A parameter library management method, device and equipment of a security device and a storage medium

Abstract

The application discloses a parameter library management method and device of a security equipment, equipment and a storage medium, and relates to the technical field of parameter management. The method comprises the following steps: randomly allocating an encryption key to a security service business data stream according to a preset key table, and establishing a key storage address relationship mapping table; distributing an initial chain variable to a preset chain variable storage position based on a first packet of the security service business data stream, and establishing a chain variable storage address relationship mapping table; encrypting the security service business data stream according to an encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table; and destroying the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to a destruction instruction. The application randomly allocates the encryption key, enhances the confidentiality of data, distributes the initial chain variable, fully utilizes the storage resource, and improves the read-write speed of data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of parameter management, and more particularly to a parameter library management method and device of a security device, equipment and a storage medium. BACKGROUND

[0002] The calling terminal protection security device commonly has a USB password device, a PCIE password device, etc. The common technical architecture of the calling terminal protection security device is to deploy a security service software on a user terminal computer. The terminal user calls the security service provided on the security device through the software. The security service commonly includes information source authenticity, information integrity, information confidentiality, etc. The implementation of these security service functions is based on the commercial secret SM2 / SM3 / SM4 cryptographic algorithm. The core parameters required by the cryptographic algorithm during work include a key, a chain variable (IV), a preset parameter (SBOX), etc.

[0003] Various operations on the key and the chain variable cannot be separated from the basic function of "searching, finding and matching" (i.e., finding the storage location of a certain parameter in the security device). Therefore, how to efficiently implement the "searching, finding and matching" function is the key to ensuring the implementation efficiency of various operations on the parameters. The existing calling security device stores the key and the chain variable IV in the RAM in the FPGA chip, or in the DDR chip hung outside the FPGA, or in the TCAM chip hung outside the FPGA.

[0004] However, if the key and the chain variable are stored in the RAM in the FPGA chip or the DDR outside the chip, a polling search method is generally used. This search method has a non-fixed processing delay, a large processing performance fluctuation and an uncontrollable processing process. If the key and the chain variable are stored in the TCAM chip, the "input content output storage address" function specific to the TCAM chip is directly used, and the search efficiency is high. However, the TCAM chip has a high cost, so the overall solution cost is too high. SUMMARY

[0005] In view of at least one defect or improvement demand of the prior art, the present application provides a parameter library management method and device of a security device, equipment and a storage medium, which are used to solve the problems of the prior art that the key and the chain variable are stored in the RAM in the FPGA chip or the DDR outside the chip, the processing delay is non-fixed, the processing performance fluctuates greatly, the processing process is uncontrollable, and the cost is high when stored in the TCAM chip.

[0006] To achieve the above-mentioned purpose, according to a first aspect of the present application, a parameter library management method of a security device is provided, comprising:

[0007] According to the preset key table, an encryption key is randomly allocated for the security service data stream, and a key storage address relationship mapping table is established;

[0008] According to the first packet message of the security service data stream, an initial chain variable is distributedly stored to a preset chain variable storage position, and a chain variable storage address relationship mapping table is established;

[0009] According to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table, the security service data stream is encrypted;

[0010] According to the destruction instruction, the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table is destroyed.

[0011] In a possible implementation, according to the preset key table, an encryption key is randomly allocated for the security service data stream, and a key storage address relationship mapping table is established, and the method further includes:

[0012] According to the key configuration instruction, an encryption key is randomly selected from the preset key table and allocated to the security service data stream;

[0013] It is judged whether there is a free key storage address in the preset key storage address;

[0014] If there is a free key storage address, the encryption key is stored in the free key storage address, and the corresponding key storage address is returned to establish the key storage address relationship mapping table.

[0015] In a possible implementation, it is judged whether there is a free key storage address in the preset key storage address, and the method further includes:

[0016] If there is no free key storage address in the preset key storage address, it is waited for a first preset time, and then it is judged whether there is a free key storage address in the preset key storage address;

[0017] If there is a free key storage address after waiting for the first preset time, the encryption key is stored in the free key storage address, and the corresponding key storage address is returned to establish the key storage address relationship mapping table;

[0018] If there is no free key storage address after waiting for the first preset time, a key configuration failure message is returned.

[0019] In a possible implementation, according to the first packet message of the security service data stream, an initial chain variable is distributedly stored to a preset chain variable storage position, and a chain variable storage address relationship mapping table is established, and the method further includes:

[0020] The data stream number and the initial chain variable are extracted from the first packet message of the security service data stream.

[0021] determining whether there is a free chain variable storage address in the preset chain variable storage address corresponding to the cryptographic algorithm associated with the data stream number;

[0022] If there is a free chain variable storage address, storing the initial chain variable to the free chain variable storage address, and returning the corresponding chain variable storage address to establish the chain variable storage address relationship mapping table.

