A system supporting automatic information collection and configuration of contactless cloud cryptographic machines

Abstract

The present invention relates to the field of information security technology, and specifically to a system supporting contactless cloud cryptographic machine information automatic collection and configuration, comprising: a wireless pluggable device, a cloud server cryptographic machine device, a wireless handheld device and a cloud server; the wireless pluggable device is pluggably connected to the cloud server cryptographic machine device, and is wirelessly connected to the wireless handheld device; the cloud server cryptographic machine device verifies the legitimacy of the wireless handheld device, and after the verification is passed, performs key negotiation with the wireless handheld device; after the key negotiation, the wireless handheld device sends an information collection request or a network configuration request, encrypts the request information, and sends it to the cloud server cryptographic machine device; the cloud server cryptographic machine device performs corresponding operations according to the request type; the cloud server stores the network information and inspection reports of the cloud server cryptographic machine device. The present invention can improve the information collection efficiency of the cloud cryptographic machine device and improve the security of the data transmission process.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more particularly to a system that supports automatic information collection and configuration of contactless cloud cryptographic machines. Background Art

[0002] Cloud cryptographic machine equipment information collection is a key link in project facility management. With the promulgation of the Cryptography Law and the enhancement of people's awareness of data protection, the demand for cloud cryptographic machines continues to grow, the number of servers increases rapidly, and improving deployment and equipment status inspections have become more urgent issues to be solved.

[0003] The traditional method of directly accessing the device through a proximal display or serial port for network configuration and inspection is not only inefficient but also prone to errors, and cannot meet the needs of large-scale device information collection. Therefore, how to improve the information collection efficiency of cloud cryptographic machine devices, improve the efficiency of cloud cryptographic machine equipment installation, and reduce labor costs has become a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0004] In view of this, the present invention provides a system that supports automatic collection and configuration of contactless cloud cryptographic machine information, which can improve the information collection efficiency of cloud cryptographic machine equipment and improve the security of the data transmission process.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] A system supporting automatic collection and configuration of contactless cloud cryptographic machine information, comprising: a wireless pluggable device, a cloud server cryptographic machine device, a wireless handheld device and a cloud server;

[0007] The wireless pluggable device is pluggably connected to the cloud server cryptographic machine device and is wirelessly connected to the wireless handheld device;

[0008] The cloud server cryptographic machine device verifies the legitimacy of the currently connected wireless handheld device. After the verification is passed, the cloud server cryptographic machine device and the wireless handheld device negotiate a key;

[0009] After the key negotiation, the wireless handheld device sends an information collection request or a network configuration request, encrypts the request information, and sends it to the cloud server cryptographic machine device;

[0010] After the cloud server cryptographic machine device decrypts the information collection request information, it performs a data collection operation, encrypts the collected data and returns it to the wireless handheld device; or after decrypting the network configuration request information, it performs a network configuration operation and returns the network configuration result to the wireless handheld device;

[0011] The cloud server is used to store the network information and inspection reports of the cloud server cryptographic machine equipment.

[0012] Further, the cloud server cryptographic machine device includes: a wireless pluggable device driver, a main control program, an information collection module, a host network configuration module, a virtual machine information collection module, a host information collection module and a virtual machine information collection agent module;

[0013] The wireless pluggable device driver is used to identify the inserted wireless pluggable device and generate a device file node under the operating system device directory;

[0014] The main control program interacts with the wireless pluggable device by reading and writing device file nodes, and verifies the legitimacy of the wireless handheld device. After the verification is passed, the main control program receives an information collection request or a network configuration request issued by the wireless handheld device, and selects to call the information collection module or the host network configuration module according to the type of request;

[0015] The information collection module sequentially calls the virtual machine information collection module and the host information collection module to complete the collection of relevant indicators of the host and virtual machine in the cloud server cryptographic machine device; wherein, the virtual machine information collection module completes the collection of virtual machine related indicators by calling the virtual machine information collection agent module in the virtual machine.

