakage or suspected leakage, improve the security protection capability of the cryptographic machine, and can quickly and accurately complete the key update, thereby improving the response capability of the cryptographic machine.

[0034] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of system module connection of the present invention;

[0036] Figure 2An example diagram of the key security index value of a cryptographic machine;

[0037] Figure 3 An image of a time window of a cryptographic key;

[0038] Figure 4 It is an image of the process of key transition for a single cipher machine;

[0039] Figure 5 This is an image of the process of key transition between two cipher machines;

[0040] Figure 6 This is an image of the process of updating the key of a cryptographic machine. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] See also Figure 1 As shown, an embodiment of the present invention provides a technical solution: a cryptographic machine key smooth transition system based on a time window, including a data analysis module for collecting relevant operating data of the cryptographic machine, analyzing to obtain the key transition index value of the cryptographic machine, and then analyzing to obtain the adjustment result of the cryptographic machine time window parameter.

[0043] The key transition module is used to obtain the time window parameters for the smooth transition of the key of the cipher machine according to the adjustment results of the time window parameters of the cipher machine, and perform the key transition of the cipher machine in combination with the time window parameters for the smooth transition of the key of the cipher machine.

[0044] It should be added that the key transition of the cryptographic machine means replacing the key of the cryptographic machine.

[0045] The key transition process analysis module is used to analyze the key transition process of the cryptographic machine, obtain the key security index value of the cryptographic machine, and then analyze and obtain the key smoothing update result of the cryptographic machine, and update the key according to the key smoothing update result of the cryptographic machine, analyze the key within the key update time period, and provide prompts for adjustment.

[0046] It should be noted that if Figure 6 As shown, the key update time period refers to the length of the overlapping time period of key 1 and the updated key between the updated key setting time and the updated key expiration time.

[0047] It should be added that the keys within the key update period are analyzed and prompted for adjustment. The specific process is that the updated key is used to decrypt the cipher machine during the period between the updated key setting time and the activation time. If the cipher machine cannot perform the decryption operation, it means that the updated key setting has failed. It is necessary to prompt the staff and re-update the key of the cipher machine. If the decryption operation can be performed, it means that the updated key setting is successful and a second judgment is required.

[0048] It should be added that the second judgment is carried out. The specific process is to use key 1 to perform encryption operations on the cipher machine in the time period between the updated key activation time and the key 1 expiration time. If the cipher machine can perform encryption operations, it means that the deactivation time setting of key 1 is incorrect, and it is necessary to remind the staff to reset the key time window of key 1. If the cipher machine cannot perform encryption operations, it means that the deactivation time setting of key 1 is successful, and then use the updated key to perform encryption operations on the cipher machine. If the cipher machine cannot perform encryption operations, it means that the updated key has not been successfully enabled and needs to be updated again. If the cipher machine can perform encryption operations, it means that the updated key has been successfully enabled and a third judgment is required.

[0049] It should be added that the third judgment is carried out. The specific process is that in the time period between the updated key deactivation time and the expiration time, key 1 is used to decrypt the cipher machine, and the updated key is used to encrypt the cipher machine. If key 1 can decrypt the cipher machine, it means that key 1 has not successfully entered the expiration state. If the updated key can encrypt the cipher machine, it means that the updated deactivation time setting is incorrect, and a prompt is required, and the key time window is reset. If both operations cannot be performed, it means that key 1 and the updated key are both successful. Then key 2 is used to encrypt and decrypt the cipher machine. If successful, it means that the cipher machine key update is successful. If unsuccessful, it means that key 2 is unsuccessful, and the staff needs to be prompted and the key of the cipher machine needs to be updated again.

[0050] It should be noted that by analyzing and judging the key three times during the key update period, we can fully understand the key update process, which helps to confirm whether the key is successfully updated, thereby improving the security and reliability of the cryptographic machine. At the same time, it can timely discover potential security vulnerabilities and improve the confidentiality and integrity of data transmission.

[0051] Specifically, the relevant operating data of the cryptographic machine includes the data flow of the cryptographic machine, the data processing volume of the cryptographic machine and the total number of key calls of the cryptographic machine.