[0023] In a possible implementation, determining whether there is a free key storage address in the preset chain variable storage address further includes:

[0024] If there is no free chain variable storage address in the preset chain variable storage address, waiting for a second preset time before determining whether there is a free chain variable storage address in the preset chain variable storage address;

[0025] If there is a free chain variable storage address after waiting for the second preset time, storing the initial chain variable to the free chain variable storage address, and returning the corresponding chain variable storage address to establish the chain variable storage address relationship mapping table;

[0026] If there is no free chain variable storage address after waiting for the second preset time, returning a chain variable configuration failure message.

[0027] In a possible implementation, configuring the encryption key and the chain variable for the cryptographic algorithm according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table includes:

[0028] determining the cryptographic algorithm corresponding to the security service data stream according to the data stream number;

[0029] obtaining the key and the chain variable from the key storage address relationship mapping table and the chain variable storage address relationship mapping table based on the data stream number;

[0030] configuring the key and the chain variable to the cryptographic algorithm.

[0031] In a possible implementation, destroying the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to the destruction instruction includes:

[0032] finding the key to be destroyed from the key storage address relationship mapping table according to the destruction instruction, and destroying the key to be destroyed and the corresponding mapping relationship;

[0033] finding the chain variable to be destroyed from the chain variable storage address relationship mapping table according to the destruction instruction, and destroying the chain variable to be destroyed and the corresponding mapping relationship.

[0034] According to a second aspect of the present application, there is also provided a parameter library management apparatus of a security device, comprising:

[0035] a key mapping module configured to randomly assign an encryption key to the security service traffic data stream according to a preset key table, and to establish a key storage address relationship mapping table;

[0036] a chain variable mapping module configured to distribute an initial chain variable to a preset chain variable storage location based on a first packet of the security service traffic data stream, and to establish a chain variable storage address relationship mapping table;

[0037] a parameter configuration module configured to encrypt the security service traffic data stream according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table;

[0038] a parameter destruction module configured to destroy the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to a destruction instruction.

[0039] According to a third aspect of the present application, there is also provided a parameter library management apparatus of a security device, comprising at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program which, when executed by the processing unit, causes the processing unit to perform the steps of any of the above-mentioned parameter library management methods of a security device.

[0040] According to a fourth aspect of the present application, there is also provided a storage medium storing a computer program executable by an access authentication device, which, when running on the access authentication device, causes the access authentication device to perform the steps of any of the above-mentioned parameter library management methods of a security device.

[0041] Overall, the above technical solutions conceived by the present application can achieve the following beneficial effects compared with the prior art:

[0042] The application provides a parameter library management method of a security device, which randomly allocates an encryption key for a security service data stream through a preset key table, effectively prevents reuse of the key, reduces the risk of cracking the key, establishes a key storage address relationship mapping table and a chain variable storage address relationship mapping table, facilitates quick positioning and access to the key or the chain variable when needed, and stores the initial chain variable in a distributed manner to a preset chain variable storage position, so that storage resources can be fully utilized, the read / write speed of data is improved, meanwhile, the distributed storage also enhances the fault tolerance of data, and even if some storage positions fail, the data will not be completely lost. When an encryption instruction is triggered, the key storage address relationship mapping table and the chain variable storage address relationship mapping table can be used to quickly locate the required key and chain variable, so that the security service data stream is quickly encrypted. When the key or the chain variable is no longer needed, the mapping table can be deleted in time, and the corresponding storage space is released, so that maintenance and expansion are facilitated. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0044] Figure 1 A flowchart of an embodiment of the parameter library management method of the security device provided by the present application is shown in the figure.

[0045] Figure 2 A flowchart of an embodiment of the parameter library management method of the security device provided by the present application is shown in the figure. Figure 1 A flowchart of an embodiment of step S101 in the method is shown in the figure.

[0046] Figure 3 A flowchart of an embodiment of step S202 in the method is shown in the figure. Figure 2 A flowchart of an embodiment of step S202 in the method is shown in the figure.

[0047] Figure 4 A flowchart of an embodiment of step S102 in the method is shown in the figure. Figure 1 A flowchart of an embodiment of step S102 in the method is shown in the figure.

[0048] Figure 5 A flowchart of an embodiment of step S402 in the method is shown in the figure. Figure 4 A flowchart of an embodiment of step S402 in the method is shown in the figure.

[0049] Figure 6 A flowchart of an embodiment of step S103 in the method is shown in the figure. Figure 1 A flowchart of an embodiment of step S103 in the method is shown in the figure.

[0050] Figure 7The structural schematic diagram of an embodiment of the parameter library management device of the security device provided by the present application is shown in the figure.

[0051] Figure 8 The structural schematic diagram of the parameter library management device of the security device provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. In addition, the technical features involved in each embodiment of the present application described below can be combined with each other as long as they do not conflict with each other.

