Audit method and device for external key storage calling, electronic equipment and medium
By auditing the operations of the external key storage agent module and hardware security module during the virtual bus card recharge process, identifying and reporting abnormal behaviors, the problem of difficulty in monitoring and auditing abnormal information during the virtual bus card recharge process in the prior art is solved, and higher data security and compliance are achieved.
Patent Information
- Application Number
- CN202411624791.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-14
- Publication Date
- 2025-02-25
AI Technical Summary
It is difficult for the existing technology to effectively monitor and audit abnormal information of virtual bus cards during the recharge process, resulting in difficult to ensure data security and compliance.
By obtaining the number of successful recharges of virtual bus cards in the historical time period, the number of calls of the external key storage proxy module to call the hardware security module, the number of encryption operations of the hardware security module, and the number of requests received by the external key storage proxy module to perform fault audits, identifying abnormal behaviors such as false recharge, repeated encryption, network transmission failures and unauthorized calls.
It realizes comprehensive monitoring and analysis of the virtual bus card recharge process, improves data security and compliance, and enhances transparency and traceability of the recharge process.
Smart Images
Figure CN119519952A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communications, and in particular to an audit method, device, electronic device and medium for external key storage call. Background Art
[0002] External key storage is widely used in areas such as bus cards, access cards, and car keys to meet users' full control over encryption keys. Although Xueqiu's bus SaaS platform has a complete key management service module (KMS) and hardware security module (HSM), some customers still choose to use external key storage, which is supported by a user-managed external key manager to ensure that keys and operations are fully controlled by users. When a user encrypts or decrypts, the actual operation is performed in the external key manager. Xueqiu KMS sends requests to the user's external key manager, and all requests are forwarded through the user-managed external key storage proxy module. To prevent abuse and ensure compliance, calls to external key storage need to be audited, detailed information for each operation needs to be recorded, and abnormal behavior needs to be monitored to enhance customer confidence in data security. Summary of the invention
[0003] The purpose of the embodiments of the present application is to provide an audit method, device, electronic device and medium for external key storage call, so as to solve the above-mentioned problems existing in the prior art and monitor abnormal information of the virtual bus card during the recharging process.
[0004] In a first aspect, an audit method for external key storage calls is provided, the method being applied to an external server including an external key storage agent module and a hardware security module, the method may include:
[0005] Obtain the number of successful recharges of the virtual bus card within a historical time period, the number of times the external key storage agent module is called during each recharge process of the virtual bus card, the number of encryption operations of the hardware security module, and the number of requests received by the external key storage agent module for encryption requests;
[0006] If the number of recharges is not equal to the number of encryption operations, a fault audit is performed on the recharge operation according to the difference between the number of recharges and the number of encryption operations;
[0007] And, if the number of calls is not equal to the number of requests, a fault audit is performed on the call operation according to the number of calls and the number of requests;
[0008] And, if the number of requests is not equal to the number of encryption operations, a fault audit is performed on the encryption operation according to the number of requests and the number of encryption operations.
[0009] In a possible implementation, a fault audit is performed on the recharge operation, including:
[0010] If the number of recharges is greater than the number of encryption operations, then there are recharge frauds or operations bypassing the encryption process in the recharge operations during the historical time period, and a prompt message of recharge frauds or operations bypassing the encryption process is issued;
[0011] If the number of recharge times is less than the number of encryption operations, then there is repeated encryption and invalid encryption in the recharge operations within the historical time period, and a prompt message indicating the existence of repeated encryption and invalid encryption is issued.
[0012] In a possible implementation, the method further includes: determining a recharge success rate according to the number of calls and the number of recharges.
[0013] In a possible implementation, determining the recharge success rate according to the number of calls and the number of recharges includes:
[0014] The ratio of the recharge times to the call times is determined as the recharge success rate.
[0015] In a possible implementation, after determining the recharge success rate, the method further includes:
[0016] If the recharge success rate is lower than the preset recharge rate, a prompt message indicating transaction failure or processing timeout will be issued.
