Key synchronization method and cryptographic service platform based on SDF standard interface

Abstract

The present application provides a key synchronization method and cryptographic service platform based on an SDF standard interface, relating to the field of cryptographic application technology. The method comprises: a cryptographic middleware obtaining a first key encryption key (KEK) ciphertext from a first cryptographic device among multiple cryptographic devices; calling an SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device obtains the KEK key plaintext; calling an SDF export interface of a second cryptographic device to export the encryption public key of the second cryptographic device from the second cryptographic device among the multiple cryptographic devices; calling the SDF export interface of the first cryptographic device to derive a second KEK ciphertext from the first cryptographic device based on the encryption public key of the second cryptographic device; and calling the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, so that the second cryptographic device obtains the KEK key plaintext.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic applications, and in particular to a key synchronization method and a cryptographic service platform based on an SDF standard interface. Background Art

[0002] With the development of cloud computing technology, more and more information systems are migrating to the cloud, leveraging the high reliability and scalability of cloud environments to achieve centralized data management and efficient utilization of hardware resources. Traditional information systems rely on hardware such as server cryptographic machines to ensure information security. Consequently, the security of information systems in cloud environments relies on highly reliable and scalable cryptographic services. Traditional cryptographic services, such as cryptographic machine services, signature services, and electronic signature services, are centrally deployed. The underlying cryptographic equipment relies on the capabilities of the cryptographic vendor and is incompatible with cryptographic machines from different vendors.

[0003] In order to address the problems of ordinary cryptographic services in cloud computing environments and meet the needs of dynamic expansion of cryptographic computing capabilities, compatibility of underlying cryptographic equipment, and key synchronization between cryptographic machines, this application is based on a cryptographic service platform based on the SDF standard interface. The cryptographic middleware consists of multiple service nodes, cryptographic machines and virtual cryptographic machines. Each cryptographic machine or virtual cryptographic machine can achieve load balancing and provide the same cryptographic computing and key management services to the outside world. Summary of the Invention

[0004] The purpose of the present invention is to address the deficiencies in the above-mentioned prior art and provide a key synchronization method and a cryptographic service platform based on the SDF standard interface, so as to realize key synchronization between a first cryptographic device and a second cryptographic device through a cryptographic middleware, effectively solving the compatibility problem of heterogeneous manufacturers, and accessing cryptographic operations and key management based on the SDF standard interface of the cryptographic device, which can provide a unified access interface for upper-level applications, so that the cryptographic service platform can provide highly reliable, highly available and unified cryptographic services to the outside world.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of the present application are as follows:

[0006] In a first aspect, an embodiment of the present application provides a key synchronization method based on an SDF standard interface, which is applied to a cryptographic service platform, wherein the cryptographic service platform includes: a cryptographic middleware and multiple cryptographic devices connected to the cryptographic middleware, and the method includes:

[0007] The cryptographic middleware obtains a first key encryption key KEK ciphertext of a first cryptographic device among the multiple cryptographic devices; the first KEK ciphertext is a ciphertext obtained by encrypting the KEK key plaintext using the encryption public key of the first cryptographic device;

[0008] The cryptographic middleware calls the SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device decrypts the first KEK ciphertext using the encryption private key of the first cryptographic device to obtain the KEK key plaintext;

[0009] The cryptographic middleware calls the SDF export interface of the second cryptographic device, generates an encryption key pair of the second cryptographic device in the second cryptographic device among the multiple cryptographic devices, and exports the encryption public key of the second cryptographic device;

[0010] The cryptographic middleware calls the SDF export interface of the first cryptographic device to derive a second KEK ciphertext from the first cryptographic device based on the encryption public key of the second cryptographic device; the second KEK ciphertext is the ciphertext obtained by encrypting the KEK plaintext using the encryption public key of the second cryptographic device;

[0011] The cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, so that the second cryptographic device decrypts the second KEK ciphertext based on the encryption private key of the second cryptographic device to obtain the KEK key plaintext.

[0012] In an optional embodiment, the cryptographic middleware obtains a ciphertext of a first key encryption key KEK of a first cryptographic device among the multiple cryptographic devices, including:

[0013] The cryptographic middleware obtains the first KEK ciphertext from a preset database according to the serial number of the first cryptographic device;

[0014] Accordingly, the method further includes:

[0015] The cryptographic middleware saves the serial number of the second cryptographic device and the second KEK ciphertext to the preset database.

[0016] In an optional embodiment, after the cryptographic middleware calls the SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, the method further includes:

[0017] The cryptographic middleware further receives the key handle of the first cryptographic device returned by the first cryptographic device;

[0018] The cryptographic middleware stores the key handle of the first cryptographic device, and the key handle of the first cryptographic device is used to call the SDF encryption and decryption interface of the first cryptographic device to perform encryption and decryption operations on sensitive data or keys.

[0019] In an optional embodiment, after the cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, the method further includes:

[0020] The cryptographic middleware further receives the key handle of the second cryptographic device returned by the second cryptographic device;

[0021] The cryptographic middleware stores the key handle of the second cryptographic device, and the key handle of the second cryptographic device is used to call the SDF encryption and decryption interface of the second cryptographic device to perform encryption and decryption operations on sensitive data or keys.

