Password card and password card communication system

Abstract

The invention discloses a password card and a password card communication system, which are applied to the field of information security, and the password card comprises a memory, a hard disk, an algorithm operation unit and a central processing unit supporting a universal operating system, the central processor is connected with the memory, the hard disk and the algorithm operation unit. The central processing unit is used for realizing a password service and a security control service; the algorithm operation unit is used for performing password operation according to the operation information; the algorithm operation unit is a single traditional password card or a plurality of traditional password cards; a traditional password card does not support a universal operating system. The password card provided by the invention is realized based on the central processing unit supporting a general operating system, so that the password card supports large-capacity storage and more convenient function expansion. By utilizing the central processing unit of the general operating system, the password card not only can realize password service, but also can increase safety control service, so that the password card is more stable and safer.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a password card and a password card communication system. Background Art

[0002] Currently, most cryptographic cards are implemented through DSP (digital signal processor) or FPGA (field programmable gate array), which can improve algorithm performance through hardware concurrency characteristics. However, such cryptographic card architecture or its physical interface cannot support large-capacity memory or storage media such as hard disks, and cannot install general-purpose operating systems (GPOS). Only real-time operating systems (RTOS) can be used. There are many deficiencies in resource abstraction, multi-tasking and software deployment. For example, only firmware upgrades can be performed, which is not conducive to functional expansion.

[0003] Therefore, how to provide a highly reliable password card is a problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a password card and a password card communication system, which solves the problems in the prior art that the password card function is inconvenient to expand and the password card is not reliable enough.

[0005] In order to solve the above technical problems, the present invention provides a password card, comprising:

[0006] Memory, hard disk, algorithm operation unit and central processing unit supporting general operating system;

[0007] The central processing unit is connected to the memory, the hard disk and the algorithm operation unit respectively;

[0008] The central processor is used to implement cryptographic services and security control services;

[0009] The algorithm operation unit is used to perform cryptographic operations according to the operation information. The algorithm operation unit is a single traditional cryptographic card or multiple traditional cryptographic cards. The traditional cryptographic card is a cryptographic card that does not support a general operating system.

[0010] Optionally, the hard disk includes a system hard disk and an extended hard disk; the system hard disk is used to install and run the general operating system, and the extended hard disk is used to store temporary files.

[0011] Optionally, the algorithm operation unit supports a first cryptographic algorithm and a second cryptographic algorithm; the first cryptographic algorithm is a general standard cryptographic algorithm, and the second cryptographic algorithm is a specific dedicated cryptographic algorithm.

[0012] Optionally, the central processing unit is also connected to a physical interface; the physical interface is a physical interface of a high-speed serial computer expansion bus standard.

[0013] Optionally, the security control service includes any one or more of an access control service, an exception handling service and a log service.

[0014] The present invention also provides a password card communication system, comprising:

[0015] Host and the above mentioned password card;

[0016] The host is used to transmit the computing information and identity information to the password card;

[0017] The password card is used to read the operation information and identity information, and send the operation information and identity information to the log service module; send the identity information to the access control service module for verification, and after the verification is passed, send the operation information to the algorithm driving module for calculation.

[0018] Optionally, sending the operation information to an algorithm driving module for operation includes:

[0019] The operation information is sent to the algorithm driving module, so that the algorithm driving module converts the format of the operation information into a standard format of the target algorithm and calls the target algorithm to perform the operation.

[0020] Optionally, sending the operation information and identity information to a log service module includes:

[0021] The operation information and identity information are sent to the log service module, so that the log service module tracks the behavior of the password card according to the tracking strategy, records it, and stores the recorded log information in the cache.

[0022] Optionally, sending the identity information to an access control service module for verification includes:

[0023] The identity information is sent to the access control service module, so that the access control module controls the access to the password card according to the access policy and the identity information; the identity information includes any one or more of the instructions and fingerprints.

[0024] Optionally, after sending the operation information to the algorithm driving module for operation, the method further includes:

[0025] If an abnormality occurs in the operation, the abnormal result is fed back to the abnormality processing service module, so that the abnormality processing service module performs analysis and processing according to the abnormal result.