[0053] The terms "first", "second", "third" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects and are not used to describe a specific order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed or can optionally include other steps or units inherent to the process, method, product or device.

[0054] The present application provides a parameter library management method, device and equipment of a security device and a storage medium, which are described below respectively.

[0055] Please refer to Figure 1 , Figure 1 The flowchart of an embodiment of the parameter library management method of the security device provided by the present application is shown in the figure. In one specific embodiment of the present application, a parameter library management method of a security device is disclosed, which comprises:

[0056] S101, randomly assigning an encryption key to a security service business data stream according to a preset key table, and establishing a key storage address relationship mapping table;

[0057] S102, distributing the initial chain variable to a preset chain variable storage location based on the first packet of the security service business data stream, and establishing a chain variable storage address relationship mapping table;

[0058] S103, encrypting the security service business data stream according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table;

[0059] S104, destroying the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to the destruction instruction.

[0060] In the above embodiments, it is first necessary to prepare a preset key table in advance, which stores a plurality of keys that can be used for encryption. A unique encryption key is randomly assigned to each incoming secure service data stream according to the preset key table, ensuring that each data stream is individually encrypted, greatly enhancing data security. Then, a key storage address relationship mapping table is established, which details the correspondence between each encryption key and its storage location. The key storage address relationship mapping table provides a convenient query path for subsequent key management and encryption operations.

[0061] For the first packet of the secure service data stream, the initial chain variable contained therein is distributedly stored in the preset chain variable storage location. There is a corresponding relationship between the cryptographic algorithm and the initial chain variable, and usually one cryptographic algorithm can correspond to multiple initial chain variables. The distributed storage strategy not only improves the fault tolerance and availability of data, but also reduces the risk of single point failure through decentralized storage. At the same time, a chain variable storage address relationship mapping table is constructed to record the correspondence between each chain variable and its storage location, which provides strong support for efficient retrieval and management of chain variables.

[0062] The parameters of the cryptographic algorithm include the key and the chain variable. When the encryption instruction is triggered, the secure service data stream is encrypted according to the key storage address relationship mapping table and the chain variable storage address relationship mapping table. The encryption process strictly follows the preset encryption algorithm and protocol to ensure the security of the data during transmission and storage. The encrypted data stream will be securely transmitted to the target location or stored in a secure storage medium for subsequent use or analysis. It can be understood that when decryption is required, the key, chain variable, and cryptographic algorithm are also required to perform the inverse operation on the encrypted data to achieve decryption.

[0063] When the data stream processing task is completed or according to specific destruction instructions, the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table will be destroyed in a timely manner, which is crucial for preventing the leakage of sensitive information. It ensures that it is difficult to track the storage location of the encryption key or chain variable through the mapping table. At the same time of destroying the mapping relationship, a series of security cleaning operations are also performed, including deleting temporary files, releasing memory resources, etc., to ensure cleanliness and security.

[0064] Compared with existing technologies, this embodiment provides a parameter library management method for security devices. By randomly assigning encryption keys to security service business data streams through a preset key table, this method effectively prevents key reuse and reduces the risk of key cracking. Establishing a key storage address mapping table and a chain variable storage address mapping table facilitates rapid location and access to keys or chain variables when needed. Initial chain variables are distributed and stored in preset chain variable storage locations, fully utilizing storage resources and improving data read / write speeds. Distributed storage also enhances data fault tolerance; even if some storage locations fail, complete data loss will not occur. When an encryption command is triggered, the required key and chain variable can be quickly located through the key storage address mapping table and the chain variable storage address mapping table, thereby achieving rapid encryption of the security service business data stream. When a key or chain variable is no longer needed, it can be promptly deleted from the mapping table, freeing up corresponding storage space for easy maintenance and expansion.

[0065] Please see Figure 2 , Figure 2 Provided by the present invention Figure 1 A flowchart illustrating one embodiment of step S101. In some embodiments of the present invention, in addition to randomly assigning encryption keys to the security service business data stream according to a preset key table and establishing a key storage address relationship mapping table, the method further includes:

[0066] S201. Randomly select an encryption key from the preset key table according to the key configuration instruction and assign it to the security service business data stream;

[0067] S202. Determine if there is a free key storage address among the preset key storage addresses;

[0068] S203. If there is a free key storage address, store the encryption key in the free key storage address and return the corresponding key storage address to establish a key storage address relationship mapping table.

[0069] In the above embodiments, when the security device is powered on, multiple key storage addresses are written. Each key storage address has storage space, which can be used to store the key to be used, and has address information. The key storage address can be found through the address information, and the corresponding key can be obtained.

[0070] When a new security service data stream needs to be encrypted, an encryption key is randomly selected from a preset key table and assigned to the data stream according to the received key configuration instruction. This ensures that a different key is used for each data transmission, increasing data security. When selecting a key, a random algorithm or a pseudo-random number generator can be used to ensure the randomness and unpredictability of the selection.