[0016] Furthermore, the wireless pluggable device has a display screen; when the wireless pluggable device driver recognizes that the wireless pluggable device is inserted, the main control program randomly generates a PIN code and sends it to the wireless pluggable device, and displays the randomly generated PIN code on the display screen.

[0017] Further, after the wireless handheld device searches for and connects to the corresponding wireless pluggable device, a PIN code is input and the input PIN code is sent to the main control program;

[0018] The main control program verifies whether the input PIN code is consistent with the PIN code of the wireless pluggable device. If they are consistent, the main control program executes the key calculation process and sends a message of successful PIN code verification to the wireless handheld device. If they are inconsistent, an error message is returned to the wireless handheld device.

[0019] After receiving the message that the PIN code verification is successful, the wireless handheld device executes the key calculation process.

[0020] Furthermore, the main control program presets data in its initial key table, the wireless handheld device presets data in its initial key table, and the preset data in the two initial key tables are the same.

[0021] Furthermore, the main control program and the wireless handheld device both use the same key calculation method to calculate the key based on the preset data in the initial key table and the current PIN code.

[0022] Furthermore, the process of the master control program and the wireless handheld device performing key calculation includes:

[0023] Assume that the PIN code is 6 digits, and each digit of the randomly generated PIN code is any digit from 1 to 9, and the preset data in the initial key table are A1 to A6;

[0024] Assign the first 5 digits of the PIN code to S1 to S5 in sequence, and assign the 6th digit to the dispersion number N; assign A1 to A6 in the initial key table to B1 to B6 in sequence; after the assignment is completed, perform a shift operation on B1 to B5, and the shift times of B1 to B5 are S1 to S5 respectively;

[0025] After the shift is completed, perform byte XOR operation on B1 to B5, and store the XOR result in K0;

[0026] Assign K0 to Ki and execute the key dispersion process; the key dispersion process is: use B6 as the key to repeatedly encrypt Ki N times; use the result of the last encryption as the final key, and use the key to encrypt the communication message.

[0027] Furthermore, when the wireless handheld device issues a network configuration request, the wireless handheld device first collects the serial number of the cloud server cryptographic machine device, and then queries the cloud server for device information corresponding to the device serial number through the device serial number. If the device information is queried, the device information is displayed on the wireless handheld device, and the network configuration request process is triggered. The network configuration request carries IP information; the main control program calls the cloud cryptographic machine host network configuration module to complete the configuration of the host network.

[0028] Furthermore, the device information corresponding to the device serial number includes an IP address, a subnet mask, and a gateway information.

[0029] Furthermore, after the legitimacy verification of the wireless handheld device is passed, the index information of the cloud server cryptographic machine device is actively and regularly collected and uploaded to the cloud server; the cloud server generates an inspection report of the cloud server cryptographic machine device.

[0030] It can be seen from the above technical solutions that, compared with the prior art, the present invention has the following beneficial effects:

[0031] The method of the present invention automatically completes the cloud server cryptographic machine equipment information collection work through the cooperation of the wireless pluggable device and the wireless handheld device, thereby improving the work efficiency of information collection;

[0032] The present invention supports automatic device configuration function, improves the efficiency of cloud cryptographic machine equipment installation and reduces labor costs; the main work of equipment installation is to configure IP address resources for the equipment and access the computer room network.

[0033] The present invention encrypts and transmits interactive information through key negotiation between a cloud server cryptographic machine device and a wireless handheld device, thereby ensuring the confidentiality of the communication process. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0035] Figure 1 A schematic diagram of the structure of a system that supports automatic collection and configuration of contactless cloud cryptographic machine information provided by the present invention;

[0036] Figure 2 A schematic diagram of the operation interface of the wireless handheld device provided by the present invention;

[0037] Figure 3 The key calculation flow chart provided by the present invention. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] like Figure 1 As shown, an embodiment of the present invention discloses a system supporting automatic collection and configuration of contactless cloud cryptographic machine information, including: a wireless pluggable device, a cloud server cryptographic machine device, a wireless handheld device and a cloud server;

