Password resource scheduling method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a password resource scheduling method and device, electronic equipment and a storage medium, and the method comprises the steps: determining a target password machine, and obtaining the equipment information of the target password machine; accessing the target cipher machine to the proxy service based on the equipment information; constructing a secure channel with the proxy service, and determining a password resource management instruction; and scheduling the password resource based on the password resource management instruction through the secure channel. The isolation of the upper layer password capability and the lower layer password resources is realized, and the simultaneous application of the password resources of multiple manufacturers and multiple models can be realized, so that the resource password scheduling efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic resource scheduling, and in particular to a cryptographic resource scheduling method, a cryptographic resource scheduling device, an electronic device and a computer-readable storage medium. Background Art

[0002] Key security is the key to ensure communication and data security. The current key application and encryption and decryption operations involved in data transmission and data storage all need to rely on the call of cryptographic resources. Especially in cloud computing scenarios, whether it is a public cloud or a hybrid cloud scenario, there are various requirements for the use of cryptographic machines, which need to meet security requirements including system data confidentiality, data integrity, and communication security. These requirements can be achieved through various encryption algorithms, signature algorithms, hash algorithms, random number generation and other functions in the cryptographic machine. However, the current cloud platform's use of cryptographic machines has defects such as a wide variety of application docking requirements, high docking costs, the inability to fix the model of the cryptographic machine, and the inability of the dynamic expansion of the cryptographic machine resource pool to be compatible with manufacturers. Summary of the invention

[0003] The embodiments of the present invention provide a cryptographic resource scheduling method, device, electronic device and computer-readable storage medium to overcome the above problems or at least partially solve the above problems.

[0004] The embodiment of the present invention discloses a cryptographic resource scheduling method, characterized in that the method is applied to a cryptographic resource management system, and the cryptographic resource management system is configured with a proxy service for a cryptographic machine, including:

[0005] Determine a target cryptographic machine and obtain device information of the target cryptographic machine;

[0006] Connecting the target cryptographic machine to the proxy service based on the device information;

[0007] Establishing a secure channel with the proxy service and determining cryptographic resource management instructions;

[0008] The cryptographic resources are scheduled based on the cryptographic resource management instructions through the secure channel.

[0009] Optionally, it also includes:

[0010] An IP polling operation is performed, and when the cipher machine IP is obtained, the cipher machine IP is sent to the target cipher machine through the secure channel; the target cipher machine is configured to register with the cipher resource management system through the cipher machine IP.

[0011] Optionally, the step of connecting the target cryptographic machine to the proxy service based on the device information includes:

[0012] Determine the cryptographic machine management interface of the target cryptographic machine based on the device information;

[0013] Calling the cryptographic machine management interface to obtain the current status information and specific machine parameters of the target cryptographic machine;

[0014] Generate a registration instruction for the target cryptographic machine based on the current state information and the specific machine parameters;

[0015] The target cryptographic machine is connected to the proxy service based on the registration instruction.

[0016] Optionally, the password resource management system is configured with a registration interface and further includes:

[0017] Receiving an agent registration instruction sent by the agent service;

[0018] Based on the proxy registration instruction, a registration interface is called to obtain the proxy resources reported by the proxy service; the proxy resources include proxy IP information, port information and proxy certificate public key information.

[0019] Optionally, the step of establishing a secure channel with the proxy service includes:

[0020] Generate a certificate public key based on the proxy IP information, the port information and the proxy certificate public key information, and generate a random number;

[0021] Encrypting the certificate public key based on the random number to generate an encrypted certificate public key;

[0022] Sending the encryption certificate public key to the proxy service; the proxy service decrypts the encryption certificate public key to generate an encryption channel key;

[0023] A secure channel is established with the proxy service based on the encryption channel key.