[0071] After the encryption key is allocated, it is necessary to check whether there is a free storage location in the preset key storage address, to ensure that there is enough space to store the newly allocated key, to avoid the problem of key conflict or storage overflow. The key storage address relationship mapping table can be queried to quickly determine which addresses are free.

[0072] If a free key storage address is found, the encryption key is stored in one of the free addresses. After storage is complete, the key storage address relationship mapping table needs to be updated to record the correspondence between the newly allocated key and its storage address, which is crucial for subsequent key management and decryption operations. At the same time, an entry containing the key identifier and storage address can be generated and added to the mapping table, so that the key can be quickly retrieved when needed.

[0073] It can be understood that, in order to further improve security, the encryption key of the allocated address can be updated or replaced or deleted periodically or according to specific conditions (such as the number of key uses, time period, etc.). When updating the key, it is necessary to ensure the secure allocation and storage of the new key, and to update the key storage address relationship mapping table to reflect the latest key status.

[0074] Please refer to Figure 3 , Figure 3 The flowchart of an embodiment of step S202 in the method provided by the present application Figure 2 In some embodiments of the present application, determining whether there is a free key storage address in the preset key storage address further comprises:

[0075] S301, if there is no free key storage address in the preset key storage address, wait for a first preset time and then determine whether there is a free key storage address in the preset key storage address;

[0076] S302, if there is a free key storage address after waiting for the first preset time, store the encryption key in the free key storage address, and return to establish the key storage address relationship mapping table corresponding to the key storage address;

[0077] S303, if there is no free key storage address after waiting for the first preset time, return a key configuration failure message.

[0078] In the above embodiments, when a request is made to allocate an encryption key for a security service business data stream, the system first checks whether there is a free storage location in the preset key storage address. If the initial judgment finds that there is no free key storage address in the preset key storage address, a failure message is generally not returned immediately. Instead, a preset time period, namely the first preset time, is waited for. This time period can be configured according to the actual operating conditions and business needs, aiming to provide a certain buffer time so that any ongoing key release or recycling operations can be completed, thereby releasing the free key storage address. As a preferred embodiment, the first preset time in this invention is set to 3 seconds, but it can also be set according to actual needs.

[0079] After waiting for the first preset time, the idle status of the preset key storage address is checked again. If an idle key storage address exists, the encryption key is stored in one of the idle addresses, and an entry containing the key identifier and storage address is generated and added to the key storage address mapping table, ensuring secure storage and fast retrieval of the encryption key.

[0080] If, after waiting for the first preset time, no free key storage address is found in the preset key storage address, it indicates that the current key storage resources are saturated and cannot allocate encryption keys for new security service business data streams. In this case, a key configuration failure message will be returned to the service or module that requested the key allocation. This message may contain additional information, such as the reason for the failure and suggested solutions, to help developers or operations personnel quickly locate the problem and take appropriate measures.

[0081] Please see Figure 4 , Figure 4 Provided by the present invention Figure 1 A flowchart illustrating an embodiment of step S102 is provided. In some embodiments of the present invention, based on the first packet of the security service business data stream, the initial chain variables are distributed and stored to a preset chain variable storage location, and a chain variable storage address mapping table is established, including:

[0082] S401. Extract the data flow number and initial chain variable from the first packet of the security service business data flow;

[0083] S402. Determine whether there is a free chain variable storage address in the preset chain variable storage address associated with the cryptographic algorithm corresponding to the data stream number;

[0084] S403. If there is a free chain variable storage address, the initial chain variable is stored in the free chain variable storage address, and the corresponding chain variable storage address is returned to establish a chain variable storage address relationship mapping table.

[0085] In the above embodiments, a pre-defined chain variable storage area needs to be maintained. This area is used to store the initial chain variables of each security service business data stream. These chain variables are typically associated with specific cryptographic algorithms and are used for verification and tracking during data stream processing. Simultaneously, a chain variable storage address mapping table also needs to be maintained to record the correspondence between each chain variable and its storage address.

[0086] When the first packet of the security service business data stream arrives, the data stream number and initial chain variable are extracted from the packet. The data stream number is an identifier used to uniquely identify each data stream, while the initial chain variable is the initial state information required when the data stream begins processing.

[0087] Next, it is necessary to determine whether there is any free storage space in the preset chain variable storage address associated with the cryptographic algorithm corresponding to the data stream number. This is to ensure that there is enough space to store the new chain variable and to avoid storage conflicts or overflow issues.

[0088] If a free chain variable storage address is found, the initial chain variable is stored in one of the free addresses. After storage, the chain variable storage address mapping table needs to be updated to record the correspondence between the newly stored chain variable and its storage address. This is crucial for subsequent chain variable retrieval and management. Simultaneously, an entry containing the data stream number, chain variable identifier, and storage address can be generated and added to the mapping table to enable quick retrieval of the chain variable when needed.