[0026] It can be seen that the password card of the present invention includes a memory, a hard disk, an algorithm operation unit and a central processing unit supporting a general operating system; the central processing unit is connected to the memory, the hard disk and the algorithm operation unit respectively; the central processing unit is used to implement password services and security control services; the algorithm operation unit is used to perform password operations according to operation information, and the algorithm operation unit is a single traditional password card or multiple traditional password cards; the traditional password card is a password card that does not support a general operating system. The password card of the present invention is implemented based on a central processing unit supporting a general operating system, so that the password card supports large-capacity storage and more convenient function expansion. The use of the central processing unit of the general operating system enables the password card to not only implement password services, but also add security control services, making the password card more stable and secure.

[0027] In addition, the present invention also provides a password card communication system, which also has the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0029] Figure 1 A schematic diagram of the structure of a password card provided by an embodiment of the present invention;

[0030] Figure 2 A schematic diagram of the structure of another password card provided by an embodiment of the present invention;

[0031] Figure 3 A specific example diagram of a password card structure provided by an embodiment of the present invention;

[0032] Figure 4 A schematic diagram of the structure of a password card communication system provided by an embodiment of the present invention;

[0033] Figure 5 A schematic diagram of the software structure of a password card communication system provided by an embodiment of the present invention;

[0034] Figure 1 , Figure 2 and Figure 4 In the figure, the reference numerals are described as follows:

[0035] 1-Central Processing Unit; 2-Algorithm Operation Unit; 3-Memory; 4-Hard Disk; 5-Physical Interface, which is PCI-E Interface; 41-System Hard Disk; 42-Extended Hard Disk; 6-Host; 7-Password Card. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] Before describing the embodiments of this specification in detail, technical terms that may be involved in the embodiments of this specification are explained.

[0038] ARM: ARM (Advanced RISC Machine) is a central processing unit (CPU) based on the Reduced Instruction Set Computing (RISC) architecture. It is widely used in mobile devices, such as smartphones and tablets, and in embedded systems.

[0039] POWER PC: A family of microprocessors. This architecture is known for its high performance and scalability and was once widely used in high-end workstations.

[0040] X86: A complex instruction set computing (CISC) architecture originally used for its 8086 processor. This architecture later became the standard platform for personal computers (PCs) and continued to develop multiple versions, including the x86-64 architecture that supports 64-bit operations.

[0041] RISCV: An open source instruction set architecture that is characterized by flexibility, scalability and openness, allowing users to customize the instruction set according to specific needs.

[0042] Linux: An open source operating system whose source code can be viewed, modified, and redistributed by anyone. This openness makes Linux very popular in servers, cloud computing, and embedded systems because it allows users to customize the system to their needs.

[0043] Windows: Windows is a closed-source operating system. Windows is known for its intuitive and easy-to-use graphical user interface (GUI) and wide software compatibility.

[0044] SDRAM (Synchronous Dynamic Random Access Memory): A dynamic random access memory (DRAM) chip that is synchronized with the system clock and can be read and written at a higher speed.

[0045] Currently, most password cards are implemented through DSP or FPGA. The advantage of this implementation is that the algorithm performance can be improved through hardware concurrency characteristics. However, this implementation also has disadvantages. For example, the architecture or external physical interface of the above-mentioned password card cannot support large-capacity memory or storage media such as hard disks, and general operating systems cannot be installed. Only real-time operating systems can be used. This has many deficiencies in resource abstraction, multi-tasking and software deployment. For example, this results in the password card only being able to perform firmware upgrades, which is not conducive to the function expansion of the password card, which limits the password card's functions and leads to insufficient reliability of the password card.

[0046] The present invention implements a password card based on a central processor supporting a general-purpose operating system, so that the password card can support memory above DDR3 (third-generation double data rate synchronous dynamic random access memory), can support large-capacity storage, and support a general-purpose operating system. In this way, the advantages of a general-purpose operating system can be utilized to add a security mechanism of a security control service to the password card, making the password card more stable and secure. At the same time, the password card provided by the present invention is also more convenient to expand new services.