[0024] Optionally, the step of performing an IP polling operation includes:

[0025] Determine an IP address segment, and set a polling queue for the IP address segment;

[0026] Performing a reachability test on the IP addresses in the polling queue;

[0027] When the IP address passes the reachability test, the IP address is marked as an available IP address and stored in a cryptographic machine device pool; the cryptographic machine device pool is used to obtain the cryptographic machine IP.

[0028] Optionally, after the step of sending the cipher machine IP to the target cipher machine through the secure channel, the step further includes:

[0029] Mark the cipher machine IP as a used IP address and remove the cipher machine IP from the polling queue;

[0030] Determine the number of IPs and the polling period of the polling queue, and adjust the length of the polling queue according to the number of IPs and the polling period.

[0031] The embodiment of the present invention further discloses a cryptographic resource scheduling device, which is applied to a cryptographic resource management system, wherein the cryptographic resource management system is configured with a proxy service for a cryptographic machine, including:

[0032] A target cryptographic machine determination module is used to determine a target cryptographic machine and obtain device information of the target cryptographic machine;

[0033] An agent service access module, used to connect the target cryptographic machine to the agent service based on the device information;

[0034] A secure channel construction module, used to construct a secure channel with the proxy service and determine cryptographic resource management instructions;

[0035] A scheduling module is used to schedule the cryptographic resources based on the cryptographic resource management instructions through the secure channel.

[0036] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0037] The memory is used to store computer programs;

[0038] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0039] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0040] The embodiments of the present invention include the following advantages:

[0041] The embodiment of the present invention determines the target cryptographic machine and obtains the device information of the target cryptographic machine; connects the target cryptographic machine to the proxy service based on the device information; builds a secure channel with the proxy service and determines the cryptographic resource management instruction; and schedules the cryptographic resources based on the cryptographic resource management instruction through the secure channel. The isolation of the upper-layer cryptographic capabilities and the lower-layer cryptographic resources is achieved, and the cryptographic resources of multiple manufacturers and models can be applied simultaneously, which can not only improve the utilization rate of cryptographic resources, but also prevent the situation of being bound by a single manufacturer. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a flowchart of a cryptographic resource scheduling method provided in an embodiment of the present invention;

[0043] Figure 2 is a schematic diagram of the structure of the instruction structure between the password resource management system and the proxy service provided in an embodiment of the present invention;

[0044] Figure 3 is a system architecture diagram between a password resource management system and an agent provided in an embodiment of the present invention;

[0045] Figure 4 is a functional module relationship diagram between a code resource management system and an agent provided in an embodiment of the present invention;

[0046] Figure 5 It is a main flow chart of the cryptographic resource expansion provided in an embodiment of the present invention;

[0047] Figure 6 It is a structural block diagram of a cryptographic resource scheduling device provided in an embodiment of the present invention;

[0048] Figure 7 is a hardware structure block diagram of an electronic device provided in an embodiment of the present invention;

[0049] Figure 8 is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0051] Key security is the key to ensure communication and data security. The current key application and encryption and decryption operations involved in data transmission and data storage all need to rely on the call of cryptographic resources. Especially in cloud computing scenarios, whether it is a public cloud or a hybrid cloud scenario, there are various requirements for the use of cryptographic machines, which need to meet security requirements including system data confidentiality, data integrity, and communication security. These requirements can be achieved through various encryption algorithms, signature algorithms, hash algorithms, random number generation and other functions in the cryptographic machine.

[0052] However, the current use of cryptographic machines on cloud platforms mainly has the following problems:

[0053] 1) There are many types of application docking requirements

[0054] The various applications on the cloud platform have a wide variety of requirements for confidentiality and integrity, and the application requirements for keys are also different. For example, some projects require customized requirements such as batch encryption and decryption, envelope encryption, and certificate verification. If the product is directly connected to a cryptographic machine or other cryptographic equipment, it will take a lot of manpower and material resources to match the interface. In public cloud and hybrid cloud scenarios, due to bidding and various business needs, it is difficult to fix a certain manufacturer to provide services, and the docking solutions and interface forms of each manufacturer are also different, resulting in a lot of repeated new work in the docking.