[0052] It should be noted that the data traffic of the cryptographic machine refers to the amount of data processed by the cryptographic machine in each regulatory cycle, which is usually obtained by calculating the total number of bytes passing through the cryptographic machine using device logs. The data processing volume of the cryptographic machine refers to the total amount of data processed by the cryptographic machine, including encryption and decryption operations, which can be obtained by analyzing the operation logs of the cryptographic machine. The total number of key calls of the cryptographic machine refers to the total number of times the cryptographic machine calls the key in each regulatory cycle, which can be obtained by using special monitoring tools.

[0053] The time window parameters of the key smooth transition of the cryptographic machine include the maximum clock error of the cryptographic machine, the maximum network delay of the cryptographic machine, the key activation time of the cryptographic machine, the key deactivation time of the cryptographic machine, the key pre-activation time of the cryptographic machine and the key expiration time of the cryptographic machine.

[0054] It should be noted that the maximum clock error of a cryptographic machine refers to the deviation between the internal clock of the cryptographic machine and the standard time, which is measured by synchronizing the clock of the cryptographic machine with a standard time source (such as a network time protocol server). The maximum network delay of a cryptographic machine refers to the longest time required for a data packet of the cryptographic machine to be sent and received in network communication, which is usually measured by a network delay testing tool (such as an Internet packet explorer).

[0055] Specifically, the key transition index value of the cipher machine is analyzed and obtained. The specific analysis process is: set several supervision cycles, and take the ratio of the total number of key calls of the cipher machine in each supervision cycle to the duration of the supervision cycle as the key call frequency of the cipher machine in each supervision cycle.

[0056] The data flow and data processing volume of the cryptographic machine in each regulatory cycle are counted, and combined with the key call frequency of the cryptographic machine in each regulatory cycle, a comprehensive analysis is performed to obtain the key transition index value of the cryptographic machine. The key transition index value of the cryptographic machine is used to comprehensively quantify the influence of the data flow and data processing volume of the cryptographic machine on the key transition quality of the cryptographic machine.

[0057] It should be noted that the key transition index value of the cryptographic machine represents the numerical quantification result of the key transition quality of the cryptographic machine within the supervision period obtained by analyzing the relevant operation data of the cryptographic machine.

[0058] Specifically, the adjustment result of the cipher machine time window parameter is analyzed and obtained. The specific analysis process is: comparing the key transition index value of the cipher machine with the set key transition index threshold of the cipher machine to obtain the adjustment result of the cipher machine time window parameter.

[0059] The adjustment results of the cipher machine time window parameters include need for adjustment and no need for adjustment. If the key transition index value of the cipher machine is higher than or equal to the set key transition index threshold of the cipher machine, then the adjustment result of the cipher machine time window parameters is need for adjustment; if the key transition index value of the cipher machine is lower than the set key transition index threshold of the cipher machine, then the adjustment result of the cipher machine time window parameters is no need for adjustment.

[0060] Specifically, according to the adjustment result of the time window parameter of the cipher machine, the time window parameter of the key smooth transition of the cipher machine is obtained, and the specific analysis process is: if the adjustment result of the time window parameter of the cipher machine is that adjustment is required, then the time window correction parameter of the key smooth transition of the cipher machine is obtained according to the key transition index value of the cipher machine, and the time window correction parameter of the key smooth transition of the cipher machine is added to the time window parameter of the key smooth transition of the corresponding cipher machine stored in the cipher machine key transition database as the time window parameter of the key smooth transition of the cipher machine.

[0061] It should be noted that the time window correction parameter for the key smooth transition of the cipher machine is obtained by matching the key transition index value of the cipher machine. The specific process is to construct a mapping set between the key transition index value interval of the cipher machine and its corresponding time window correction parameter for the key smooth transition of the cipher machine, input the real-time key transition index value of the cipher machine, match the interval where the key transition index value of the cipher machine is located, and obtain the time window correction parameter for the key smooth transition of the cipher machine corresponding to the key transition index value of the cipher machine through the mapping set.

[0062] It should be noted that the time window correction parameters for smooth key transition include the maximum clock error correction value of the cipher machine and the maximum network delay correction value of the cipher machine.

[0063] It should be added that the key time window can be adjusted by adjusting the time window correction parameter of the key smooth transition, thereby improving the reliability and security of key replacement.

[0064] If the adjustment result of the cipher machine time window parameter is that no adjustment is required, the time window parameter of the key smooth transition of the cipher machine stored in the cipher machine key transition database is used as the time window parameter of the key smooth transition of the cipher machine.