[0040] The wireless pluggable device is pluggable and connected to the cloud server cryptographic machine device, and is wirelessly connected to the wireless handheld device;

[0041] The cloud server cryptographic machine device verifies the legitimacy of the currently connected wireless handheld device. After the verification is passed, the cloud server cryptographic machine device and the wireless handheld device negotiate the key;

[0042] After the key negotiation, the wireless handheld device sends an information collection request or a network configuration request, encrypts the request information, and sends it to the cloud server cryptographic machine device;

[0043] After the cloud server cryptographic machine device decrypts the information collection request information, it performs the data collection operation, encrypts the collected data and returns it to the wireless handheld device; or after decrypting the network configuration request information, it performs the network configuration operation and returns the network configuration result to the wireless handheld device;

[0044] The cloud server is used to store network information and inspection reports of cloud server cryptographic machine equipment.

[0045] The following is a further description of the above modules.

[0046] 1) The cloud server cryptographic machine equipment includes: wireless pluggable device driver, main control program, information collection module, host network configuration module, virtual machine information collection module, host information collection module and virtual machine information collection agent module;

[0047] The wireless pluggable device driver is used to identify the inserted wireless pluggable device and generate a device file node under the operating system device directory;

[0048] The main control program interacts with the wireless pluggable device by reading and writing device file nodes, and verifies the legitimacy of the wireless handheld device. After the verification is passed, the main control program receives the information collection request or network configuration request sent by the wireless handheld device, and selects to call the information collection module or the host network configuration module according to the type of request;

[0049] The information collection module calls the virtual machine information collection module and the host information collection module in turn to complete the collection of relevant indicators of the host and virtual machine in the cloud server cryptographic machine device; among them, because the cloud cryptographic machine virtual machine and the host are isolated, the virtual machine information collection module completes the collection of virtual machine related indicators by calling the virtual machine information collection agent module in the virtual machine, and the communication technology can be based on the network, unix socket, system bus and other methods.

[0050] 2) The wireless pluggable device has a display screen; when the wireless pluggable device driver recognizes that the wireless pluggable device is plugged in, the main control program randomly generates a PIN code and sends it to the wireless pluggable device, and displays the randomly generated PIN code on the display screen.

[0051] Wireless pluggable devices can use universal USB port design. Servers basically have USB ports. Wireless pluggable devices are equipped with a small LCD screen to display PIN codes. PIN codes are randomly generated by the main control program. For ease of use, the PIN code remains unchanged after the wireless pluggable device is plugged in and before it is unplugged. Such a design does not require frequent input and update of the PIN code during one use. Since the operation process will not take too long, a short-term fixed PIN code can meet security requirements. There is no need to worry about the security risks caused by the spread of PIN codes. Bluetooth wireless connection can be used between wireless pluggable devices and wireless handheld devices.

[0052] 3) After the wireless handheld device searches for and connects to the corresponding wireless pluggable device, enter the PIN code and send the entered PIN code to the main control program;

[0053] The main control program verifies whether the input PIN code is consistent with the PIN code of the wireless pluggable device. If they are consistent, the main control program executes the key calculation process and sends a message of successful PIN code verification to the wireless handheld device. If they are inconsistent, an error message is returned to the wireless handheld device;

[0054] After the wireless handheld device receives the message that the PIN code verification is successful, it executes the key calculation process.

[0055] Specifically, the wireless handheld device can be a smart phone, on which a special APP for information collection is installed, and its display interface is as follows: Figure 2 shown.

[0056] When using it, first click Search Device to see if the wireless signal of the wireless pluggable device can be searched. If it is found, click Connect Device. A prompt will pop up asking you to enter the PIN code. After entering the PIN code, click Confirm. After confirmation, the main control program on the cloud server password machine will verify the PIN code. After the verification is successful, the wireless handheld device will return a successful verification response. The main control program and the wireless handheld device will start to follow Figure 3 The process of calculating the key.

[0057] Click on device information collection to collect information about the connected devices, and the collection results will be displayed in a table.