[0055] 2) High connection cost

[0056] At present, the commercial secrets transformation work for cloud platforms involves complex scenarios, and the docking methods of cryptographic vendors are also different. In particular, the docking of cryptographic machines involves complex transformation and docking requirements for business functions, and there is currently no unified docking solution among manufacturers. In addition, the programming languages ​​and system architectures used by each system are also different. Each system is connected to the cryptographic machines of different manufacturers to achieve commercial secrets transformation, which will incur a lot of manpower and time costs, and it is impossible to form a unified and shared docking solution, which will have a great impact on project delivery and project advancement.

[0057] 3) The model of the cipher machine cannot be fixed

[0058] Whether it is a public cloud scenario or a hybrid cloud scenario, it involves the private deployment of the project and the personalized customization of functions. According to the actual project requirements, the type of cryptographic machine may be a financial cryptographic machine, a cloud cryptographic machine, or a server cryptographic machine. For the types and models of cryptographic machines currently available on the market, each has different docking and usage methods, and each requires personalized functional docking, resulting in increasingly complex functions that are difficult to manage.

[0059] 4) Dynamic expansion of the cryptographic machine resource pool is not compatible with manufacturers

[0060] Because manufacturers have different docking solutions and usage methods, it is impossible to achieve a common expansion method for cryptographic machines from multiple manufacturers when expanding the cryptographic resource pool. However, in actual application scenarios, in order to prevent being bound by a single manufacturer, it is usually necessary to expand the capacity of machines from different manufacturers in the resource pool to achieve the coexistence of cryptographic resources. The current common method is to deploy the management system of the corresponding cryptographic machine manufacturer to achieve unified management and resource allocation of a single model of cryptographic machine. However, this will lead to a variety of systems that are difficult to manage in a unified manner, which increases the difficulty of unified operation and management of cryptographic machine resources.

[0061] Reference Figure 1 , shows a flowchart of a cryptographic resource scheduling method provided in an embodiment of the present invention, which may specifically include the following steps:

[0062] Step 101, determine the target cryptographic machine and obtain the device information of the target cryptographic machine;

[0063] Step 102, connecting the target cryptographic machine to the proxy service based on the device information;

[0064] Step 103, building a secure channel with the proxy service and determining a cryptographic resource management instruction;

[0065] Step 104: Schedule the cryptographic resources based on the cryptographic resource management instruction through the secure channel.

[0066] In a specific implementation, an embodiment of the present invention can be applied to a cryptographic resource management system, which is configured with a proxy service for cryptographic machines. The cryptographic resource management system can be deployed in a network specifically used to schedule cryptographic resources. An embodiment of the present invention can determine a cryptographic machine connected to the network as a target cryptographic machine, thereby determining the specific cryptographic machine that needs to be managed and scheduled.

[0067] In a specific implementation, the device information of the target cryptographic machine is obtained; illustratively, the device information may include but is not limited to manufacturer information and device model information, etc., to provide a basis for subsequent access and configuration, so as to manage the target cryptographic machine in a targeted manner, avoid misoperation, and provide necessary parameter information for subsequent configuration work.

[0068] The embodiment of the present invention can also connect the target cryptographic machine to the proxy service based on the device information to establish a connection between the target cryptographic machine and the proxy service, so that the cryptographic machine can accept instructions from the proxy service, and uniformly manage different models of cryptographic machines through the proxy service, shielding the underlying differences, thereby centralizing the management of cryptographic machines on the proxy service, simplifying the management process, and flexibly adapting to different models of cryptographic machines through the proxy service.

[0069] The embodiments of the present invention can also build a secure channel with the proxy service and determine cryptographic resource management instructions to establish a secure communication channel, protect the security of cryptographic resources, and determine an instruction set for managing cryptographic resources so that the proxy service can accurately understand and execute them, thereby protecting the security of data transmission through encryption and other means, and making the management process more standardized and efficient with a unified instruction set.