[0017] In a possible implementation, a fault audit is performed on the call operation, including:
[0018] If the number of calls is greater than the number of requests, the call operation failure is a network transmission failure or the call request of the external key storage agent module to call the hardware security module is lost halfway, and a prompt message of network transmission failure or loss of the call request is issued;
[0019] If the number of calls is less than the number of requests, the call operation failure is an unauthorized call request, and a prompt message indicating the existence of an unauthorized call request is issued.
[0020] In a possible implementation, determining an encryption operation failure according to the number of requests and the number of encryption operations includes:
[0021] If the number of requests is greater than the number of encryption operations, the encryption operation failure is that the external key storage agent module fails to send the encryption request to the hardware security module, and a prompt message is issued that the external key storage agent module fails to send the encryption request to the hardware security module;
[0022] If the number of requests is less than the number of encryption operations, the encryption operation failure is that there is an unrecorded encryption operation in the external key storage agent module, and a prompt message indicating that there is an unrecorded encryption operation in the external key storage agent module is issued.
[0023] In a second aspect, a method and apparatus for auditing an external key storage call is provided, and the apparatus may include:
[0024] An acquisition unit is used to acquire the number of successful recharges of the virtual bus card in a historical time period, the number of calls of the hardware security module by the external key storage agent module during each recharge process of the virtual bus card, the number of encryption operations of the hardware security module, and the number of requests received by the external key storage agent module for encryption requests;
[0025] an audit unit, configured to, if the number of recharges is not equal to the number of encryption operations, perform a fault audit on the recharge operation according to the difference between the number of recharges and the number of encryption operations;
[0026] And, if the number of calls is not equal to the number of requests, a fault audit is performed on the call operation according to the number of calls and the number of requests;
[0027] And, if the number of requests is not equal to the number of encryption operations, a fault audit is performed on the call of the encryption operation according to the size of the number of requests and the number of encryption operations.
[0028] In a third aspect, an electronic device is provided, the electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;
[0029] Memory, used to store computer programs;
[0030] The processor is used to implement any method step described in the first aspect when executing the program stored in the memory.
[0031] In a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, any method step described in the first aspect is implemented.
[0032] The present application provides an audit method for external key storage calls, which includes: obtaining the number of successful recharges of virtual bus cards in a historical time period, the number of calls of the external key storage agent module to the hardware security module during each recharge of the virtual bus card, the number of encryption operations of the hardware security module, and the number of requests of the external key storage agent module to receive encryption requests; if the number of recharges is not equal to the number of encryption operations, then the recharge operation is audited for failure according to the number of recharges and the number of encryption operations; and, if the number of calls is not equal to the number of requests, then the call operation is audited for failure according to the number of calls and the number of requests; and, if the number of requests is not equal to the number of encryption operations, then the call encryption operation is audited for failure according to the number of requests and the number of encryption operations. The method can integrate key logs and establish a relationship between business and key use, thereby achieving comprehensive monitoring and analysis, and improving the transparency and traceability of the recharge process. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0034] Figure 1 A system architecture diagram of an audit method applied to an external key storage call provided in an embodiment of the present application;
[0035] Figure 2 A flowchart of an external key storage calling method and an auditing method provided in an embodiment of the present application;
[0036] Figure 3 A flowchart of an audit method for external key storage calls provided in an embodiment of the present application;
[0037] Figure 4 A schematic diagram of the structure of an audit device for external key storage call provided in an embodiment of the present application;
[0038] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0039] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0040] The business opportunity creation method based on session information provided in the embodiment of the present application can be applied to Figure 1 In the system architecture shown in Figure 1 As shown, the system may include: business servers and external servers. Business servers and external servers may be physical servers, or server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. Business servers and external servers may be directly or indirectly connected via wired or wireless communication methods, which is not limited in this application.
[0041] Combination Figure 2 As shown, the business server includes a business service module and a key management service module; wherein the business service module is used to obtain the business request of the recharge business, and generate an encrypted recharge instruction according to the business request, and send the encrypted instruction to the key management service module; the key management service module is used to record the received encrypted recharge instruction and send the encrypted recharge instruction to an external server.