[0058] Click to query device IP information from the cloud server. The network information of the device with the device serial number will be queried from the cloud server and displayed in a table. After confirmation, click Configure Device Network to configure the network information for the network card of the cloud server cryptographic machine.

[0059] 4) The cloud server has two uses. One is to store the network information of the cloud server cryptographic machine equipment and retrieve information using the equipment sequence as the primary key. The other is to store the inspection report of the cloud server cryptographic machine equipment.

[0060] When the wireless handheld device sends a network configuration request, the wireless handheld device first collects the serial number of the cloud server cryptographic machine device, and then queries the cloud server for the device information corresponding to the device serial number through the device serial number. The device information includes the IP address, subnet mask and gateway information, and the IP network information needs to be entered in advance. If the device information is queried, the device information is displayed on the wireless handheld device, and after confirmation, the network configuration request process is triggered. The network configuration request carries the IP information; the main control program calls the cloud cryptographic machine host network configuration module to complete the host network configuration.

[0061] After the legitimacy verification of the wireless handheld device is passed, it is connected to the main control program of the cloud server cryptographic machine device, and will actively and regularly collect indicator information of the cloud server cryptographic machine device. The operation and maintenance personnel can view the collected information through the wireless handheld device. If it needs to be uploaded to the cloud server, the upload process will be triggered. After receiving the reported information, the cloud server stores the information in a file or database and generates an inspection report for the cloud server cryptographic machine device.

[0062] Next, the encryption process of the wireless handheld device and the cloud server cryptographic machine device is further explained.

[0063] The main control program presets data in its initial key table, and the wireless handheld device presets data in its initial key table, and the preset data in the two initial key tables are the same.

[0064] The master control program and the wireless handheld device both use the same key calculation method to calculate the key based on the preset data in the initial key table and the current PIN code. The specific calculation process is as follows Figure 3 As shown, including:

[0065] Assume that the PIN code is 6 digits, and each digit of the randomly generated PIN code is any digit from 1 to 9, and the preset data in the initial key table are A1 to A6;

[0066] Assign the first 5 digits of the PIN code to S1 to S5 in sequence, and assign the 6th digit to the dispersion number N; assign A1 to A6 in the initial key table to B1 to B6 in sequence; after the assignment is completed, perform a shift operation on B1 to B5, and the shift times of B1 to B5 are S1 to S5 respectively;

[0067] After the shift is completed, perform byte XOR operation on B1 to B5, and store the XOR result in K0;

[0068] Assign K0 to Ki and execute the key dispersion process; the key dispersion process is: use B6 as the key to repeatedly encrypt Ki N times; use the result of the last encryption as the final key, and use the key to encrypt the communication message.

[0069] The following further describes the execution process of the system of the present invention in combination with an information collection scenario and a network configuration scenario.

[0070] Preparation: When the cloud server cryptographic machine device leaves the factory, data is preset for the initial key table. The wireless handheld device also needs to preset data for the initial key table before use, and the preset data must be the same. Otherwise, the keys calculated by the same key calculation method will be different and normal communication will not be possible.

[0071] If you need to configure the network for the cloud server cryptographic machine on site, you need to first configure the cloud cryptographic machine device information corresponding to the device serial number on the cloud server, including the IP address, subnet mask, and gateway network configuration information.

[0072] In the information collection scenario, the specific collection steps include:

[0073] 1. Insert the wireless pluggable device into the host physical interface of the cloud server cryptographic machine device, such as a USB port.

[0074] 2. After the wireless pluggable device is powered on, the LCD screen displays a randomly generated PIN code.

[0075] 3. Open the information collection app on the wireless handheld device, search for and connect the corresponding wireless pluggable device, such as a Bluetooth device. To facilitate manual identification, the device name is fixed and has practical significance.

[0076] 4. Select the corresponding wireless pluggable device, and you will be prompted to enter the PIN code. Enter the PIN code and actively trigger the verification process. Usually, you click a prompt button to trigger it.