[0065] It should be noted that the time window parameters for the smooth transition of the key of the cipher machine stored in the cipher machine key transition database are used for the transition process of the historical cipher machine, and the adjustment result of the time window parameters of the cipher machine is that no adjustment is required, which means that the time window parameters for the smooth transition of the key of the stored cipher machine do not need to be adjusted, and can be directly applied to the next key transition process.

[0066] Specifically, the key transition of the cipher machine is performed in combination with the time window parameters of the key smooth transition of the cipher machine. The specific process is: designing the key time window according to the time window parameters of the key smooth transition of the cipher machine.

[0067] The specific process of designing the key time window is to arrange the time window parameters of the smooth transition of the key of the adjusted cipher machine in chronological order as pre-activation time, activation time, deactivation time and expiration time, and divide the key of the cipher machine into an unactivated state, a to-be-activated state, an activated state, a to-be-expired state and an expired state to obtain the key time window.

[0068] It should be noted that the unactivated state of the key represents the state of the key before the key pre-activation time of the cryptographic machine, the to-be-activated state represents the state of the key between the key pre-activation time and the key activation time of the cryptographic machine, the activated state represents the state of the key between the key activation time and the key deactivation time of the cryptographic machine, the to-be-expired state represents the state of the key between the key deactivation time and the key expiration time of the cryptographic machine, and the expired state represents the state of the key after the key expiration time of the cryptographic machine.

[0069] It should be added that Figure 3 The figure is an image of the time window of the key of the cipher machine. In the figure, the pre-activation time is the time point of the activation time advanced by a fixed length window n, and the expiration time is the time point of the deactivation time postponed by a fixed length window m. The values ​​of n and m directly affect the reliability and security of key replacement. When the values ​​of n and m are set too small, business data packet loss will occur, and when the values ​​of n and m are set too large, excessive use of keys will result in certain security risks. By setting a double time window before and after the key activation and deactivation time, the problem of smooth key replacement during the key transition process is solved.

[0070] It should be added that the key in the startup state can be used to encrypt and decrypt business data, the key in the waiting-to-start state can only be used to decrypt business data, the key in the waiting-to-expiry state can also only be used to decrypt business data, the key in the unenabled state cannot be used to encrypt and decrypt business data, and the key in the expired state can no longer be used to encrypt and decrypt business data. In order to free up key storage space, the key in this state should be deleted from the device.

[0071] The key transition of the cipher machine is carried out in combination with the key time window. The specific process is to obtain the key information on the current cipher machine, including the key pre-activation time, activation time, deactivation time and expiration time of the current cipher machine, design a new key time window for the new key of the cipher machine, determine the new key pre-activation time, activation time, deactivation time and expiration time of the cipher machine, and set the key deactivation time of the current cipher machine as the new key activation time of the cipher machine.

[0072] It should be noted that the above-mentioned key transition of the cipher machine in combination with the key time window is a process of key transition for a single cipher machine. Figure 4 This is an image of the key transition process for a single cipher machine. In the figure, Key 1 represents the key of the current cipher machine, and Key 2 represents the new key of the cipher machine. The two keys should be kept continuous on the timeline, that is, the deactivation time of Key 1 coincides with the activation time of Key 2.

[0073] It should be added that Figure 5 Figure 3 is a process image of key transition between two cipher machines. Key transition is performed on the two cipher machines. The specific process is to set the deactivation time of key 1 of cipher machine 1 to the activation time of key 2 of cipher machine 1, and to set the deactivation time of key 1 of cipher machine 2 to the activation time of key 2 of cipher machine 2. The dotted box area is the time period when key 1 and key 2 can be decrypted on both cipher machines. c represents the maximum clock error of the cipher machine. When c plus the maximum network delay of the cipher machine are less than n and m at the same time, the encryption switching time points of the two cipher machines are both within the box. At this time, there will be no packet loss problem when replacing the keys of the two cipher machines. The values ​​of m and n can be determined by adjusting the time window parameters for smooth key transition. The values ​​of m and n are the sum of twice the maximum clock error of the cipher machine and the maximum network delay of the cipher machine.

[0074] In this implementation, the key replacement process does not rely on data interaction with cipher machines and can be applied in scenarios where data interaction is inconvenient such as satellite communications. A time window management design is added on the basis of the fixed-time key replacement method. While retaining the advantages of the fixed-time key replacement method such as simplicity and ease of implementation and independence from data interaction between cipher machines, it also solves the shortcomings of fixed-time replacement such as insufficient smoothness of switching, easy packet loss, and dependence on precise time synchronization.