[0047] The specific structure of the password card of the present invention can be referred to Figure 1 , Figure 1 A schematic diagram of the structure of a password card provided by an embodiment of the present invention may specifically include:

[0048] A central processing unit 1, an algorithm operation unit 2, a memory 3 and a hard disk 4 supporting a general operating system;

[0049] The central processing unit 1 is connected to the memory 3, the hard disk 4 and the algorithm operation unit 2 respectively;

[0050] Central processor 1, used to implement cryptographic services and security control services, the security control services including any one or more of access control services, exception handling services and log services;

[0051] The algorithm operation unit 2 is used to perform cryptographic operations according to the operation information. The algorithm operation unit 2 is a single traditional password card or multiple traditional password cards. The traditional password card is a password card that does not support a general operating system.

[0052] It should be noted that the type of the central processing unit 1 is not limited in this embodiment, as long as it can support a general-purpose operating system. For example, the central processing unit 1 includes but is not limited to ARM, POWERPC, X86, RISCV and other architectures. The general-purpose operating system in this embodiment is not limited to Linux or Windows operating systems, which facilitates the deployment of services. This embodiment does not limit the memory 3. For example, the memory in this embodiment can be an SDRAM adapted to the central processing unit.

[0053] The central processing unit 1 in this embodiment is used to implement cryptographic services and security control services. It can be understood that the cryptographic service in this embodiment is a basic service of the cryptographic card, which can be implemented by calling the algorithm operation unit 2. The algorithm operation unit 2 is used to perform cryptographic operations based on the acquired operation information. The security control service in this embodiment is a security service of the cryptographic card. The security control service includes but is not limited to security control services such as access control services, exception handling services, and log services; it can also be any one or several of the access control services, exception handling services, and log services. The memory 3 in this embodiment is used to temporarily store the operation data in the central processing unit 1 and the data exchanged with the external storage device such as the hard disk 4. The hard disk 4 in this embodiment is an external device for permanent data storage.

[0054] This embodiment does not limit the number of algorithm operation units 2. In this embodiment, the algorithm operation unit 2 is a single traditional password card or multiple traditional password cards. It can be a single form or a cluster form. The central processor 1 of the password card performs calculations through the algorithm operation unit 2 and calls the traditional password card through the central processor 1. Among them, the traditional password card here is implemented with FPGA or DSP as the main control chip, and does not support the password card of the general operating system.

[0055] The password card provided by the embodiment of the present invention includes a memory 3, a hard disk 4, an algorithm operation unit 2 and a central processing unit 1 supporting a general operating system; the central processing unit 1 is connected to the memory 3, the hard disk 4 and the algorithm operation unit 2 respectively; the central processing unit 1 is used to implement password services and security control services, and the security control service includes any one or more of access control services, exception handling services and log services; the algorithm operation unit 2 is used to perform password operations according to operation information. The password card of the present invention is implemented based on a central processing unit supporting a general operating system, so that the password card supports large-capacity storage and more convenient function expansion. The use of the central processing unit of the general operating system allows the password card to not only implement password services, but also add security control services, making the password card more stable and secure.

[0056] Based on the above embodiment, the hard disk 4 in the password card may include a system hard disk 41 and an extended hard disk 42; the system hard disk 41 is used to install and run a general operating system, and the extended hard disk 42 is used to store temporary files, such as system logs.

[0057] For details, please refer to Figure 2 The hard disk of the password card in this embodiment includes a system hard disk 41 for running and installing a general operating system, and storing temporary files such as system logs generated by security control services. This password card supports large-capacity hard disk storage media.