[0022] In an optional embodiment, before the cryptographic middleware obtains the ciphertext of the first key encryption key KEK of the first cryptographic device among the multiple cryptographic devices, the method further includes:

[0023] The management terminal in the cryptographic service platform generates a KEK key;

[0024] The management end calls the SDF export interface of the first cryptographic device through the cryptographic middleware, generates an encryption key pair of the first cryptographic device in the first cryptographic device, and exports the encryption public key of the first cryptographic device;

[0025] The management terminal decrypts the KEK key to obtain the KEK key plaintext, and encrypts the KEK key plaintext according to the encryption public key of the first cryptographic device to obtain the first KEK ciphertext;

[0026] The management end calls the SDF import interface of the first cryptographic device through the cryptographic middleware to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device uses the encryption private key of the first cryptographic device to decrypt the first KEK ciphertext to obtain the KEK key plaintext, and returns the key handle of the first cryptographic device to the cryptographic middleware, so that the cryptographic middleware saves the key handle of the first cryptographic device and stores the serial number of the first cryptographic device and the first KEK ciphertext in the preset database.

[0027] In an optional embodiment, the method further comprises:

[0028] The cryptographic middleware obtains the business data of the cryptographic service request triggered by the application information system and converts the business data into business parameters in a preset cryptographic operation format;

[0029] The cryptographic middleware schedules the multiple cryptographic devices and determines a target cryptographic device;

[0030] The cryptographic middleware obtains a link to the target cryptographic device and uses the link to send the service parameters to the target cryptographic device for cryptographic operation;

[0031] The cryptographic middleware obtains the cryptographic operation result returned by the target cryptographic device;

[0032] The cryptographic middleware converts the cryptographic operation result into data in a preset business parameter format corresponding to the application information system, and returns the data to the application information system.

[0033] In an optional embodiment, the method further comprises:

[0034] The cryptographic middleware further obtains the device requirement quantity in the cryptographic service request;

[0035] The cryptographic middleware schedules the multiple cryptographic devices according to the required number of devices, and determines the target cryptographic devices of the required number of devices.

[0036] In an optional embodiment, the cryptographic middleware schedules the multiple cryptographic devices and determines the target cryptographic device, including:

[0037] The cryptographic middleware schedules the multiple cryptographic devices according to resource occupancy of the multiple cryptographic devices and determines the target cryptographic device.

[0038] In an optional embodiment, the method further comprises:

[0039] The cryptographic middleware releases the occupied resources of the target cryptographic device.

[0040] In the second aspect, an embodiment of the present application also provides a cryptographic service platform, including: a cryptographic middleware and multiple cryptographic devices connected to the cryptographic middleware, and the cryptographic middleware is used to execute any step of the key synchronization method based on the SDF standard interface described in the first aspect.

[0041] The beneficial effects of this application are:

[0042] The present application provides a key synchronization method and a cryptographic service platform based on an SDF standard interface. The method includes: a cryptographic middleware obtains a first key encryption key KEK ciphertext of a first cryptographic device from a plurality of cryptographic devices, where the first KEK ciphertext is the ciphertext obtained by encrypting the KEK key plaintext using the encryption public key of the first cryptographic device; the cryptographic middleware calls an SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device decrypts the first KEK ciphertext using the encryption private key of the first cryptographic device to obtain the KEK key plaintext; and the cryptographic middleware calls an SDF export interface of a second cryptographic device. In a second cryptographic device among the multiple cryptographic devices, an encryption key pair for the second cryptographic device is generated and the encryption public key of the second cryptographic device is derived. Based on the encryption public key of the second cryptographic device, the cryptographic middleware calls the SDF export interface of the first cryptographic device to derive the second KEK ciphertext from the first cryptographic device. The second KEK ciphertext is the ciphertext obtained by encrypting the KEK key plaintext using the encryption public key of the second cryptographic device. The cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, so that the second cryptographic device decrypts the second KEK ciphertext based on the encryption private key of the second cryptographic device to obtain the KEK key plaintext. The method of the present application achieves key synchronization between the first and second cryptographic devices through the cryptographic middleware, effectively resolving compatibility issues among heterogeneous vendors. Furthermore, by accessing cryptographic operations and key management based on the SDF standard interface of the cryptographic device, a unified access interface can be provided for upper-layer applications, enabling the cryptographic service platform to provide highly reliable and highly available unified cryptographic services. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 A schematic diagram of a cryptographic service platform provided in an embodiment of the present application;

[0045] Figure 2 One of the flow diagrams of a key synchronization method based on the SDF standard interface provided in an embodiment of the present application;

[0046] Figure 3 The second flowchart of a key synchronization method based on the SDF standard interface provided in an embodiment of the present application;

[0047] Figure 4The third flowchart of a key synchronization method based on the SDF standard interface provided in an embodiment of the present application;

[0048] Figure 5 4 is a flowchart of a key synchronization method based on the SDF standard interface provided in an embodiment of the present application;

[0049] Figure 6 A schematic diagram of the functional modules of a key synchronization device based on the SDF standard interface provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0051] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present application. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments in the present application without creative work are within the scope of protection of the present application.

[0052] In the description of this application, it should be noted that if the terms "upper", "lower", etc. appear, the orientation or position relationship indicated is based on the orientation or position relationship shown in the accompanying drawings, or is the orientation or position relationship in which the product of the application is usually placed when in use. It is only for the convenience of describing this application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on this application.

[0053] In addition, the terms "first," "second," and the like in the description and claims of the present invention and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having," as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to these processes, methods, products, or apparatus.

[0054] It should be noted that, in the absence of conflict, the features in the embodiments of this application can be combined with each other.

[0055] In order to better understand the solutions provided by the following embodiments of the present application, the technical terms involved in the following embodiments of the present application are first explained here.