[0075] Specifically, the key transition process of the cryptographic machine is analyzed, and the specific analysis process is: the analysis of the key transition process of the cryptographic machine includes analyzing the response time of the decryption operation of the cryptographic machine, the total number of decryption failures of the cryptographic machine and the key call frequency of the cryptographic machine.

[0076] Monitor the response time of the decryption operation of the cryptographic machine and the total number of decryption failures of the cryptographic machine in each regulatory cycle, and combine the key call frequency of the cryptographic machine in each regulatory cycle to obtain the key security index value of the cryptographic machine in each regulatory cycle. The key security index value of the cryptographic machine in each regulatory cycle is used to comprehensively quantify the impact of the response time of the decryption operation of the cryptographic machine and the total number of decryption failures on the key security quality of the cryptographic machine.

[0077] It should be added that the response time of the decryption operation of the cipher machine refers to the time interval from the receipt of the decryption request to the completion of the decryption and the return of the result. Usually, the timestamps of the decryption request and response are obtained by checking the operation log of the cipher machine, and the difference between the timestamps of the decryption request and response is calculated to obtain the response time of the decryption operation. The total number of decryption failures of the cipher machine refers to the total number of failures that occur in the decryption process of the cipher machine during the supervision period. The total number of decryption failures of the cipher machine is obtained by analyzing the operation log of the cipher machine and statistically recording the total number of decryption failure events.

[0078] It should be noted that the key security index value of the cipher machine represents the numerical quantification result of the key security index value obtained by analyzing the key transition process of the cipher machine, which can be obtained by the following analysis method. The specific analysis conditions are as follows:

[0079]

[0080] In the formula, β i represents the key security index value of the cipher machine in the i-th supervision cycle, B 1→i represents the response time of the decryption operation of the cipher machine in the i-th supervision cycle, μ1 represents the correction factor corresponding to the set response time, and B 2→i represents the total number of decryption failures of the cipher machine in the i-th supervision cycle, μ2 represents the correction factor corresponding to the set number of decryption failures, and A 3→i It represents the key call frequency of the cipher machine in the i-th supervision cycle, μ3 represents the correction factor corresponding to the set key call frequency, i represents the number of each supervision cycle, i=1,2,3,…n, n represents the total number of supervision cycles, and e represents a natural constant.

[0081] In a specific embodiment, Table 1 shows the response time, total number of decryption failures, key call frequency and key security index value of the decryption operation of the cipher machine in different supervision cycles. In this embodiment, the correction factor corresponding to the response time is 0.3, the correction factor corresponding to the number of decryption failures is 0.3, and the correction factor corresponding to the key call frequency is 0.4.

[0082] Table 1 Response time of decryption operation, total number of decryption failures, key call frequency and key security index values ​​of cryptographic machines in different supervision cycles

[0083]

[0084]

[0085] It should be explained that in Table 1, as the total number of decryption failures and key call frequency of the cipher machine increase, the key security index value decreases accordingly, and as the response time of the decryption operation of the cipher machine increases accordingly, the key security index value increases accordingly. Table 1 lists the response time of the decryption operation of the cipher machine in four different regulatory cycles, the total number of decryption failures and key call frequency, and the corresponding key security index values ​​are obtained through the formula. These key security index values ​​provide the degree of influence of the key call frequency of the cipher machine in different regulatory cycles on the key security index value. The key security index value comprehensively considers the response time of the decryption operation of the cipher machine, the total number of decryption failures and key call frequency, provides data support for the smooth update of the key of the cipher machine, and improves the accuracy of the key security index value evaluation of the cipher machine.

[0086] It needs to be explained that Figure 2 This is an example diagram of the key security index value of the cipher machine, such as Figure 2 As shown, the x-axis represents the response time of the decryption operation of the cipher machine, and the y-axis represents the key security index value of the cipher machine. In this embodiment, the key call frequency of the cipher machine is 2 times / second. Three different groups of example parameters are defined in the figure, corresponding to different situations of the three curves, represented by solid lines, dashed lines and dotted lines, respectively, and the corresponding curve labels are a, b, and c.