[0058] Based on the above embodiment, the algorithm operation unit supports the first cryptographic algorithm and the second cryptographic algorithm; the first cryptographic algorithm is a universal standard cryptographic algorithm, and the second cryptographic algorithm is a specific dedicated cryptographic algorithm. For example, the first cryptographic algorithm can be an international cryptographic algorithm, which can specifically include RSA (asymmetric encryption algorithm), AES (a symmetric secret algorithm), 3DES (an enhanced version of the (Data Encryption Standard) encryption algorithm), SHA-256 ((Secure Hash Algorithm 256-bit) is a hash function), etc. The second cryptographic algorithm can be a national secret cryptographic algorithm, which can specifically include SM1 (a block cipher algorithm), SM2 (an asymmetric cryptographic algorithm based on the elliptic curve public key cryptography system), SM3 (a cryptographic hash algorithm, a hash function used to map input data of any length to an output hash value of a fixed length), SM4 (a symmetric cryptographic algorithm), etc. In this way, the password card of this embodiment has a wide range of applications.

[0059] Based on the above embodiment, the central processor 1 is also connected to the physical interface 5 .

[0060] For details, please refer to Figure 2 , where the interface type of the physical interface is PCI-E (Peripheral Component Interconnect Express, a high-speed serial computer expansion bus standard used to connect computer motherboards with various external devices) interface. CPU 1 is a CPU that supports the implementation of device nodes. The external device node is the end point of PCI-E (an endpoint device on the bus). The password card itself is a device, and the external device can be a host. Figure 3 A specific example diagram of a password card structure provided by an embodiment of the present invention. Figure 3 The PCI-E password card is implemented for XXE2000Q. The physical interface is PCI-E gold finger, and the central processor uses the central processor of XXE2000Q.

[0061] The present invention also provides a password card communication system, which refers to the communication process between the password card and the host. Based on the above-mentioned password card including memory, hard disk, algorithm operation unit and central processing unit supporting general operating system, communication with the host is realized. When the host is invaded by a virus, policy measures can be used to prevent the password card from being used illegally and the data from being stolen; at the same time, the behavior of the password card is monitored, and when an unexpected situation occurs, the problem can be quickly located by analyzing the log inside the password card; at the same time, when the password card fails, it can quickly recover by itself, and the host computer business is basically unaware of the password card failure. For details, please refer to Figure 4 , Figure 4A schematic diagram of the structure of a password card communication system provided by an embodiment of the present invention. It may include:

[0062] Host 6 and the above-mentioned password card 7;

[0063] Host 6, used to transmit computing information and identity information to the password card;

[0064] The password card 7 is used to read the operation information and identity information, and send the operation information and identity information to the log service module; send the identity information to the access control service module for verification, and after the verification is passed, send the operation information to the algorithm driving module for calculation.

[0065] Specifically, this embodiment implements the host's access control to the core components of the password card through the access control module; implements full tracking of the password card 7 call through the log service module; drives the operation of the password card through the algorithm driving module, and when an abnormality occurs during the operation, it can be further restored in time through reset and other means.

[0066] Furthermore, the above-mentioned sending of the operation information to the algorithm driving module for operation may specifically include the following steps:

[0067] The operation information is sent to the algorithm driving module, so that the algorithm driving module converts the format of the operation information into the standard format of the target algorithm and calls the target algorithm to perform the operation.

[0068] Specifically, when using the algorithm driving module to perform calculations, it is necessary to convert the format of the calculation information into the format required by the algorithm, and call the algorithm to perform the calculation. In this embodiment, the method for determining the target algorithm is not limited. For example, a strategy can be formulated in advance; or it can also be determined based on the calculation information.

[0069] Further, sending the operation information and identity information to the log service module may specifically include the following steps:

[0070] The operation information and identity information are sent to the log service module, so that the log service module tracks the behavior of the password card according to the tracking strategy, records it, and stores the recorded log information in the cache.

[0071] Specifically, the log service module can track the behavior of the password card according to the issued tracking strategy and record it as a log access. In this implementation, the algorithm API can only put the log information into the cache, and the log service program reads the log from the cache and prints it to reduce the impact of log printing on product performance.

[0072] Further, the identity information is sent to the access control service module for verification, which may specifically include the following steps:

[0073] The identity information is sent to the access control service module so that the access control module controls the access to the password card according to the policy and the identity information; the identity information includes any one or more of the instructions and the fingerprint.