[0089] Please see Figure 5 , Figure 5 Provided by the present invention Figure 4 A flowchart illustrating an embodiment of step S402. In some embodiments of the present invention, determining whether there is a free key storage address in the preset chain variable storage address further includes:

[0090] S501. If there is no free chain variable storage address in the preset chain variable storage address, wait for the second preset time and then determine whether there is a free chain variable storage address in the preset chain variable storage address.

[0091] S502. If there is an idle chain variable storage address after waiting for the second preset time, the initial chain variable is stored in the idle chain variable storage address, and the corresponding chain variable storage address is returned to establish a chain variable storage address relationship mapping table.

[0092] S503. If no free chain variable storage address is found after waiting for the second preset time, a chain variable configuration failure message is returned.

[0093] In the above embodiments, upon receiving the security service data stream, the idle status of the preset chain variable storage address is first checked. If no idle chain variable storage address is found, failure is not immediately returned; instead, a more flexible processing mechanism is adopted. Specifically, a preset time period, namely the second preset time, is required to allow any ongoing chain variable release or recycling operations to complete, thereby releasing idle chain variable storage addresses. After waiting for the second preset time, the idle status of the preset chain variable storage address is checked again to confirm whether any idle chain variable storage addresses have been released during the waiting period. As a preferred embodiment, the second preset time in this invention is also set to 3 seconds, but it can also be set according to actual needs.

[0094] If a free chain variable storage address exists, the initial chain variable extracted from the first packet of the security service business data stream will be stored in one of these free addresses. After storage, an entry containing the chain variable identifier and storage address will be generated and added to the chain variable storage address mapping table, ensuring secure storage and fast retrieval of the chain variable. Simultaneously, the corresponding chain variable storage address will be returned to the requester so that the chain variable can be correctly referenced during subsequent data processing or verification.

[0095] If, after waiting for the second preset time, no free storage address is found in the preset chain variable storage address list, it indicates that the current chain variable storage resources are saturated and cannot allocate chain variables for new security service business data streams. In this case, a chain variable configuration failure message will be returned to the service or module that requested the chain variable allocation. This message may contain additional information, such as the reason for the failure and suggested solutions, to help developers or operations personnel quickly locate the problem and take appropriate measures.

[0096] Please see Figure 6 , Figure 6 Provided by the present invention Figure 1 A flowchart illustrating an embodiment of step S103. In some embodiments of the present invention, configuring encryption keys and chain variables for a cryptographic algorithm based on encryption instructions, a key storage address relationship mapping table, and a chain variable storage address relationship mapping table includes:

[0097] S601. Determine the cryptographic algorithm corresponding to the security service business data stream based on the data stream number;

[0098] S602. Obtain the key and chain variable from the key storage address relationship mapping table and the chain variable storage address relationship mapping table based on the data stream number;

[0099] S603. Assign the key and chain variables to the cryptographic algorithm.

[0100] Referring to Table 1, which is a configuration table of data stream numbers, cryptographic algorithms, and their corresponding relationships, in the above embodiment, a database or configuration table containing data stream numbers, cryptographic algorithms, and their corresponding relationships is maintained, which is used to quickly determine which cryptographic algorithm should be used for processing when a data stream is received. At the same time, a key storage address relationship mapping table and a chain variable storage address relationship mapping table are also maintained, which respectively record the storage address information of encryption keys and chain variables.

[0101] Table 1

[0102]

[0103] When receiving an encryption instruction, the data stream number is first extracted from the instruction, and then the corresponding cryptographic algorithm is found in the cryptographic algorithm configuration table according to the data stream number, which ensures that the most suitable cryptographic algorithm can be selected for each data stream for processing.

[0104] After determining the cryptographic algorithm, the encryption key and chain variable required are obtained from the key storage address relationship mapping table and the chain variable storage address relationship mapping table. Specifically, the key storage address and chain variable storage address associated with the data stream number are found in the two mapping tables based on the data stream number. Then, the actual values of the encryption key and chain variable are read from the found storage addresses.

[0105] After obtaining the encryption key and chain variable, they are configured to the previously determined cryptographic algorithm. This step usually involves passing the key and chain variable as parameters to the implementation function or module of the cryptographic algorithm for use in subsequent data processing. After the configuration is complete, the configured cryptographic algorithm can be used to encrypt the secure service business data stream.

[0106] In some embodiments of the present application, the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table is destroyed according to the destruction instruction, comprising:

[0107] According to the destruction instruction, the to-be-destroyed key is found in the key storage address relationship mapping table, and the to-be-destroyed key and the corresponding mapping relationship are destroyed;

[0108] According to the destruction instruction, the to-be-destroyed chain variable is found in the chain variable storage address relationship mapping table, and the to-be-destroyed chain variable and the corresponding mapping relationship are destroyed.