[0087] It needs to be explained that, when the total number of decryption failures of the cipher machine is 3, the functional relationship between the response time of the decryption operation of the cipher machine and the key security index value of the cipher machine is shown as curve a, when the total number of decryption failures of the cipher machine is 4, the functional relationship between the response time of the decryption operation of the cipher machine and the key security index value of the cipher machine is shown as curve b, when the total number of decryption failures of the cipher machine is 5, the functional relationship between the response time of the decryption operation of the cipher machine and the key security index value of the cipher machine is shown as curve c, the key security index value of the cipher machine increases with the increase of the response time of the decryption operation of the cipher machine, when the total number of decryption failures of the cipher machine increases, the key security index value of the cipher machine decreases accordingly, and the key security index value of the cipher machine can be quickly and accurately obtained through the curve, which solves the problem in the prior art that the key security index value of the cipher machine cannot be accurately analyzed due to the insufficiently detailed analysis process, thereby realizing accurate analysis of the key security index value of the cipher machine.

[0088] It should be noted that in the present embodiment, the correction factor corresponding to the preset response time, the correction factor corresponding to the number of decryption failures and the correction factor corresponding to the key call frequency are obtained from the cipher machine key transition database, and the correction factor corresponding to the preset response time, the correction factor corresponding to the number of decryption failures and the correction factor corresponding to the key call frequency are all numbers between 0 and 1.

[0089] It should be noted that the correction factor corresponding to the response time represents the numerical value of the influence of the response time on the key security index value of the cipher machine, the correction factor corresponding to the number of decryption failures represents the numerical value of the influence of the number of decryption failures on the key security index value of the cipher machine, and the correction factor corresponding to the key call frequency represents the numerical value of the influence of the number of decryption failures on the key security index value of the cipher machine. These corresponding relationships are pre-set mapping relationships. For example, the response time and the correction factor corresponding to the preset response time obtained from the cipher machine key transition database form a mapping set, and the response time of the real-time decryption operation of the cipher machine is input into the mapping set to obtain the correction factor corresponding to the response time of the decryption operation of the cipher machine.

[0090] It should be added that the response time of the decryption operation of the cipher machine in each regulatory cycle, the total number of decryption failures and the key call frequency in this formula are correlated and do not exist independently. For example, a longer response time may mean a higher load on the cipher machine, which may lead to more failures. As the key call frequency increases, the load on the cipher machine will increase, which may lead to an increase in the response time.

[0091] It should be noted that the longer the response time of the decryption operation, the more secure the key. By analyzing the response time, it is possible to identify early and decide whether the key needs to be updated in advance to maintain the performance and security of the cryptographic machine. An increase in the total number of decryption failures may indicate that there is a problem with the key in actual use. By monitoring these failures, it is possible to decide in time whether the key needs to be updated in advance to prevent the security risk of the cryptographic machine from increasing. A high key call frequency indicates that the key is used intensively, which can reveal the key's stress level. By monitoring the call frequency, it is possible to more accurately assess whether the key needs to be updated in advance due to excessive use, so as to reduce security risks caused by the degradation of the cryptographic machine's performance.

[0092] In this implementation, a comprehensive analysis is performed on the response time of the decryption operation of the cipher machine, the total number of decryption failures and the key call frequency to obtain the key security index value of the cipher machine, which can evaluate the risk index of the cipher machine key transition and further determine whether the key needs to be updated.

[0093] Specifically, the key smoothing update result of the cipher machine is obtained by analysis, and the specific analysis process is: the key smoothing update result of the cipher machine includes the key that needs to be updated and the key that does not need to be updated.

[0094] The key security index value of the cipher machine in each supervision cycle is compared with the set key security index threshold of the cipher machine to obtain the key smoothing update result of the cipher machine. If the key security index value of the cipher machine in a certain supervision cycle is higher than or equal to the set key security index threshold of the cipher machine, the key smoothing update result of the cipher machine in this supervision cycle is set to no need to update.

[0095] It should be added that, by analyzing the key smoothing update results of the cipher machine, it is possible to evaluate the risk value of the cipher machine key leakage or suspected leakage, and then determine whether the key needs to be updated.

[0096] If the key security index value of the cryptographic machine within a certain supervision period is lower than the set key security index threshold of the cryptographic machine, the key smoothing update result of the cryptographic machine within the supervision period is set as needing to be updated, and then the key is updated based on the key smoothing update result and the adjusted time window parameter of the key smoothing transition of the cryptographic machine.