[0056] SDF (Secure Device Format) is a security interface standard for smart cards and cryptographic devices. It defines protocols and specifications for communicating with smart cards and performing secure operations. SDF can be used to perform various cryptographic operations, including key management, encryption, decryption, digital signatures, and identity authentication. Smartcard vendors typically provide SDF interfaces so that developers can use them to securely communicate and operate with smart cards.

[0057] KEK (Key Encryption Key) is a key encryption key used to encrypt other keys to ensure the secure transmission and storage of keys.

[0058] Figure 1 A schematic diagram of a cryptographic service platform provided in an embodiment of the present application is shown as follows: Figure 1 As shown, the cryptographic service platform includes: a cryptographic middleware and multiple cryptographic devices connected to the cryptographic middleware, wherein the multiple cryptographic devices include: a cryptographic device and / or a virtual cryptographic device. The cryptographic device, i.e., a cryptographic machine, is a device that encrypts and decrypts information. By encrypting the information, the security and confidentiality of the information during transmission are determined. The virtual cryptographic device can be a virtual cryptographic device obtained based on the cloud server cryptographic device, and is also used for secure storage of cryptographic operations and key encryption keys. The SDF interface specifications of the multiple cryptographic devices all comply with the preset standard cryptographic device application interface specifications.

[0059] Cryptographic middleware is a type of middleware located at the software interface level that provides flexible and versatile cryptographic operation services for application information systems. It includes a cryptographic device management module, a request management module, a key management module, a scheduling management module, a connection management module, and a database module. The cryptographic device management module primarily configures information and synchronizes keys across multiple cryptographic devices, including configuring cryptographic device service information and performance specifications, monitoring and maintaining the operating status of cryptographic devices, and synchronizing keys between cryptographic devices. The request processing module receives cryptographic service requests from application information systems, parses the request content and parameters, and verifies the validity of the parameters. It converts the data in the cryptographic service requests into data that the cryptographic devices can recognize, and converts the results returned by the cryptographic devices into data that the application information system can easily understand and use. The key management module primarily performs key initialization and synchronizes keys between cryptographic devices. The scheduling management module selects the instance responsible for cryptographic operations based on the device scheduling algorithm and then obtains the corresponding connection for the cryptographic device from the connection management module. The connection management module is responsible for establishing connections between the cryptographic middleware and multiple cryptographic devices, creating and maintaining sessions with these devices. The database module is used to store general information and encrypted ciphertext of sensitive information and key information.

[0060] In order to solve the problem of key synchronization difficulties between different cryptographic devices, an embodiment of the present application provides a key synchronization method based on the SDF standard interface, which is applied to a cryptographic service platform, and obtains a first key encryption key KEK ciphertext of a first cryptographic device among multiple cryptographic devices through a cryptographic middleware; the first KEK ciphertext is a ciphertext obtained by encrypting the KEK key plaintext with the encryption public key of the first cryptographic device, and the cryptographic middleware calls the SDF import interface of the first cryptographic device to import the first KEK ciphertext to the first cryptographic device, so that the first cryptographic device uses the encryption private key of the first cryptographic device to decrypt the first KEK ciphertext to obtain the KEK key plaintext, and the cryptographic middleware calls the second cryptographic device to decrypt the first KEK ciphertext. The SDF export interface of the device generates an encryption key pair for the second cryptographic device in a second cryptographic device among the multiple cryptographic devices and derives the second cryptographic device's encryption public key. Based on the second cryptographic device's encryption public key, the cryptographic middleware calls the SDF export interface of the first cryptographic device to derive the second KEK ciphertext from the first cryptographic device. The second KEK ciphertext is the ciphertext of the KEK key plaintext encrypted using the second cryptographic device's encryption public key. The cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, allowing the second cryptographic device to decrypt the second KEK ciphertext using the second cryptographic device's encryption private key to obtain the KEK key plaintext. This achieves key synchronization between different cryptographic devices, improving the performance and availability of cryptographic services, and thus ensuring the high reliability and high availability of the cryptographic service platform.

[0061] The key synchronization method based on the SDF standard interface provided by the present application is described below with reference to the accompanying drawings through multiple examples. The key synchronization method based on the SDF standard interface is applied to a cryptographic service platform. Figure 2 One of the flow charts of a key synchronization method based on the SDF standard interface provided in the embodiment of the present application is as follows: Figure 2 As shown, the method includes:

[0062] S101. The cryptographic middleware obtains a ciphertext of a first key encryption key KEK of a first cryptographic device among multiple cryptographic devices.

[0063] The first KEK ciphertext is the ciphertext obtained by encrypting the KEK key plaintext using the encryption public key of the first cryptographic device.

[0064] In this embodiment, when the cryptographic service platform adds a new cryptographic device, i.e., a second cryptographic device, or restarts a cryptographic device, multiple cryptographic devices need to synchronize keys. The first cryptographic device is a pre-initialized cryptographic device among the multiple cryptographic devices, i.e., the first cryptographic device pre-stores the KEK key plaintext.

[0065] The key management module in the cryptographic middleware obtains the first KEK ciphertext of the first cryptographic device from the database module.

[0066] S102: The cryptographic middleware calls the SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device decrypts the first KEK ciphertext using the encryption private key of the first cryptographic device to obtain the KEK key plaintext.

[0067] Specifically, the key management module of the cryptographic middleware calls the SDF import interface of the first cryptographic device, namely the SDF_ImPortKeyWtihISK_ECC interface, to import the first KEK ciphertext into the first cryptographic device. Since the first KEK ciphertext is obtained by encrypting the KEK key plaintext with the encryption public key of the first cryptographic device, the first cryptographic device decrypts the first KEK ciphertext with the encryption private key of the first cryptographic device to obtain the KEK key plaintext.