[0109] In the above embodiment, after receiving the destruction instruction, the instruction usually contains the data stream number or related identifier to be destroyed, indicating which keys and chain variables need to be destroyed. It is necessary to maintain a key storage address relationship mapping table and a chain variable storage address relationship mapping table, which respectively record the storage addresses of the keys and chain variables and their corresponding relationship.

[0110] According to the information provided in the destruction instruction, the key to be destroyed is found in the key storage address relationship mapping table. Once a matching key is found, it is deleted from the table, and the mapping relationship associated with the key is also destroyed, which means that the corresponding relationship between the key and its storage address is no longer maintained.

[0111] Similarly, the chain variable to be destroyed will be found in the chain variable storage address relationship mapping table according to the destruction instruction. Once a matching chain variable is found, it is deleted from the table, and the mapping relationship associated with the chain variable is also destroyed, ensuring that the corresponding relationship between the chain variable and its storage address is no longer maintained, thereby preventing subsequent illegal access to the chain variable.

[0112] In a specific embodiment of the present application, taking the case where a security device needs to support 1000 keys, after the security device is powered on, 1000 numbers from 0 to 999 are written into the key storage unit in sequence as free available key storage addresses. When receiving a key configuration instruction from the user terminal security service software, first determine whether there are free available key storage addresses in the key storage unit. If so, read an address from the key storage unit and return it to the user terminal. The user terminal then adds a new table entry in the "key number-key address relationship mapping table", and the security device writes the key content into the corresponding position in the key library RAM according to the address. If not, return a key configuration failure message to the user terminal. The algorithm scheduling module has two operations on the key library: getting a key and destroying a key. The key acquisition action is based on the key address, and the key destruction action writes the key address back to the key storage unit to complete the release and recovery.

[0113] In another specific embodiment of the present application, on the premise that the security device needs to support 1000 keys and place 10 password algorithms, each password algorithm needs to support 100 chain variable processes of data stream, and the security device is powered on, the "chain variable address power-on initialization" module corresponding to each of the 5 algorithms will first write the 100 numbers from 0 to 99 into the chain variable storage address in sequence as the idle available chain variable storage address. When the algorithm scheduling module of a certain algorithm receives the security service data stream message fragment from the user terminal, it first judges the "first packet / intermediate packet / tail packet" attribute. If it is the first packet, it judges whether there is idle available chain variable storage address space, if yes, adds a new table entry in the "data stream number-key address relationship mapping table", and writes the chain variable content into the corresponding position in the chain variable library RAM. If not, it returns the message of no idle chain variable space to the user terminal. The algorithm scheduling module has two operations on the chain variable library, that is, obtaining the chain variable and destroying the chain variable. The key acquisition action is searched according to the key address, and the key destruction action is written back to the "key address recycling storage FIFO" to complete the release and recycling.

[0114] In order to better implement the parameter library management method of the security device in the embodiment of the present application, on the basis of the parameter library management method of the security device, please refer to Figure 7 , Figure 7 The structure diagram of an embodiment of the parameter library management device of the security device provided by the present application, the embodiment of the present application provides a parameter library management device 700 of a security device, which comprises:

[0115] The key mapping module 710 is configured to randomly allocate an encryption key for the security service data stream according to a preset key table, and establish a key storage address relationship mapping table;

[0116] The chain variable mapping module 720 is configured to distribute the initial chain variable to the preset chain variable storage position based on the first packet message of the security service data stream, and establish a chain variable storage address relationship mapping table;

[0117] The parameter configuration module 730 is configured to encrypt the security service data stream according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table;

[0118] The parameter destruction module 740 is configured to destroy the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to the destruction instruction.

[0119] It should be noted that the apparatus 700 provided in the above embodiments can implement the technical solutions described in the above method embodiments, and the principles of the implementation of the above modules or units can be referred to the corresponding content in the above method embodiments, which will not be described here.

[0120] Please refer to Figure 8 , Figure 8 The structure diagram of the parameter library management device of the security device provided in the embodiments of the present application. Based on the above security device parameter library management method, the present application also correspondingly provides a security device parameter library management device. The security device parameter library management device can be a mobile terminal, a desktop computer, a notebook computer, a palm computer, a server, and other computing devices. The security device parameter library management device 800 includes a processor 810, a memory 820, and a display 830. Figure 8 Only part of the components of the battery height real-time measurement synchronous tracking flight welding device is shown, but it should be understood that all the components shown are not required to be implemented, and more or less components can be alternatively implemented.