[0097] Specifically, according to the key smoothing update result, the key is updated in combination with the adjusted time window parameters of the key smooth transition of the cipher machine. The specific analysis process is: if the key smoothing update result of the cipher machine is that updating is required, the key setting is updated, and the time window of the updated key is designed in combination with the adjusted time window parameters of the key smooth transition of the cipher machine, the original key is updated to the updated key, the updated key activation time is set to the original key deactivation time, the original key original deactivation time is set to the updated key deactivation time, and the original key original expiration time is set to the updated key expiration time.

[0098] It should be added that Figure 6 The figure shows the process of updating the key of the cipher machine. In the figure, key 1 represents the original key of the cipher machine, and the updated key represents the updated key of the cipher machine. After the updated key is set, the expiration time of key 1 is set to a time window m after the deactivation time of key 1 after the update. The activation time of the updated key is the same as other key activation times, which is a specific time point. The delay time d between the updated key setting time and the updated key activation time is used to ensure that all devices have completed the settings before the updated key is enabled. In order to ensure that there is no packet loss during the key update process, when setting the new key activation time, the reserved delay time d is the sum of the new key synchronization setting time difference, twice the maximum clock error of the cipher machine and the maximum network delay of the cipher machine.

[0099] Specifically, the key transition index value of the cipher machine, the specific analysis conditions are:

[0100]

[0101] In the formula, α represents the key transition index value of the cipher machine, A 1→i represents the data flow of the cipher machine in the i-th supervision cycle, Indicates the weight factor corresponding to the set data flow, A 2→i represents the data processing volume of the cipher machine in the i-th supervision cycle, Indicates the weight factor corresponding to the set data processing amount, A 3→ represents the key call frequency of the cipher machine in the i-th supervision cycle, It represents the weight factor corresponding to the set key call frequency, i represents the number of each supervision cycle, i=1,2,3,…n, and n represents the total number of supervision cycles.

[0102] It should be noted that in the present embodiment, the preset weight factor corresponding to the data flow, the weight factor corresponding to the data processing volume, and the weight factor corresponding to the key call frequency are obtained from the cipher machine key transition database, and the preset weight factor corresponding to the data flow, the weight factor corresponding to the data processing volume, and the weight factor corresponding to the key call frequency obtained from the cipher machine key transition database are all numbers between 0 and 1.

[0103] It should be noted that the weight factor corresponding to the data flow represents the numerical value of the influence of the data flow on the key transition index value of the cipher machine, the weight factor corresponding to the data processing volume represents the numerical value of the influence of the data processing volume on the key transition index value of the cipher machine, and the weight factor corresponding to the key call frequency represents the numerical value of the influence of the key call frequency on the key transition index value of the cipher machine. These corresponding relationships are pre-set mapping relationships. For example, the data flow and the weight factor corresponding to the preset data flow obtained from the cipher machine key transition database form a mapping set, and the real-time data flow of the cipher machine is input into the mapping set to obtain the weight factor corresponding to the data flow of the cipher machine.

[0104] It should be added that the data flow, data processing volume and key call frequency of the cryptographic machine in each regulatory cycle in this formula are correlated and do not exist independently. For example, data flow and data processing volume are usually positively correlated. A larger data flow usually means that the cryptographic machine needs to process more data, thereby increasing the data processing volume of the cryptographic machine.

[0105] It should be noted that by analyzing the key transition index values ​​of the cryptographic machine under different data traffic conditions, it can be determined whether more frequent key transitions are required under high data traffic conditions to ensure the security and effectiveness of data encryption. By analyzing the data processing volume of the cryptographic machine, the key transition requirements can be more accurately measured. By analyzing the key call frequency of the cryptographic machine, the performance of the key in actual operation can be more accurately evaluated, thereby determining whether the time window parameters for the smooth key transition of the cryptographic machine need to be adjusted.

[0106] It should be added that, in the process of analyzing the key transition index value of the cryptographic machine, analyzing the key call frequency of the cryptographic machine helps to identify whether the key is used frequently, thereby optimizing the time window parameters for the smooth transition of the key. In the process of analyzing the key security index value of the cryptographic machine, analyzing the key call frequency of the cryptographic machine can identify abnormal patterns early and discover potential key leakage risks in time, and then determine whether the key needs to be updated in advance.