[0074] Specifically, the access control service module can control the access to the password card according to the issued policy. The identity information may include verification passwords, fingerprints, etc. The specific implementation strategy may include: no control, host control, program ID control, program name control, etc. For access that does not meet the requirements, the response is rejected and an error is returned.

[0075] Furthermore, after sending the operation information to the algorithm driving module for operation, the following steps may also be included:

[0076] If an abnormality occurs during the operation, the abnormal result will be fed back to the abnormality handling service module so that the abnormality handling service module can analyze and handle it according to the abnormal result.

[0077] Specifically, after the algorithm driving module completes the operation, if an operation exception occurs, the abnormal result will be fed back to the exception handling service module, and the exception handling service module will analyze and handle the abnormal situation. The processing methods for a single algorithm include but are not limited to: not processing, initializing the algorithm, resetting the algorithm, powering off and restarting the algorithm, etc. In addition to the above methods, multi-algorithms also include shielding errors, algorithm switching, etc.

[0078] The password card communication system provided by the embodiment of the present invention is applied, through the host 6 and the above-mentioned password card 7; the host is used to transmit the operation information and identity information to the password card; the password card 7 is used to read the operation information and identity information, and send the operation information and identity information to the log service module; the identity information is sent to the access control service module for verification, and after the verification is passed, the operation information is sent to the algorithm driving module for calculation. This system can use the central processor supporting the general operating system in the password card 7 to achieve large-capacity storage and more convenient function expansion. The use of the central processor of the general operating system allows the password card to add access control, fault tracking, exception handling and other functions, making the password card more stable and secure. Using the above-mentioned highly secure and reliable password card, when the host is invaded by a virus, the password card can be prevented from being illegally used and data stolen through strategic means; at the same time, the behavior of the password card is monitored, and when an unexpected situation occurs, the problem can be quickly located by analyzing the log inside the password card; at the same time, when the password card fails, it can be quickly self-recovered, and the upper computer business is basically unaware of the password card failure.

[0079] Please refer to Figure 5 , Figure 5 A schematic diagram of the software structure of a password card communication system provided by an embodiment of the present invention. Figure 5It can be seen that the software part of the system includes host side software and password card side software.

[0080] The host-side software includes a host-side API and a host-side driver. Host-side API (Application Programming Interface): The interface calling program on the host side. The host service implements the password calling function by calling the host-side API. Unlike the traditional API, the API of this embodiment requires necessary identity information in addition to sending the necessary information for the password card operation, including but not limited to the system user name, process ID (process control symbol, which is a unique number used by the operating system to identify and manage each running program), and process name, so as to facilitate the access control service of the password card to control its access. Host-side driver: The host calls the device driver of the password card to transfer the data of the host-side API (operation information and identity information) to the password card. It is used to implement basic operations such as mapping the address space in the password card, applying for DMA (Direct Memory Access) address space, sending DMA requests, and some complex protocol operations based on basic operations.

[0081] The software on the password card side includes password services and security control related services. The password service includes the device side driver, algorithm API, and algorithm driver module. The device side driver: a driver that directly communicates with the host side driver, including but not limited to implementing the following functions, providing an address space for the host side to access, responding to DMA requests, and forwarding the data (calculation information and identity information) received from the host to the algorithm API. Algorithm API: the algorithm interface caller, which parses the data packet received from the device side driver and distinguishes the calculation information from the identity information. The identity information is sent to the access control service for authentication, and the identity information and calculation information are sent to the log service. After the access control service passes the authentication, the calculation information is sent to the algorithm driver module, otherwise it will not be calculated and an error will be returned. Algorithm driver module: realizes the conversion of the calculation information format into the format required by the algorithm, and calls the algorithm for calculation. Specifically, the load balancing method is adopted to determine the target algorithm in a round-robin manner. Security control related services include access control services, log services, and exception handling services. Access control service: control the access to the password card according to the issued policy. The issued policy requires verification passwords, fingerprints, and other methods to identify the identity. Strategies include no control, host control, program ID control, program name control, etc. For access that does not meet the requirements, the response is rejected and an error is returned. Log service: According to the issued policy, the behavior of the password card is tracked and recorded as a log access. The algorithm API only puts the log information into the cache, and the log service program reads the log from the cache and prints it to reduce the impact of log printing on product performance. Exception handling service, after the algorithm operation is completed, if an abnormal operation occurs, the abnormal result will be fed back to the exception handling service, and the exception handling service will analyze and handle it according to the abnormal situation. The processing methods for a single algorithm include but are not limited to: no processing, initialization algorithm, reset algorithm, algorithm power off and restart, etc. In addition to the above methods, multiple algorithms also include error shielding and algorithm switching.