[0042] The external server includes an external key storage agent module and a hardware security module; wherein the external key storage agent module is used to record the received encrypted recharge instruction and send the encrypted recharge instruction to the hardware security module; the hardware security module is used to perform encryption operations according to the received encrypted instruction, thereby generating an encrypted instruction, and sending the encrypted instruction to the external key storage agent module. The external key storage agent module is also used to send the encrypted instruction to the key management service module;
[0043] The key management service module is also used to send the received encrypted instructions to the business service module.
[0044] The external server is also used to obtain the number of successful recharges of the virtual bus card within a historical time period, the number of calls of the external key storage agent module to the hardware security module during each recharge of the virtual bus card, the number of encryption operations of the hardware security module and the number of requests received by the external key storage agent module for encryption requests, so as to execute an audit method for external key storage calls provided in this application.
[0045] External key storage is widely used in areas such as bus cards, access cards, and car keys to meet users' full control over encryption keys. Although Xueqiu's bus SaaS platform has a complete key management service module (KMS) and hardware security module (HSM), some customers still choose to use external key storage, which is supported by a user-managed external key manager to ensure that keys and operations are fully controlled by users. When a user encrypts or decrypts, the actual operation is performed in the external key manager. Xueqiu KMS sends requests to the user's external key manager, and all requests are forwarded through the user-managed external key storage proxy module. To prevent abuse and ensure compliance, calls to external key storage need to be audited, detailed information for each operation needs to be recorded, and abnormal behavior needs to be monitored to enhance customer confidence in data security.
[0046] During the recharge process of the mobile phone NFC virtual bus card, the recharge instruction needs to be encrypted. The encryption keys used by each card company are different, and the storage methods of the encryption keys are also different. Some card companies will host the keys in Snowball's HSM; some will manage them completely by themselves and save the keys in the local HSM. For this situation, it is necessary to develop an XKS-Proxy (external key storage proxy module). When the recharge instruction needs to be encrypted, Snowball's KMS will call the card company's external key storage agent, and then use the card company's local key for encryption, and then return the encrypted result. The safe use of recharge keys is crucial. To prevent abuse and ensure compliance, it is necessary to audit the call of the recharge key, record the details of each operation, and monitor abnormal behavior, so as to enhance customers' confidence in data security.
[0047] The existing technical solution only records the call request log of KMS, but fails to cover the request log received by the external key storage agent and the use record of the key in HSM. In addition, these records lack relevance to the business, making it impossible to clearly understand the specific situation of the recharge business calling the external key storage agent and the use of HSM keys.
[0048] Therefore, this application proposes an audit method for external key storage calls to optimize the solution to integrate these key logs and establish the association between business and key usage, so as to achieve comprehensive monitoring and analysis and improve the transparency and traceability of the recharge process.
[0049] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.
[0050] Figure 3 A flowchart of an audit method for external key storage call provided in an embodiment of the present application. Figure 3 As shown, the method may include:
[0051] Step S310: Obtain the number of successful recharges of the virtual bus card within a historical time period, the number of calls of the external key storage agent module during each recharge of the virtual bus card, the number of encryption operations of the hardware security module, and the number of requests received by the external key storage agent module for encryption requests.
[0052] Before executing step S310, that is, during the historical time period, the recharging process of the virtual bus card may include:
[0053] Step S301: In the recharge service, the business service module obtains the business request of the recharge service and generates an encrypted recharge instruction according to the business request. The business service module calls KMS and sends the encrypted recharge instruction to KMS. KMS determines whether the current encrypted recharge instruction needs to call the external key storage agent module according to the correspondence between different instructions and different instructions that need to call the external key storage agent module.
[0054] If the external key storage agent module of the pass card needs to be called, the encrypted recharge instruction will be forwarded to the external key storage agent and the log will be recorded.
[0055] Afterwards, the external key storage agent module records the log after receiving the encryption recharge instruction, and forwards the encryption task corresponding to the encryption recharge instruction to the HSM.