[0107] In this implementation, a comprehensive analysis is performed on the data flow, data processing volume and key call frequency of the cryptographic machine to obtain the key transition index value of the cryptographic machine, which can be used to analyze the key usage efficiency and security, and then adjust the time window parameters for the smooth transition of the key of the cryptographic machine.

[0108] It should be added that a time window-based cipher machine key smooth transition system also includes a cipher machine key transition database, which is used to store the cipher machine's key transition index threshold obtained by analyzing historical data, the correction factor corresponding to the response time, the correction factor corresponding to the number of decryption failures, the correction factor corresponding to the key call frequency, the cipher machine's key security index threshold, the cipher machine's key smooth transition time window parameter, the data flow corresponding to the weight factor, the data processing amount corresponding to the weight factor and the key call frequency corresponding to the weight factor.

[0109] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0110] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well.

Claims

1. A cryptographic machine key smooth transition system based on a time window, characterized in that: include: The data analysis module is used to collect relevant operation data of the cipher machine, analyze and obtain the key transition index value of the cipher machine, and then analyze and obtain the adjustment result of the time window parameter of the cipher machine; A key transition module, used to obtain a time window parameter for smooth key transition of the cipher machine according to an adjustment result of the time window parameter of the cipher machine, and perform key transition of the cipher machine in combination with the time window parameter for smooth key transition of the cipher machine; The key transition process analysis module is used to analyze the key transition process of the cryptographic machine, obtain the key security index value of the cryptographic machine, and then analyze and obtain the key smoothing update result of the cryptographic machine, and update the key according to the key smoothing update result of the cryptographic machine, analyze the key within the key update time period, and provide prompts for adjustment.

2. According to claim 1, a time window-based cipher key smooth transition system is characterized by: The relevant operation data of the cryptographic machine include the data flow of the cryptographic machine, the data processing volume of the cryptographic machine and the total number of key calls of the cryptographic machine; The time window parameters of the key smooth transition of the cryptographic machine include the maximum clock error of the cryptographic machine, the maximum network delay of the cryptographic machine, the key activation time of the cryptographic machine, the key deactivation time of the cryptographic machine, the key pre-activation time of the cryptographic machine and the key expiration time of the cryptographic machine.

3. The cryptographic machine key smooth transition system based on time window according to claim 2 is characterized in that: The analysis obtains the key transition index value of the cipher machine, and the specific analysis process is: Set a number of supervision cycles, and use the ratio of the total number of key calls of the cipher machine in each supervision cycle to the duration of the supervision cycle as the key call frequency of the cipher machine in each supervision cycle; The data flow and data processing volume of the cryptographic machine in each regulatory cycle are counted, and combined with the key call frequency of the cryptographic machine in each regulatory cycle, a comprehensive analysis is performed to obtain the key transition index value of the cryptographic machine. The key transition index value of the cryptographic machine is used to comprehensively quantify the influence of the data flow and data processing volume of the cryptographic machine on the key transition quality of the cryptographic machine.

4. The cryptographic machine key smooth transition system based on time window according to claim 1 is characterized in that: The analysis obtains the adjustment result of the cipher machine time window parameter, and the specific analysis process is: Compare the key transition index value of the cipher machine with the set key transition index threshold of the cipher machine to obtain the adjustment result of the cipher machine time window parameter; The adjustment results of the cipher machine time window parameters include need for adjustment and no need for adjustment. If the key transition index value of the cipher machine is higher than or equal to the set key transition index threshold of the cipher machine, then the adjustment result of the cipher machine time window parameters is need for adjustment; if the key transition index value of the cipher machine is lower than the set key transition index threshold of the cipher machine, then the adjustment result of the cipher machine time window parameters is no need for adjustment.

5. A time window-based cipher key smooth transition system according to claim 4, characterized in that: According to the adjustment result of the cipher machine time window parameter, the time window parameter of the key smooth transition of the cipher machine is obtained. The specific analysis process is: If the adjustment result of the cipher machine time window parameter is that adjustment is required, then the time window correction parameter of the key smooth transition of the cipher machine is obtained according to the key transition index value of the cipher machine, and the time window correction parameter of the key smooth transition of the cipher machine is added to the time window parameter of the key smooth transition of the corresponding cipher machine stored in the cipher machine key transition database as the time window parameter of the key smooth transition of the cipher machine; If the adjustment result of the cipher machine time window parameter is that no adjustment is required, the time window parameter of the key smooth transition of the cipher machine stored in the cipher machine key transition database is used as the time window parameter of the key smooth transition of the cipher machine.