[0068] S103: The cryptographic middleware calls the SDF export interface of the second cryptographic device, generates an encryption key pair of the second cryptographic device in the second cryptographic device among the multiple cryptographic devices, and exports the encryption public key of the second cryptographic device.

[0069] Among them, the second cryptographic device is a cryptographic device that does not store the KEK key plaintext among the multiple cryptographic devices, that is, a cryptographic device that has not performed key synchronization. If the number of multiple cryptographic devices is 4, and the first cryptographic device is the first cryptographic device, that is, the device that stores the KEK key plaintext, then the three cryptographic devices other than the first cryptographic device are all called second cryptographic devices. Key synchronization of the three cryptographic devices needs to be performed. The first cryptographic device can be used to perform key synchronization with the three cryptographic devices respectively, or if the first cryptographic device has completed key synchronization with the second cryptographic device, the second cryptographic device can be used to perform key synchronization with the remaining two cryptographic devices respectively. There is no restriction here.

[0070] Specifically, the cryptographic management module of the cryptographic middleware calls the SDF export interface of the second cryptographic device, namely the SDF_ExportEncPublicKey_ECC interface, generates an encryption key pair of the second cryptographic device at a specified index position inside the second cryptographic device, and exports the encrypted public key in the encryption key pair of the second cryptographic device. The cryptographic management module obtains the encrypted public key of the second cryptographic device.

[0071] S104: The cryptographic middleware calls the SDF export interface of the first cryptographic device to export the second KEK ciphertext from the first cryptographic device according to the encrypted public key of the second cryptographic device.

[0072] The second KEK ciphertext is the ciphertext obtained by encrypting the KEK key plaintext using the encryption public key of the second cryptographic device.

[0073] Specifically, the cryptographic management module of the cryptographic middleware sends the encrypted public key of the second cryptographic device to the first cryptographic device. The first cryptographic device encrypts the KEK key with the encrypted public key of the second cryptographic device to obtain the second KEK ciphertext, and exports the second KEK ciphertext to the key management module of the cryptographic middleware.

[0074] S105. The cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, so that the second cryptographic device decrypts the second KEK ciphertext based on the encryption private key of the second cryptographic device to obtain the KEK key plaintext.

[0075] Specifically, the key management module of the cryptographic middleware calls the SDF import interface of the second cryptographic device, namely the SDF_ImPortKeyWtihISK_ECC interface, to import the second KEK ciphertext into the second cryptographic device. Since the second KEK ciphertext is the ciphertext obtained by the first cryptographic device encrypting the KEK key plaintext with the encryption public key of the second cryptographic device, the second cryptographic device decrypts the second KEK ciphertext with the encryption private key of the second cryptographic device to obtain the KEK key plaintext.

[0076] In summary, an embodiment of the present application provides a key synchronization method based on an SDF standard interface, the method comprising: a cryptographic middleware obtains a first key encryption key KEK ciphertext of a first cryptographic device among multiple cryptographic devices, the first KEK ciphertext being a ciphertext obtained by encrypting the KEK key plaintext using the encryption public key of the first cryptographic device; the cryptographic middleware calls the SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device decrypts the first KEK ciphertext using the encryption private key of the first cryptographic device to obtain the KEK key plaintext; the cryptographic middleware calls the SDF export interface of the second cryptographic device, and An encryption key pair of the second cryptographic device is generated in a second cryptographic device among the multiple cryptographic devices, and an encryption public key of the second cryptographic device is derived. The cryptographic middleware calls the SDF export interface of the first cryptographic device to derive the second KEK ciphertext from the first cryptographic device based on the encryption public key of the second cryptographic device. The second KEK ciphertext is the ciphertext obtained by encrypting the KEK key plaintext using the encryption public key of the second cryptographic device. The cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, so that the second cryptographic device decrypts the second KEK ciphertext based on the encryption private key of the second cryptographic device to obtain the KEK key plaintext.

[0077] The method of the present application realizes key synchronization between the first cryptographic device and the second cryptographic device through cryptographic middleware, effectively solving the compatibility problem of heterogeneous manufacturers, and accessing cryptographic operations and key management based on the SDF standard interface of the cryptographic device, which can provide a unified access interface for upper-level applications, enabling the cryptographic service platform to provide highly reliable, highly available unified cryptographic services to the outside world.

[0078] Based on the above embodiment, the embodiment of the present application also provides another possible implementation of the key synchronization method based on the SDF standard interface. Figure 3 The second flow chart of a key synchronization method based on the SDF standard interface provided in the embodiment of the present application is as follows: Figure 3 As shown, the cryptographic middleware obtains the first key encryption key KEK ciphertext of the first cryptographic device among the multiple cryptographic devices, including:

[0079] S201. The cryptographic middleware obtains a first KEK ciphertext from a preset database according to the serial number of the first cryptographic device;

[0080] Accordingly, the method further includes:

[0081] S202: The cryptographic middleware saves the serial number of the second cryptographic device and the second KEK ciphertext to a preset database.

[0082] In this embodiment, the preset database of the key middleware, i.e., the database module, pre-stores the serial number of the first cryptographic device and the corresponding first KEK ciphertext. Therefore, the key management module of the cryptographic middleware can obtain the first KEK ciphertext from the preset database according to the serial number of the first cryptographic device.

[0083] The cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, so that the second cryptographic device decrypts the second KEK ciphertext based on the encryption private key of the second cryptographic device. After obtaining the KEK key plaintext, the key management module of the cryptographic middleware stores the serial number of the second cryptographic device and the second KEK ciphertext in a preset database.