[0056] After that, after the HSM completes the encryption, it updates the encryption counter and returns the result, and the external key storage agent module updates the log and returns the result to the KMS.
[0057] Finally, KMS updates the log and returns the result to the business service module.
[0058] Specific recharge service encryption instruction process:
[0059] 1. The business service module calls the encrypted recharge instruction of KMS:
[0060] The business service module issues an encryption recharge instruction corresponding to the encryption request and calls KMS to perform the encryption operation.
[0061] 2. KMS forwards the request to the external key storage agent module:
[0062] (1) KMS checks the request and determines whether it is necessary to call the external key storage agent module of Tongka Company.
[0063] (2) If necessary, KMS forwards the encryption request to the external key storage agent module and records the request log to the database.
[0064] 3. The external key storage agent module receives the encryption request and records the log:
[0065] (1) After receiving the encryption request forwarded by KMS, the external key storage agent module records the request log to the database.
[0066] (2) The external key storage agent module forwards the encrypted information to the HSM for actual encryption operations.
[0067] 4. HSM performs encryption and updates encryption counter:
[0068] (1) HSM uses keys to complete encryption tasks.
[0069] (2) The HSM adds 1 to the encryption counter of the key and records the number of encryption operations.
[0070] (3) HSM returns the encryption result to the external key storage agent module.
[0071] 5. The external key storage agent module updates the log and returns the result to KMS:
[0072] (1) After receiving the encryption result from the HSM, the external key storage agent module updates the request log.
[0073] (2) Then return the encryption result to KMS.
[0074] 6. KMS updates the record and returns the result to the business service module:
[0075] (1) After receiving the encryption result, KMS updates the record log in the database.
[0076] (2) KMS returns the encryption result to the business service module.
[0077] 7. The business service returns the encrypted transfer instruction to the wallet application on the mobile phone to complete the execution of the transfer instruction.
[0078] Step S310 may include:
[0079] The external key storage agent module can reconcile the previous day's operations every morning according to the preset cycle: obtain the successful recharge record of the business service, the call record of the business service module calling KMS during each virtual bus card recharge process, the number of times KMS calls the external key storage agent module, the number of encryption operations of HSM, and the number of times the external key storage agent module receives encryption requests.
[0080] Among them, the recharge record includes the number of recharges.
[0081] That is, the external key storage agent module calls the business service module to obtain the reconciliation file:
[0082] (1) Every morning, the external key storage agent module automatically calls the business service to obtain the recharge reconciliation file of the previous day.
[0083] (2) This file contains the total number of successful recharge records (number of recharges).
[0084] 2. The external key storage agent module calls KMS to obtain the request log:
[0085] (1) The external key storage agent module calls KMS, obtains the log records of all requests to call the external key storage agent module in the previous day, and obtains the number of calls.
[0086] 3. The external key storage agent module calls HSM to obtain the encryption counter:
[0087] (1) The external key storage agent module calls the HSM to obtain the key encryption counter and record the number of encryption operations on the previous day.
[0088] 4. The external key storage agent queries its own log:
[0089] (1) The external key storage agent queries the number of requests received in the previous day and the number of encryptions successfully processed.
[0090] Step S320: Audit the faults in the recharge operation process according to the number of recharges, the number of calls, the number of encryption operations and the number of requests, and obtain the audit results.
[0091] Specifically, A. When the number of recharge times is equal to the number of encryption operations, it indicates that the recharge operation and the encryption operation are normal.
[0092] When the number of recharges is not equal to the number of encryption operations, a fault audit is performed on the recharge operation based on the difference between the number of recharges and the number of encryption operations. The process may include:
[0093] If the number of recharges is greater than the number of encryption operations, it indicates that there are recharge frauds or operations bypassing the encryption process in the historical period, and a prompt message of recharge frauds or operations bypassing the encryption process is issued;
[0094] If the number of recharge times is less than the number of encryption operations, it indicates that there are repeated encryptions and invalid encryptions in the recharge operations during the historical time period, and a prompt message indicating the existence of repeated encryptions and invalid encryptions is issued.