[0082] Depend on Figure 5 It can be seen that the specific communication process may include:

[0083] (1) The host-side algorithm application calls the host-side API.

[0084] (2) The host-side API is responsible for packaging the calculation information and identity information and sending it to the host-side driver.

[0085] (3) The host-side driver fills the calculation information and identity information into the memory space requested by DMA and starts DMA transfer.

[0086] (4) The device-side driver reads the calculation information and identity information in the DMA and uploads it to the algorithm API.

[0087] (5) The algorithm API parses the calculation information and identity information, performs access control services based on the identity information, implements the calculation by calling the algorithm's API interface, and performs log services; if the calculation is abnormal, the exception handling service is started.

[0088] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0089] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0090] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0091] The above is a detailed introduction to a password card and a password card communication system provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A password card, characterized in that: include: Memory, hard disk, algorithm operation unit and central processing unit supporting general operating system; The central processing unit is connected to the memory, the hard disk and the algorithm operation unit respectively; The central processor is used to implement cryptographic services and security control services; The algorithm operation unit is used to perform cryptographic operations according to the operation information. The algorithm operation unit is a single traditional cryptographic card or multiple traditional cryptographic cards. The traditional cryptographic card is a cryptographic card that does not support a general operating system.

2. The password card according to claim 1, characterized in that: The hard disk includes a system hard disk and an extended hard disk; the system hard disk is used to install and run the universal operating system, and the extended hard disk is used to store temporary files.

3. The password card according to claim 1, characterized in that: The algorithm operation unit supports a first cryptographic algorithm and a second cryptographic algorithm; the first cryptographic algorithm is a universal standard cryptographic algorithm, and the second cryptographic algorithm is a specific dedicated cryptographic algorithm.

4. The password card according to claim 1, characterized in that: The central processing unit is also connected to a physical interface; the physical interface is a physical interface of a high-speed serial computer expansion bus standard.

5. The password card according to claim 1, characterized in that: The security control service includes any one or more of an access control service, an exception handling service and a log service.

6. A password card communication system, characterized in that: include: A host and a password card as claimed in any one of claims 1 to 5; The host is used to transmit the computing information and identity information to the password card; The password card is used to read the operation information and identity information, and send the operation information and identity information to the log service module; send the identity information to the access control service module for verification, and after the verification is passed, send the operation information to the algorithm driving module for calculation.

7. The password card communication system according to claim 6, characterized in that: Sending the operation information to the algorithm driving module for operation includes: The operation information is sent to the algorithm driving module, so that the algorithm driving module converts the format of the operation information into a standard format of the target algorithm and calls the target algorithm to perform the operation.

8. The password card communication system according to claim 6, characterized in that: Sending the operation information and identity information to the log service module includes: The operation information and identity information are sent to the log service module, so that the log service module tracks the behavior of the password card according to the tracking strategy, records it, and stores the recorded log information in the cache.

9. The password card communication system according to claim 6, characterized in that: Sending the identity information to the access control service module for verification includes: The identity information is sent to the access control service module, so that the access control module controls the access to the password card according to the access policy and the identity information; the identity information includes any one or more of the instructions and fingerprints.

10. The password card communication system according to claim 6, characterized in that: After sending the operation information to the algorithm driving module for operation, the method further includes: If an abnormality occurs in the operation, the abnormal result is fed back to the abnormality processing service module, so that the abnormality processing service module performs analysis and processing according to the abnormal result.

Images