[0084] The present application embodiment also provides another possible implementation of the key synchronization method based on the SDF standard interface, and further reference is made to Figure 2 After the cryptographic middleware calls the SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, the method further includes:

[0085] S301: The cryptographic middleware further receives a key handle of the first cryptographic device returned by the first cryptographic device.

[0086] S302: The cryptographic middleware saves the key handle of the first cryptographic device.

[0087] The key handle of the first cryptographic device is used to call the SDF encryption and decryption interface of the first cryptographic device to perform encryption and decryption operations on sensitive data or keys.

[0088] In this embodiment, the key management module of the cryptographic middleware also receives the key handle of the first cryptographic device returned by the first cryptographic device, and saves and maintains the key handle of the first cryptographic device, where the key handle refers to an identifier used to identify and manage keys. In the cryptographic device, the key handle is mainly used to access and operate keys to ensure the safe storage and use of keys.

[0089] Among them, the SDF encryption interface, namely the SDF_Encrypt interface, performs encryption operations on sensitive data or keys, and the SDF decryption interface, namely the SDF_Decrypt interface, performs decryption operations on sensitive data or keys.

[0090] In the method provided in the embodiment of the present application, the cryptographic middleware also receives the key handle of the first cryptographic device returned by the first cryptographic device, and the cryptographic middleware saves the key handle of the first cryptographic device. The key handle of the first cryptographic device is used to call the SDF encryption and decryption interface of the first cryptographic device to perform encryption and decryption operations on sensitive data or keys. The cryptographic middleware can call the SDF encryption and decryption interface of the first cryptographic device through the key handle of the first cryptographic device to perform encryption and decryption operations on sensitive data or keys.

[0091] The present application embodiment also provides another possible implementation of the key synchronization method based on the SDF standard interface, and further reference is made to Figure 2 After the cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, the method further includes:

[0092] S401: The cryptographic middleware further receives a key handle of the second cryptographic device returned by the second cryptographic device.

[0093] S402: The cryptographic middleware saves the key handle of the second cryptographic device.

[0094] The key handle of the second cryptographic device is used to call the SDF encryption and decryption interface of the second cryptographic device to perform encryption and decryption operations on sensitive data or keys.

[0095] In this embodiment, the key management module of the cryptographic middleware further receives the key handle of the second cryptographic device returned by the second cryptographic device, and saves and maintains the key handle of the second cryptographic device.

[0096] Among them, the SDF encryption interface, namely the SDF_Encrypt interface, performs encryption operations on sensitive data or keys, and the SDF decryption interface, namely the SDF_Decrypt interface, performs decryption operations on sensitive data or keys.

[0097] In the method provided in an embodiment of the present application, the cryptographic middleware further receives a key handle of the second cryptographic device returned by the second cryptographic device. The cryptographic middleware stores the key handle of the second cryptographic device, and uses the key handle of the second cryptographic device to invoke the SDF encryption and decryption interface of the second cryptographic device to perform encryption and decryption operations on sensitive data or keys. The cryptographic middleware can invoke the SDF encryption and decryption interface of the second cryptographic device using the key handle of the second cryptographic device to perform encryption and decryption operations on the sensitive data or keys.

[0098] The embodiment of the present application also provides another possible implementation of the key synchronization method based on the SDF standard interface. Figure 4 The third flow chart of a key synchronization method based on the SDF standard interface provided in the embodiment of the present application is as follows: Figure 4 As shown, before the cryptographic middleware obtains the ciphertext of the first key encryption key KEK of the first cryptographic device among the multiple cryptographic devices, the method further includes:

[0099] S501: The management terminal in the cryptographic service platform generates a KEK key.

[0100] In this embodiment, the cryptographic service platform includes a management terminal, which includes a USBKEY smart cryptographic key. The USBKEY is a hardware device that connects directly to a computer via a USB (Universal Serial Bus) interface. It provides password verification capabilities and reliable, high-speed data storage and identity authentication services. It has a built-in microcontroller or smart card chip and a sufficient amount of storage space for sensitive information such as user private keys and digital certificates. The management terminal uses the USBKEY to generate the KEK key.

[0101] S502: The management end calls the SDF export interface of the first cryptographic device through the cryptographic middleware, generates an encryption key pair of the first cryptographic device in the first cryptographic device, and exports the encryption public key of the first cryptographic device.

[0102] Specifically, the management end calls the SDF export interface of the first cryptographic device through the cryptographic middleware, namely the SDF_ExportEncPublicKey_ECC interface, generates an encryption key pair of the first cryptographic device at a specified index position inside the first cryptographic device, and exports the encryption public key in the encryption key pair of the first cryptographic device. The management end obtains the encryption public key of the first cryptographic device.

[0103] S503: The management terminal decrypts the KEK key to obtain a KEK key plaintext, and encrypts the KEK key plaintext according to the encryption public key of the first cryptographic device to obtain a first KEK ciphertext.

[0104] Specifically, the management terminal decrypts the KEK key internally through the USBKEY to obtain the KEK key plaintext, and then encrypts the KEK key plaintext with the encryption public key of the first cryptographic device to obtain the first KEK ciphertext.

[0105] S504. The management end calls the SDF import interface of the first cryptographic device through the cryptographic middleware to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device decrypts the first KEK ciphertext using the encryption private key of the first cryptographic device to obtain the KEK key plaintext, and returns the key handle of the first cryptographic device to the cryptographic middleware, so that the cryptographic middleware saves the key handle of the first cryptographic device and stores the serial number of the first cryptographic device and the first KEK ciphertext in a preset database.