[0121] The memory 820 can be an internal storage unit of the security device parameter library management device 800 in some embodiments, such as a hard disk or a memory of the security device parameter library management device 800. The memory 820 can also be an external storage device of the security device parameter library management device 800 in other embodiments, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the security device parameter library management device 800. Further, the memory 820 can include both the internal storage unit and the external storage device of the security device parameter library management device 800. The memory 820 is used to store application software and various data installed on the security device parameter library management device 800, such as program codes installed on the security device parameter library management device 800, etc. The memory 820 can also be used to temporarily store data that has been output or will be output. In an embodiment, the memory 820 stores a security device parameter library management program 840, which can be executed by the processor 810, thereby implementing the security device parameter library management method of the embodiments of the present application.

[0122] The processor 810 can be a central processing unit (CPU), a microprocessor, or other data processing chip in some embodiments, used to run program codes or process data stored in the memory 820, such as to execute the security device parameter library management method, etc.

[0123] The display 830 can be, in some embodiments, an LED display, a liquid crystal display, a touch liquid crystal display, an OLED (Organic Light-Emitting Diode) touch, etc. The display 830 is used to display information of the parameter library management device 800 of the security device and to display a visualized user interface. The components 810-830 of the parameter library management device 800 of the security device communicate with each other through a system bus.

[0124] In an embodiment, the steps in the above-mentioned security device parameter library management method are implemented when the processor 810 executes the security device parameter library management program 840 in the memory 820.

[0125] The present embodiment also provides a computer-readable storage medium having a security device parameter library management program stored thereon, which, when executed by a processor, implements the following steps:

[0126] Randomly assigning encryption keys to the security service data stream according to a preset key table, and establishing a key storage address relationship mapping table;

[0127] Distributing initial chain variables to preset chain variable storage locations based on the first packet of the security service data stream, and establishing a chain variable storage address relationship mapping table;

[0128] Encrypting the security service data stream according to the encryption instruction, the key storage address relationship mapping table, and the chain variable storage address relationship mapping table;

[0129] Destroying the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to the destruction instruction.

[0130] In summary, the security device parameter library management method provided by the present application randomly assigns encryption keys to the security service data stream according to a preset key table, which effectively prevents the reuse of keys, reduces the risk of key cracking, and establishes a key storage address relationship mapping table and a chain variable storage address relationship mapping table, facilitating quick positioning and access to keys or chain variables when needed. The initial chain variables are distributed to preset chain variable storage locations, which can fully utilize storage resources and improve data read / write speed. At the same time, distributed storage also enhances the fault tolerance of data, so that even if some storage locations fail, it will not result in complete data loss. When the encryption instruction is triggered, the key storage address relationship mapping table and the chain variable storage address relationship mapping table can be used to quickly locate the required keys and chain variables, thereby realizing the quick encryption of the security service data stream. When a key or chain variable is no longer needed, it can be deleted from the mapping table in a timely manner to release the corresponding storage space, facilitating maintenance and expansion.

[0131] The application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the method. The computer readable storage medium can include, but is not limited to, any type of disk, including a floppy disk, an optical disk, a DVD, a CD-ROM, a micro drive, and a magneto-optical disk, a ROM, a RAM, an EPROM, an EEPROM, a DRAM, a VRAM, a flash memory device, a magnetic card or an optical card, a nano system (including a molecular memory IC), or any type of medium or device suitable for storing instructions and / or data.

[0132] It should be noted that, for the foregoing method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the application is not limited to the action sequence described, because according to the application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions and modules involved are not necessarily necessary for the application.

[0133] In the above embodiments, the description of each embodiment is focused on, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0134] In several embodiments provided by the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic. The division of the units is only a logical function division. There can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some services interfaces, devices or units, and can be electrical or other forms.

[0135] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0136] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware, or in the form of a software functional unit.

[0137] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable memory. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a memory and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present application. The aforementioned memory includes: a U disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0138] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by a program instructing relevant hardware, and the program can be stored in a computer readable memory, which can include a flash disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, etc.

[0139] The above is only exemplary embodiments of the present disclosure, and cannot limit the scope of the present disclosure. That is, any equivalent changes and modifications made in accordance with the teachings of the present disclosure are still within the scope of the present disclosure. Those skilled in the art will easily think of embodiments of the present disclosure after considering the specification and practicing the disclosure herein. The present application is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or conventional techniques in the art that are not described in the present disclosure. The specification and examples are only considered as exemplary, and the scope and spirit of the present disclosure are defined by the claims.

[0140] The technical features of the above embodiments can be combined in any way. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not contradict, they should be considered within the scope of the present disclosure.