[0077] 5. After receiving the PIN code to be verified, the main control program verifies whether it is consistent with the PIN code of the wireless pluggable device. If they are consistent, the main control program starts to execute the key calculation process, calculates the key, and feeds back the successful verification to the wireless handheld device. Otherwise, an error message is returned to the wireless handheld device, and a prompt message is displayed to feed back the PIN code error to the operation and maintenance personnel.

[0078] 6. After the wireless handheld device receives the PIN code and verifies it successfully, it also enters the key calculation process to calculate the key. Because the initial key table and PIN code of both parties are consistent, the key calculation process is the same, so the calculated key is also the same. Both parties use the keys calculated by each other to encrypt the same data. The data encrypted by the other party can be correctly decrypted by the other party, thus achieving the purpose of key negotiation and ciphertext communication.

[0079] 7. Actively trigger the collection function. The wireless handheld device sends a collection request. The request data is first encrypted with a key, that is, the key calculated in step 6. The encrypted data is sent to the main control program on the cloud cryptographic machine. The data sample is: {"command":"collect"}, the field command represents the instruction, and the value collect represents the execution of data collection.

[0080] 8. After receiving the data, the main control program first uses its own key to decrypt and parse the message. The received instruction is collect. The main control program knows that it needs to perform the data collection operation and calls the device collection module, virtual machine information collection module and host information collection module to collect monitoring information; the main control program encrypts the collection results and returns the ciphertext to the wireless handheld device.

[0081] 9. The operator checks the information collected by the wireless handheld device and actively triggers the upload action to upload the collected information to the cloud server. The wireless handheld device and the cloud server use the international https standard for communication to meet data security requirements.

[0082] 10. After receiving the data, the cloud server stores it in the database for easy review and statistics, and report generation.

[0083] In the network configuration scenario, the following steps are included:

[0084] 1. Log in to the cloud server and enter the device serial number corresponding to the device IP address, subnet mask, and gateway information to be configured in advance.

[0085] 2. The wireless handheld device is normally connected to the wireless pluggable device of the cloud password server, and the device SN is obtained through collection.

[0086] 3. If the wireless handheld device fails to find the IP configuration information corresponding to the backup serial number, it will prompt you to enter the IP information on the cloud server. If it finds an artificial trigger to send a network configuration request to the wireless handheld device, the main control program will call the cloud cryptographic machine host network configuration module after receiving the configuration instruction. The cloud cryptographic machine host network configuration module will call the operating system network configuration command to complete the network configuration of the cloud cryptographic machine. If the system network configuration command is successfully executed, a success prompt will be returned to the wireless handheld device. Otherwise, a failure prompt will be returned to the wireless handheld device.

[0087] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0088] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A system that supports automatic information collection and configuration of contactless cloud cryptographic machines, characterized in that: include: Wireless pluggable devices, cloud server cryptographic devices, wireless handheld devices, and cloud servers; The wireless pluggable device is pluggably connected to the cloud server cryptographic machine device and is wirelessly connected to the wireless handheld device; The cloud server cryptographic machine device verifies the legitimacy of the currently connected wireless handheld device. After the verification is passed, the cloud server cryptographic machine device and the wireless handheld device negotiate a key; After the key negotiation, the wireless handheld device sends an information collection request or a network configuration request, encrypts the request information, and sends it to the cloud server cryptographic machine device; After the cloud server cryptographic machine device decrypts the information collection request information, it performs a data collection operation, encrypts the collected data and returns it to the wireless handheld device; or after decrypting the network configuration request information, it performs a network configuration operation and returns the network configuration result to the wireless handheld device; The cloud server is used to store network information and inspection reports of the cloud server cryptographic machine equipment; The cloud server cryptographic machine device comprises: a wireless pluggable device driver and a main control program; when the wireless pluggable device driver recognizes that the wireless pluggable device is inserted, the main control program randomly generates a PIN code and sends it to the wireless pluggable device; the main control program verifies whether the PIN code input by the wireless handheld device is consistent with the PIN code of the wireless pluggable device, and if they are consistent, the main control program executes a key calculation process; The master control program presets data in its initial key table, and the wireless handheld device presets data in its initial key table, and the preset data in the two initial key tables are the same; The main control program and the wireless handheld device both use the same key calculation method to calculate the key based on the preset data in the initial key table and the current PIN code.