6. The cryptographic machine key smooth transition system based on time window according to claim 1 is characterized in that: The key transition of the cipher machine is performed in combination with the time window parameter of the key smooth transition of the cipher machine. The specific process is: Design the key time window according to the time window parameter of the key smooth transition of the cipher machine; The specific process of designing the time window of the key is to arrange the time window parameters of the smooth transition of the key of the cipher machine after adjustment in chronological order as pre-activation time, activation time, deactivation time and expiration time, and divide the key of the cipher machine into an unactivated state, a state to be activated, an activated state, a state to be expired and an expired state to obtain the time window of the key; The key transition of the cipher machine is carried out in combination with the key time window. The specific process is to obtain the key information on the current cipher machine, including the key pre-activation time, activation time, deactivation time and expiration time of the current cipher machine, design a new key time window for the new key of the cipher machine, determine the new key pre-activation time, activation time, deactivation time and expiration time of the cipher machine, and set the key deactivation time of the current cipher machine as the new key activation time of the cipher machine.

7. The cryptographic machine key smooth transition system based on time window according to claim 1 is characterized in that: The key transition process of the cipher machine is analyzed, and the specific analysis process is as follows: The analysis of the key transition process of the cipher machine includes analyzing the response time of the decryption operation of the cipher machine, the total number of decryption failures of the cipher machine and the key call frequency of the cipher machine; Monitor the response time of the decryption operation of the cryptographic machine and the total number of decryption failures of the cryptographic machine in each regulatory cycle, and combine the key call frequency of the cryptographic machine in each regulatory cycle to obtain the key security index value of the cryptographic machine in each regulatory cycle. The key security index value of the cryptographic machine in each regulatory cycle is used to comprehensively quantify the impact of the response time of the decryption operation of the cryptographic machine and the total number of decryption failures on the key security quality of the cryptographic machine.

8. The cryptographic machine key smooth transition system based on time window according to claim 1 is characterized by: The analysis obtains the key smoothing update result of the cipher machine, and the specific analysis process is as follows: The key smoothing update result of the cipher machine includes whether it needs to be updated or not; The key security index value of the cipher machine in each supervision cycle is compared with the set key security index threshold of the cipher machine to obtain the key smoothing update result of the cipher machine. If the key security index value of the cipher machine in a certain supervision cycle is higher than or equal to the set key security index threshold of the cipher machine, the key smoothing update result of the cipher machine in the supervision cycle is set as no need to update; If the key security index value of the cryptographic machine within a certain supervision period is lower than the set key security index threshold of the cryptographic machine, the key smoothing update result of the cryptographic machine within the supervision period is set as needing to be updated, and then the key is updated based on the key smoothing update result and the adjusted time window parameter of the key smoothing transition of the cryptographic machine.

9. A time window-based cipher key smooth transition system according to claim 8, characterized in that: The key is updated according to the key smoothing update result, combined with the adjusted time window parameter of the key smoothing transition of the cipher machine. The specific analysis process is as follows: If the result of the key smoothing update of the cipher machine is that update is required, the key settings are updated, and the time window of the updated key is designed in combination with the adjusted time window parameters of the key smooth transition of the cipher machine, the original key is updated to the updated key, the updated key activation time is set to the original key deactivation time, the original key original deactivation time is set to the updated key deactivation time, and the original key original expiration time is set to the updated key expiration time.

10. The cryptographic machine key smooth transition system based on time window according to claim 3, characterized in that: The key transition index value of the cipher machine, the specific analysis conditions are: In the formula, α represents the key transition index value of the cipher machine, A 1→i represents the data flow of the cipher machine in the i-th supervision cycle, Indicates the weight factor corresponding to the set data flow, A 2→i represents the data processing volume of the cipher machine in the i-th supervision cycle, Indicates the weight factor corresponding to the set data processing amount, A 3→i represents the key call frequency of the cipher machine in the i-th supervision cycle, It represents the weight factor corresponding to the set key call frequency, i represents the number of each supervision cycle, i=1,2,3,…n, and n represents the total number of supervision cycles.

Images