[0141] Those skilled in the art readily understand that the above only describes preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement and improvement made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A parameter library management method of a security device, characterized by, The method comprises the following steps: randomly assigning an encryption key to a secure service data stream according to a preset key table, and establishing a key storage address relationship mapping table; distributively storing an initial chain variable to a preset chain variable storage location based on a first packet message of the secure service data stream, and establishing a chain variable storage address relationship mapping table; encrypting the secure service data stream according to an encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table; destroying the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to a destruction instruction; wherein the step of distributively storing the initial chain variable to the preset chain variable storage location based on the first packet message of the secure service data stream, and establishing the chain variable storage address relationship mapping table, comprises the following steps: extracting a data stream number and an initial chain variable from the first packet message of the secure service data stream; judging whether there is a free chain variable storage address in the preset chain variable storage address associated with the password algorithm corresponding to the data stream number; if there is a free chain variable storage address, storing the initial chain variable to the free chain variable storage address, and returning the corresponding chain variable storage address to establish the chain variable storage address relationship mapping table; wherein the step of configuring the encryption key and the chain variable for the password algorithm according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table, comprises the following steps: determining the password algorithm corresponding to the secure service data stream according to the data stream number; obtaining the key and the chain variable from the key storage address relationship mapping table and the chain variable storage address relationship mapping table based on the data stream number; configuring the key and the chain variable to the password algorithm.

2. The parameter library management method of a security device according to Claim 1, wherein The step of randomly assigning the encryption key to the secure service data stream according to the preset key table, and establishing the key storage address relationship mapping table, further comprises the following steps: randomly selecting an encryption key from the preset key table according to a key configuration instruction and assigning the encryption key to the secure service data stream; judging whether there is a free key storage address in the preset key storage address; if there is a free key storage address, storing the encryption key to the free key storage address, and returning the corresponding key storage address to establish the key storage address relationship mapping table.

3. The parameter library management method of a security device according to Claim 2, wherein The step of judging whether there is a free key storage address in the preset key storage address, further comprises the following steps: if there is no free key storage address in the preset key storage address, waiting for a first preset time and then judging whether there is a free key storage address in the preset key storage address; if there is a free key storage address after waiting for the first preset time, storing the encryption key to the free key storage address, and returning the corresponding key storage address to establish the key storage address relationship mapping table; if there is no free key storage address after waiting for the first preset time, returning a key configuration failure message.

4. The parameter library management method of a security device according to Claim 1, wherein The step of judging whether there is a free key storage address in the preset chain variable storage address, further comprises the following steps: If there is no free chain variable storage address in the preset chain variable storage address, waiting for a second preset time and then judging whether there is a free chain variable storage address in the preset chain variable storage address; If there is a free chain variable storage address after waiting for the second preset time, storing the initial chain variable to the free chain variable storage address, and returning the corresponding chain variable storage address to establish the chain variable storage address relationship mapping table; If there is no free chain variable storage address after waiting for the second preset time, returning a chain variable configuration failure message.

5. The parameter library management method of a security device according to Claim 1, wherein, The corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table is destroyed according to the destruction instruction, including: According to the destruction instruction, the to-be-destroyed key is searched from the key storage address relationship mapping table, and the to-be-destroyed key and the corresponding mapping relationship are destroyed; According to the destruction instruction, the to-be-destroyed chain variable is searched from the chain variable storage address relationship mapping table, and the to-be-destroyed chain variable and the corresponding mapping relationship are destroyed.

6. A parameter library management apparatus of a security device, characterized by comprising: Including: A key mapping module configured to randomly assign an encryption key to a secure service data stream according to a preset key table, and establish a key storage address relationship mapping table; A chain variable mapping module configured to distribute an initial chain variable to a preset chain variable storage location based on a first packet message of the secure service data stream, and establish a chain variable storage address relationship mapping table; A parameter configuration module configured to encrypt a secure service data stream according to an encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table; A parameter destruction module configured to destroy the corresponding mapping relationship in the key storage address relationship mapping table and the chain variable storage address relationship mapping table according to a destruction instruction; Wherein, the initial chain variable is distributed to the preset chain variable storage location based on the first packet message of the secure service data stream, and the chain variable storage address relationship mapping table is established, including: Extracting a data stream number and an initial chain variable from the first packet message of the secure service data stream; Judging whether there is a free chain variable storage address in the preset chain variable storage address corresponding to the password algorithm associated with the data stream number; If there is a free chain variable storage address, store the initial chain variable to the free chain variable storage address, and return the corresponding chain variable storage address to establish the chain variable storage address relationship mapping table; Wherein, the encryption key and the chain variable are configured for the password algorithm according to the encryption instruction, the key storage address relationship mapping table and the chain variable storage address relationship mapping table, including: According to the data stream number, determining the password algorithm corresponding to the secure service data stream; Based on the data stream number, obtaining the key and the chain variable from the key storage address relationship mapping table and the chain variable storage address relationship mapping table; The key and the chain variable are configured to the password algorithm.

7. A parameter library management device of a security device, characterized by comprising: The security device comprises at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the computer program is executed by the processing unit, the processing unit executes the steps of the parameter library management method of the security device according to any one of claims 1-5.

8. A storage medium, characterized by The computer program stored in the storage unit can be executed by the access authentication device, and when the computer program runs on the access authentication device, the access authentication device executes the steps of the parameter library management method of the security device according to any one of claims 1-5.

Images