2. The system supporting automatic information collection and configuration of contactless cloud cryptographic machines according to claim 1 is characterized in that: The cloud server cryptographic machine device also includes: an information collection module, a host network configuration module, a virtual machine information collection module, a host information collection module and a virtual machine information collection agent module; The wireless pluggable device driver is used to identify the inserted wireless pluggable device and generate a device file node under the operating system device directory; The main control program interacts with the wireless pluggable device by reading and writing device file nodes, and verifies the legitimacy of the wireless handheld device. After the verification is passed, the main control program receives an information collection request or a network configuration request issued by the wireless handheld device, and selects to call the information collection module or the host network configuration module according to the type of request; The information collection module sequentially calls the virtual machine information collection module and the host information collection module to complete the collection of relevant indicators of the host and virtual machine in the cloud server cryptographic machine device; wherein, the virtual machine information collection module completes the collection of virtual machine related indicators by calling the virtual machine information collection agent module in the virtual machine.

3. The system supporting automatic collection and configuration of contactless cloud cryptographic machine information according to claim 2 is characterized in that: The wireless pluggable device has a display screen, and the randomly generated PIN code is displayed on the display screen.

4. The system supporting automatic information collection and configuration of contactless cloud cryptographic machines according to claim 3 is characterized in that: After the wireless handheld device searches for and connects to the corresponding wireless pluggable device, a PIN code is input and the input PIN code is sent to the main control program; The main control program verifies whether the input PIN code is consistent with the PIN code of the wireless pluggable device. If they are consistent, the main control program executes the key calculation process and sends a message of successful PIN code verification to the wireless handheld device. If they are inconsistent, an error message is returned to the wireless handheld device. After receiving the message that the PIN code verification is successful, the wireless handheld device executes the key calculation process.

5. The system supporting automatic collection and configuration of contactless cloud cryptographic machine information according to claim 1 is characterized in that: The process of the master control program and the wireless handheld device performing key calculation includes: Assume that the PIN code is 6 digits, and each digit of the randomly generated PIN code is any digit from 1 to 9, and the preset data in the initial key table are A1 to A6; Assign the first 5 digits of the PIN code to S1 to S5 in sequence, and assign the 6th digit to the dispersion number N; assign A1 to A6 in the initial key table to B1 to B6 in sequence; after the assignment is completed, perform a shift operation on B1 to B5, and the shift times of B1 to B5 are S1 to S5 respectively; After the shift is completed, perform byte XOR operation on B1 to B5, and store the XOR result in K0; Assign K0 to Ki and execute the key dispersion process; the key dispersion process is: use B6 as the key to repeatedly encrypt Ki N times; use the result of the last encryption as the final key, and use the key to encrypt the communication message.

6. The system supporting automatic collection and configuration of contactless cloud cryptographic machine information according to claim 2, characterized in that: When the wireless handheld device sends a network configuration request, the wireless handheld device first collects the serial number of the cloud server cryptographic machine device, and then queries the cloud server for device information corresponding to the device serial number through the device serial number. If the device information is found, the device information is displayed on the wireless handheld device, and the network configuration request process is triggered. The network configuration request carries IP information; The main control program calls the cloud cryptographic machine host network configuration module to complete the configuration of the host network.

7. The system supporting automatic information collection and configuration of contactless cloud cryptographic machines according to claim 6 is characterized in that: The device information corresponding to the device serial number includes the IP address, subnet mask, and gateway information.

8. The system supporting automatic information collection and configuration of contactless cloud cryptographic machines according to claim 1, characterized in that: After the legitimacy verification of the wireless handheld device is passed, the index information of the cloud server cryptographic machine device is actively and regularly collected and uploaded to the cloud server; the cloud server generates an inspection report of the cloud server cryptographic machine device.

Images