[0095] B. When the number of calls is not equal to the number of requests, it indicates that the calling process of the calling operation is normal.
[0096] When the number of calls is not equal to the number of requests, a fault audit is performed on the call operation based on the number of calls and the number of requests. The process may include:
[0097] If the number of calls is greater than the number of requests, the call operation failure is a network transmission failure or the call request of the external key storage agent module to call the hardware security module is lost midway, and a prompt message of network transmission failure or call request loss midway is issued;
[0098] If the number of calls is less than the number of requests, the call operation failure is considered an unauthorized call request, and a prompt message indicating the existence of an unauthorized call request is issued.
[0099] C. When the number of requests is equal to the number of encryption operations, it indicates that the encryption process of the encryption operation is normal.
[0100] If the number of requests is not equal to the number of encryption operations, a fault audit is performed on the encryption operation based on the number of requests and the number of encryption operations, including:
[0101] If the number of requests is greater than the number of encryption operations, the encryption operation failure is that the external key storage agent module fails to send the encryption request to the hardware security module, and a prompt message is issued that the external key storage agent module fails to send the encryption request to the hardware security module;
[0102] If the number of requests is less than the number of encryption operations, the encryption operation failure is that there is an unrecorded encryption operation in the external key storage agent module, and a prompt message indicating that there is an unrecorded encryption operation in the external key storage agent module is issued.
[0103] In some embodiments, the method further includes: determining a recharge success rate based on the number of calls and the number of recharges.
[0104] Specifically, the ratio of the number of recharges to the number of calls is determined as the recharge success rate.
[0105] In some embodiments, 1) if the number of calls > the number of recharges: it indicates that the recharge success rate is low, there may be transaction failure, timeout or other technical problems, and it is necessary to investigate the reasons affecting the recharge rate.
[0106] 2) If the number of calls ≈ the number of recharges: it indicates that the recharge success rate is normal and the system is running well.
[0107] After determining the recharge success rate, the method may further include:
[0108] If the recharge success rate is lower than the preset recharge rate, a prompt message indicating transaction failure or processing timeout will be issued.
[0109] If the recharge success rate is not less than the preset recharge rate, it indicates that there is no transaction failure or processing timeout.
[0110] In this method, by comparing these data, potential problems in the recharge process can be detected, such as fraudulent recharge, low success rate, network problems or illegal calls. All abnormal situations are summarized through auditing and form an encrypted record summary report for the day. The daily encrypted record summary report is sent to relevant personnel via email to ensure the safe and efficient operation of the system.
[0111] The present application provides an audit method for external key storage calls, which includes: obtaining the number of successful recharges of virtual bus cards in a historical time period, the number of calls of the external key storage agent module to the hardware security module during each recharge of the virtual bus card, the number of encryption operations of the hardware security module, and the number of requests of the external key storage agent module to receive encryption requests; if the number of recharges is not equal to the number of encryption operations, then the recharge operation is audited for failure according to the number of recharges and the number of encryption operations; and, if the number of calls is not equal to the number of requests, then the call operation is audited for failure according to the number of calls and the number of requests; and, if the number of requests is not equal to the number of encryption operations, then the call encryption operation is audited for failure according to the number of requests and the number of encryption operations. The method can integrate key logs and establish a relationship between business and key use, thereby achieving comprehensive monitoring and analysis, and improving the transparency and traceability of the recharge process.
[0112] The beneficial effects of the present application may specifically include:
[0113] 1. Full-link logging and tracing: It not only records the KMS call log, but also covers the complete operation log of the external key storage agent module and HSM, ensuring the full-link transparency of each encryption request and realizing the full process tracking from business request to HSM encryption.
[0114] 2. Scheduled audit mechanism: The external key storage agent module automatically audits according to the preset period, comprehensively analyzes the recharge success records, KMS call times, requests received by the agent, and HSM encryption counters to ensure data consistency and quickly identify potential security risks or efficiency issues.