[0106] Specifically, the management end calls the SDF import interface of the first cryptographic device through the cryptographic middleware, that is, the SDF_ImPortKeyWtihISK_ECC interface, to import the first KEK ciphertext into the first cryptographic device. Since the first KEK ciphertext is the ciphertext obtained by the management end encrypting the KEK key plaintext with the encryption public key of the first cryptographic device, the first cryptographic device decrypts the first KEK ciphertext with the encryption private key of the first cryptographic device to obtain the KEK key plaintext.

[0107] The first cryptographic device returns the key handle of the first cryptographic device to the cryptographic middleware, so that the cryptographic middleware saves the key handle of the first cryptographic device to the key management module and stores the serial number of the first cryptographic device and the first KEK ciphertext to the preset database.

[0108] In the method provided in an embodiment of the present application, a management terminal in a cryptographic service platform generates a KEK key. The management terminal invokes the SDF export interface of a first cryptographic device through cryptographic middleware, generates an encryption key pair for the first cryptographic device in the first cryptographic device, and exports the encryption public key of the first cryptographic device. The management terminal decrypts the KEK key to obtain a KEK key plaintext, and encrypts the KEK key plaintext using the encryption public key of the first cryptographic device to obtain a first KEK ciphertext. The management terminal invokes the SDF import interface of the first cryptographic device through the cryptographic middleware to import the first KEK ciphertext into the first cryptographic device, causing the first cryptographic device to decrypt the first KEK ciphertext using the encryption private key of the first cryptographic device to obtain the KEK key plaintext. The management terminal then returns a key handle for the first cryptographic device to the cryptographic middleware, causing the cryptographic middleware to save the key handle for the first cryptographic device and store the serial number of the first cryptographic device and the first KEK ciphertext in a preset database. This implements the initialization of the first cryptographic device by the management terminal and stores the KEK key plaintext in the first cryptographic device.

[0109] The embodiment of the present application also provides another possible implementation of the key synchronization method based on the SDF standard interface. Figure 5 The fourth flow chart of a key synchronization method based on the SDF standard interface provided in the embodiment of the present application is as follows: Figure 5 As shown, the method further includes:

[0110] S601. The cryptographic middleware obtains the business data of the cryptographic service request triggered by the application information system, and converts the business data into business parameters in a preset cryptographic operation format.

[0111] In this embodiment, after completing key synchronization for multiple cryptographic devices, if the cryptographic service platform interface receives a cryptographic service request triggered by the application information system, the request management module in the cryptographic middleware parses the content of the cryptographic service request to obtain business data, and then converts the business data into business parameters in a preset cryptographic operation format, that is, data that can be recognized by the cryptographic device.

[0112] S602: The cryptographic middleware schedules multiple cryptographic devices and determines a target cryptographic device.

[0113] Specifically, the request management module of the cryptographic middleware selects a target cryptographic device according to the business parameters and processes the request. If multiple target cryptographic devices need to be called according to the business parameters, the request management module simultaneously calls multiple target cryptographic devices to process the request.

[0114] The scheduling management module of the cryptographic middleware schedules multiple cryptographic devices according to the request of the request management module and determines the target cryptographic device.

[0115] Optionally, the cryptographic middleware schedules multiple cryptographic devices according to resource occupancy of the multiple cryptographic devices and determines a target cryptographic device.

[0116] For example, the scheduling management module uses the minimum number of connections method to determine the target cryptographic device. In this method, the connection is the channel between the cryptographic middleware and the cryptographic device. When the cryptographic device begins operation, the number of active connections is increased by 1 based on the resource usage of multiple cryptographic devices. When the cryptographic device completes operation, the number of active connections is decreased by 1. During each load cycle, the cryptographic device with the fewest active connections is selected to determine the target cryptographic device.

[0117] Optionally, the cryptographic middleware also obtains the device requirement quantity in the cryptographic service request.

[0118] The cryptographic middleware schedules multiple cryptographic devices according to the required number of devices and determines the target cryptographic devices of the required number of devices.

[0119] If the number of devices required in the cryptographic service request is 5, the request management module calls 5 target cryptographic devices and processes the request. The scheduling management module uses the minimum connection number method to determine 5 target cryptographic devices from multiple cryptographic devices based on the resource usage of multiple cryptographic devices, and schedules the 5 target cryptographic devices.

[0120] S603: The cryptographic middleware obtains the link of the target cryptographic device and uses the link to send the business parameters to the target cryptographic device for cryptographic operation.

[0121] S604: The cryptographic middleware obtains the cryptographic operation result returned by the target cryptographic device.

[0122] S605: The cryptographic middleware converts the cryptographic operation result into data in a preset business parameter format corresponding to the application information system, and returns the data to the application information system.

[0123] Specifically, the connection management module in the cryptographic middleware obtains the link of the target cryptographic device and uses the link to send the business parameters to the target cryptographic device for cryptographic operations. After the request management module imported into the cryptographic middleware obtains the cryptographic operation results returned by the target cryptographic device, it converts the cryptographic operation results into data in the preset business parameter format corresponding to the application information system and replies to the application information system.

[0124] Optionally, the cryptographic middleware releases occupied resources of the target cryptographic device.

[0125] In the method provided in an embodiment of the present application, cryptographic middleware obtains business data from a cryptographic service request triggered by an application information system and converts the business data into business parameters in a preset cryptographic operation format. The cryptographic middleware then schedules multiple cryptographic devices, determines a target cryptographic device, obtains a link to the target cryptographic device, and uses the link to send the business parameters to the target cryptographic device for cryptographic operation. The cryptographic middleware then obtains the cryptographic operation result returned by the target cryptographic device, converts the cryptographic operation result into data in a preset business parameter format corresponding to the application information system, and returns it to the application information system. After completing key synchronization for multiple cryptographic devices, the multiple cryptographic devices are flexibly scheduled, achieving high availability through load balancing.