[0115] 3. Multi-dimensional problem detection: By comparing data from different systems, various problems can be discovered, including fraudulent recharge, low recharge success rate, abnormal network transmission or unauthorized calls, providing multi-level security protection.
[0116] 4. Active warning and reporting mechanism: Automatically generate daily encrypted record summaries and send them to relevant personnel via email to ensure timely understanding of system operation status and potential problems, thereby improving the transparency and operability of system operation and maintenance.
[0117] 5. Compliance and risk control: Through sophisticated logging, comparative analysis, and automatic auditing, the solution strengthens compliance management of key calls, effectively controls the risks of key abuse or abnormal behavior, and improves the security and reliability of the system.
[0118] Corresponding to the above method, the embodiment of the present application also provides an audit device for external key storage call, such as Figure 4 As shown, the device comprises:
[0119] The acquisition unit 410 is used to acquire the number of successful recharges of the virtual bus card in a historical time period, the number of times the external key storage agent module is called during each recharge process of the virtual bus card, the number of encryption operations of the hardware security module, and the number of requests received by the external key storage agent module for encryption requests;
[0120] The audit unit 420 is configured to perform a fault audit on the recharge operation according to the difference between the recharge number and the encryption operation number if the recharge number is not equal to the encryption operation number;
[0121] And, if the number of calls is not equal to the number of requests, a fault audit is performed on the call operation according to the number of calls and the number of requests;
[0122] And, if the number of requests is not equal to the number of encryption operations, a fault audit is performed on the encryption operation according to the number of requests and the number of encryption operations.
[0123] The functions of each functional unit of an audit device for external key storage calls provided in the above-mentioned embodiment of the present application can be realized through the above-mentioned method steps. Therefore, the specific working process and beneficial effects of each unit in an audit device for external key storage calls provided in the embodiment of the present application will not be repeated here.
[0124] The present application also provides an electronic device, such as Figure 5 As shown, it includes a processor 510 , a communication interface 520 , a memory 530 and a communication bus 540 , wherein the processor 510 , the communication interface 520 , and the memory 530 communicate with each other via the communication bus 540 .
[0125] A memory 530, for storing computer programs;
[0126] The processor 510 is used to execute the program stored in the memory 530 to implement the following steps:
[0127] Obtain the number of successful recharges of the virtual bus card within a historical time period, the number of times the external key storage agent module is called during each recharge process of the virtual bus card, the number of encryption operations of the hardware security module, and the number of requests received by the external key storage agent module for encryption requests;
[0128] If the number of recharges is not equal to the number of encryption operations, a fault audit is performed on the recharge operation according to the difference between the number of recharges and the number of encryption operations;
[0129] And, if the number of calls is not equal to the number of requests, a fault audit is performed on the call operation according to the number of calls and the number of requests;
[0130] And, if the number of requests is not equal to the number of encryption operations, a fault audit is performed on the encryption operation according to the number of requests and the number of encryption operations.
[0131] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.
[0132] The communication interface is used for communication between the above electronic device and other devices.
[0133] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.
[0134] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
[0135] The implementation methods and beneficial effects of the components of the electronic device in the above embodiments to solve the problems can be seen in Figure 2 The various steps in the illustrated embodiment are implemented, therefore, the specific working process and beneficial effects of the electronic device provided by the embodiment of the present application are not repeated here.
[0136] In another embodiment provided by the present application, a computer-readable storage medium is also provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes an audit method for external key storage calls described in any of the above embodiments.
[0137] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute an audit method for external key storage calls as described in any of the above embodiments.
[0138] Those skilled in the art will appreciate that the embodiments in the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt a complete hardware embodiment, a complete software embodiment, or a form of an embodiment combining software and hardware. Moreover, the present application may adopt a form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0139] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0140] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0141] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0142] Unless otherwise defined, the technical terms or scientific terms used in this application should be understood by people with ordinary skills in the field to which the present invention belongs. "First", "second" and similar words used in this application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect", "couple" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.
[0143] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic creative concepts. Therefore, the present application embodiments are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application embodiments.
[0144] Obviously, those skilled in the art can make various changes and modifications to the embodiments in the present application without departing from the spirit and scope of the embodiments in the present application. Thus, if these modifications and variations of the embodiments in the present application are within the scope of the embodiments in the present application and their equivalents, the embodiments in the present application are also intended to include these modifications and variations.
Claims
1. An audit method for external key storage calls, characterized in that: Applied to an external server including an external key storage agent module and a hardware security module, the method comprises: Obtain the number of successful recharges of the virtual bus card within a historical time period, the number of times the external key storage agent module is called during each recharge process of the virtual bus card, the number of encryption operations of the hardware security module, and the number of requests received by the external key storage agent module for encryption requests; If the number of recharges is not equal to the number of encryption operations, a fault audit is performed on the recharge operation according to the difference between the number of recharges and the number of encryption operations; And, if the number of calls is not equal to the number of requests, a fault audit is performed on the call operation according to the number of calls and the number of requests; And, if the number of requests is not equal to the number of encryption operations, a fault audit is performed on the encryption operation according to the number of requests and the number of encryption operations.
2. The method according to claim 1, characterized in that Conduct fault audit on recharge operations, including: If the number of recharges is greater than the number of encryption operations, then there are recharge frauds or operations bypassing the encryption process in the recharge operations during the historical time period, and a prompt message of recharge frauds or operations bypassing the encryption process is issued; If the number of recharge times is less than the number of encryption operations, then there is repeated encryption and invalid encryption in the recharge operations within the historical time period, and a prompt message indicating the existence of repeated encryption and invalid encryption is issued.
3. The method according to claim 1, characterized in that The method further includes: determining a recharge success rate according to the number of calls and the number of recharges.
4. The method according to claim 3, characterized in that Determining the recharge success rate according to the number of calls and the number of recharges includes: The ratio of the recharge times to the call times is determined as the recharge success rate.
5. The method according to claim 4, characterized in that After determining the recharge success rate, the method further includes: If the recharge success rate is lower than the preset recharge rate, a prompt message indicating transaction failure or processing timeout will be issued.
6. The method according to claim 1, characterized in that Perform fault audit on call operations, including: If the number of calls is greater than the number of requests, the call operation failure is a network transmission failure or the call request of the external key storage agent module to call the hardware security module is lost halfway, and a prompt message of network transmission failure or loss of the call request is issued; If the number of calls is less than the number of requests, the call operation failure is an unauthorized call request, and a prompt message indicating the existence of an unauthorized call request is issued.
7. The method according to claim 1, characterized in that Determining an encryption operation failure according to the number of requests and the number of encryption operations includes: If the number of requests is greater than the number of encryption operations, the encryption operation failure is that the external key storage agent module fails to send the encryption request to the hardware security module, and a prompt message is issued that the external key storage agent module fails to send the encryption request to the hardware security module; If the number of requests is less than the number of encryption operations, the encryption operation failure is that there is an unrecorded encryption operation in the external key storage agent module, and a prompt message indicating that there is an unrecorded encryption operation in the external key storage agent module is issued.
8. An audit device for external key storage call, characterized in that: Applied to an external server including an external key storage agent module and a hardware security module, the device includes: An acquisition unit is used to acquire the number of successful recharges of the virtual bus card in a historical time period, the number of times the external key storage agent module is called during each recharge process of the virtual bus card, the number of encryption operations of the hardware security module, and the number of requests received by the external key storage agent module for encryption requests; an audit unit, configured to, if the number of recharges is not equal to the number of encryption operations, perform a fault audit on the recharge operation according to the difference between the number of recharges and the number of encryption operations; And, if the number of calls is not equal to the number of requests, a fault audit is performed on the call operation according to the number of calls and the number of requests; And, if the number of requests is not equal to the number of encryption operations, a fault audit is performed on the encryption operation according to the number of requests and the number of encryption operations.
9. An electronic device, characterized in that: The electronic device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 7 when executing a program stored in a memory.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 7 are implemented.