[0126] The following continues to explain the key synchronization device based on the SDF standard interface provided by any of the above embodiments of the present application. Its specific implementation process and the technical effects produced are the same as those of the corresponding method embodiments mentioned above. For the sake of brief description, for the parts not mentioned in this embodiment, please refer to the corresponding content in the method embodiment.

[0127] Figure 6 A schematic diagram of the functional modules of a key synchronization device based on the SDF standard interface provided in an embodiment of the present application. Applied to a cryptographic service platform, the cryptographic service platform includes: a cryptographic middleware and multiple cryptographic devices connected to the cryptographic middleware, such as Figure 5 As shown, the key synchronization device 100 based on the SDF standard interface includes:

[0128] An acquisition module 110 is configured for the cryptographic middleware to acquire a first key encryption key KEK ciphertext of a first cryptographic device among the multiple cryptographic devices; the first KEK ciphertext is a ciphertext obtained by encrypting the KEK key plaintext using the encryption public key of the first cryptographic device;

[0129] An import module 120 is configured to enable the cryptographic middleware to call the SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device decrypts the first KEK ciphertext using the encryption private key of the first cryptographic device to obtain a KEK key plaintext.

[0130] An export module 130, configured for the cryptographic middleware to call an SDF export interface of a second cryptographic device, generate an encryption key pair of the second cryptographic device in a second cryptographic device among the multiple cryptographic devices, and export an encryption public key of the second cryptographic device;

[0131] The export module 130 is further configured to cause the cryptographic middleware to call the SDF export interface of the first cryptographic device to derive a second KEK ciphertext from the first cryptographic device based on the encryption public key of the second cryptographic device; the second KEK ciphertext is the ciphertext obtained by encrypting the KEK plaintext using the encryption public key of the second cryptographic device;

[0132] The import module 120 is also used by the cryptographic middleware to call the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, so that the second cryptographic device decrypts the second KEK ciphertext based on the encryption private key of the second cryptographic device to obtain the KEK key plaintext.

[0133] Optionally, the acquisition module 110 is further configured for the cryptographic middleware to acquire the first KEK ciphertext from a preset database according to the serial number of the first cryptographic device.

[0134] Accordingly, the device further comprises:

[0135] A saving module is used for the cryptographic middleware to save the serial number of the second cryptographic device and the second KEK ciphertext to the preset database.

[0136] Optionally, the device further comprises:

[0137] A receiving module, configured for the cryptographic middleware to further receive the key handle of the first cryptographic device returned by the first cryptographic device;

[0138] The saving module is also used by the cryptographic middleware to save the key handle of the first cryptographic device, and the key handle of the first cryptographic device is used to call the SDF encryption and decryption interface of the first cryptographic device to perform encryption and decryption operations on sensitive data or keys.

[0139] Optionally, the receiving module is further configured for the cryptographic middleware to receive the key handle of the second cryptographic device returned by the second cryptographic device;

[0140] The storage module is also used by the cryptographic middleware to store the key handle of the second cryptographic device, and the key handle of the second cryptographic device is used to call the SDF encryption and decryption interface of the second cryptographic device to perform encryption and decryption operations on sensitive data or keys.

[0141] Optionally, the device further comprises:

[0142] An initialization module is configured to generate a KEK key at a management end in the cryptographic service platform; the management end calls the SDF export interface of the first cryptographic device through the cryptographic middleware to generate an encryption key pair of the first cryptographic device in the first cryptographic device and export the encryption public key of the first cryptographic device; the management end decrypts the KEK key to obtain the KEK key plaintext, and encrypts the KEK key plaintext according to the encryption public key of the first cryptographic device to obtain the first KEK ciphertext; the management end calls the SDF import interface of the first cryptographic device through the cryptographic middleware to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device decrypts the first KEK ciphertext using the encryption private key of the first cryptographic device to obtain the KEK key plaintext, and returns the key handle of the first cryptographic device to the cryptographic middleware, so that the cryptographic middleware saves the key handle of the first cryptographic device and stores the serial number of the first cryptographic device and the first KEK ciphertext in the preset database.

[0143] Optionally, the device further comprises:

[0144] A scheduling module is used for the cryptographic middleware to obtain the business data of the cryptographic service request triggered by the application information system and convert the business data into business parameters in a preset cryptographic operation format; the cryptographic middleware schedules the multiple cryptographic devices and determines the target cryptographic device; the cryptographic middleware obtains the link of the target cryptographic device and uses the link to send the business parameters to the target cryptographic device for cryptographic operation; the cryptographic middleware obtains the cryptographic operation result returned by the target cryptographic device; the cryptographic middleware converts the cryptographic operation result into data in a preset business parameter format corresponding to the application information system, and replies to the application information system.

[0145] Optionally, the scheduling module is also used for the cryptographic middleware to obtain the device requirement quantity in the cryptographic service request; the cryptographic middleware schedules the multiple cryptographic devices according to the device requirement quantity, and determines the target cryptographic devices of the device requirement quantity.

[0146] Optionally, the scheduling module is further used by the cryptographic middleware to schedule the multiple cryptographic devices according to resource occupancy of the multiple cryptographic devices and determine the target cryptographic device.

[0147] Optionally, the scheduling module is also used by the cryptographic middleware to release the occupied resources of the target cryptographic device.

[0148] The above-mentioned device is used to execute the method provided in the above-mentioned embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0149] The above modules can be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), one or more microprocessors, or one or more field programmable gate arrays (FPGAs). For another example, when a module is implemented by scheduling program code through a processing element, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules can be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0150] The above are only specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A key synchronization method based on the SDF standard interface, characterized in that: Applied to a cryptographic service platform, the cryptographic service platform includes: a cryptographic middleware and a plurality of cryptographic devices connected to the cryptographic middleware, the method includes: The cryptographic middleware obtains a first key encryption key KEK ciphertext of a first cryptographic device among the multiple cryptographic devices; the first KEK ciphertext is a ciphertext obtained by encrypting the KEK key plaintext using the encryption public key of the first cryptographic device; The cryptographic middleware calls the SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device decrypts the first KEK ciphertext using the encryption private key of the first cryptographic device to obtain the KEK key plaintext; The cryptographic middleware calls the SDF export interface of the second cryptographic device, generates an encryption key pair of the second cryptographic device in the second cryptographic device among the multiple cryptographic devices, and exports the encryption public key of the second cryptographic device; The cryptographic middleware calls the SDF export interface of the first cryptographic device to derive a second KEK ciphertext from the first cryptographic device based on the encryption public key of the second cryptographic device; the second KEK ciphertext is the ciphertext obtained by encrypting the KEK plaintext using the encryption public key of the second cryptographic device; The cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, so that the second cryptographic device decrypts the second KEK ciphertext based on the encryption private key of the second cryptographic device to obtain the KEK key plaintext.

2. The method according to claim 1, characterized in that The cryptographic middleware obtains a ciphertext of a first key encryption key KEK of a first cryptographic device among the multiple cryptographic devices, including: The cryptographic middleware obtains the first KEK ciphertext from a preset database according to the serial number of the first cryptographic device; Accordingly, the method further includes: The cryptographic middleware saves the serial number of the second cryptographic device and the second KEK ciphertext to the preset database.

3. The method according to claim 1, characterized in that After the cryptographic middleware calls the SDF import interface of the first cryptographic device to import the first KEK ciphertext into the first cryptographic device, the method further includes: The cryptographic middleware further receives the key handle of the first cryptographic device returned by the first cryptographic device; The cryptographic middleware stores the key handle of the first cryptographic device, and the key handle of the first cryptographic device is used to call the SDF encryption and decryption interface of the first cryptographic device to perform encryption and decryption operations on sensitive data or keys.

4. The method according to claim 1, wherein After the cryptographic middleware calls the SDF import interface of the second cryptographic device to import the second KEK ciphertext into the second cryptographic device, the method further includes: The cryptographic middleware further receives the key handle of the second cryptographic device returned by the second cryptographic device; The cryptographic middleware stores the key handle of the second cryptographic device, and the key handle of the second cryptographic device is used to call the SDF encryption and decryption interface of the second cryptographic device to perform encryption and decryption operations on sensitive data or keys.

5. The method according to claim 2, characterized in that Before the cryptographic middleware obtains the ciphertext of the first key encryption key KEK of the first cryptographic device among the multiple cryptographic devices, the method further includes: The management terminal in the cryptographic service platform generates a KEK key; The management end calls the SDF export interface of the first cryptographic device through the cryptographic middleware, generates an encryption key pair of the first cryptographic device in the first cryptographic device, and exports the encryption public key of the first cryptographic device; The management terminal decrypts the KEK key to obtain the KEK key plaintext, and encrypts the KEK key plaintext according to the encryption public key of the first cryptographic device to obtain the first KEK ciphertext; The management end calls the SDF import interface of the first cryptographic device through the cryptographic middleware to import the first KEK ciphertext into the first cryptographic device, so that the first cryptographic device uses the encryption private key of the first cryptographic device to decrypt the first KEK ciphertext to obtain the KEK key plaintext, and returns the key handle of the first cryptographic device to the cryptographic middleware, so that the cryptographic middleware saves the key handle of the first cryptographic device and stores the serial number of the first cryptographic device and the first KEK ciphertext in the preset database.

6. The method according to claim 1, characterized in that The method further comprises: The cryptographic middleware obtains the business data of the cryptographic service request triggered by the application information system and converts the business data into business parameters in a preset cryptographic operation format; The cryptographic middleware schedules the multiple cryptographic devices and determines a target cryptographic device; The cryptographic middleware obtains a link to the target cryptographic device and uses the link to send the service parameters to the target cryptographic device for cryptographic operation; The cryptographic middleware obtains the cryptographic operation result returned by the target cryptographic device; The cryptographic middleware converts the cryptographic operation result into data in a preset business parameter format corresponding to the application information system, and returns the data to the application information system.

7. The method according to claim 6, characterized in that The method further comprises: The cryptographic middleware further obtains the device requirement quantity in the cryptographic service request; The cryptographic middleware schedules the multiple cryptographic devices according to the required number of devices, and determines the target cryptographic devices of the required number of devices.

8. The method according to claim 6, characterized in that The cryptographic middleware schedules the multiple cryptographic devices and determines the target cryptographic device, including: The cryptographic middleware schedules the multiple cryptographic devices according to resource occupancy of the multiple cryptographic devices and determines the target cryptographic device.

9. The method according to claim 8, characterized in that The method further comprises: The cryptographic middleware releases the occupied resources of the target cryptographic device.

10. A cryptographic service platform, characterized in that: include: A cryptographic middleware and a plurality of cryptographic devices connected to the cryptographic middleware, wherein the cryptographic middleware is used to execute the steps of the key synchronization method based on the SDF standard interface as described in any one of claims 1 to 9.

Images