[0070] In the embodiment of the present invention, the cryptographic resources can also be scheduled through the secure channel based on the cryptographic resource management instructions to implement various operations on the cryptographic resources, such as key generation, encryption, decryption, etc.

[0071] Exemplarily, after the proxy service is started, it automatically submits registration information to the cryptographic resource management system to complete the proxy registration; after the proxy service registration is completed, a secure channel is established with the cryptographic resource management system through the reported certificate to complete the encrypted data interaction; the two parties agree on the cryptographic resource management instructions, implement the instruction interaction protocol based on the secure encrypted channel, and complete the cryptographic resource management capability based on the management instruction. The negotiation process of the initial secure channel encryption key is completed based on the certificate; the cryptographic resource device management is implemented based on the SNMP protocol to complete the information acquisition of the cryptographic resource. The selection of the proxy service and the adaptation of the calling method are completed based on the matching of the device model; for the IP address configuration of the cryptographic machine, the cryptographic resource management system can realize the active discovery of cryptographic resources based on IP polling based on the IP polling mechanism, and realize the automatic registration capability of cryptographic resources. Including the automatic expansion and dynamic update capability of the polling IP range. Based on the instruction protocol of the secure channel with the proxy service, the unified scheduling of cryptographic resources is realized, thereby providing users with a unified interface calling capability.

[0072] The embodiment of the present invention determines the target cryptographic machine and obtains the device information of the target cryptographic machine; connects the target cryptographic machine to the proxy service based on the device information; builds a secure channel with the proxy service and determines the cryptographic resource management instruction; and schedules the cryptographic resources based on the cryptographic resource management instruction through the secure channel. The isolation of the upper-layer cryptographic capabilities and the lower-layer cryptographic resources is achieved, and the cryptographic resources of multiple manufacturers and models can be applied simultaneously, which can not only improve the utilization rate of cryptographic resources, but also prevent the situation of being bound by a single manufacturer.

[0073] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0074] In an optional implementation of the present invention, it also includes:

[0075] An IP polling operation is performed, and when the cipher machine IP is obtained, the cipher machine IP is sent to the target cipher machine through the secure channel; the target cipher machine is configured to register with the cipher resource management system through the cipher machine IP.

[0076] 1. IP polling operation:

[0077] Purpose: To discover available cryptographic devices on the network.

[0078] process:

[0079] The password resource management system sends ICMP echo requests (ie, ping) one by one according to the preset IP address range.

[0080] If an IP address responds, it is considered that the IP address corresponds to an online device.

[0081] The responding IP address is recorded as a potential cryptographic machine device.

[0082] 2. Secure channel communication:

[0083] Purpose: To establish a secure and reliable communication link between the cryptographic resource management system and the target cryptographic machine.

[0084] Way:

[0085] TLS / SSL: Use the TLS / SSL protocol to encrypt communication data to ensure data confidentiality, integrity, and identity authentication.

[0086] Key exchange: Negotiate session keys through key exchange protocols (such as RSA, Diffie-Hellman) to encrypt communication data.

[0087] Digital certificate: Use digital certificates to authenticate the identities of both communicating parties.

[0088] 3. Send password machine IP:

[0089] Purpose: To notify the target cryptographic machine of the IP address assigned by the cryptographic resource management system.

[0090] Way:

[0091] Encapsulate into instructions: Encapsulate the cipher machine IP into a specific instruction and send it to the target cipher machine through a secure channel.

[0092] Instruction format: The instruction format should be clearly defined, including information such as instruction type, target device, IP address, etc.

[0093] 4. Target cipher machine registration:

[0094] Purpose: To register its own information into the password resource management system for subsequent management and scheduling.

[0095] process:

[0096] Receiving instructions: After the target cipher machine receives the instructions sent by the cipher resource management system, it parses the instruction content.

[0097] Configure IP address: Configure its own network interface according to the IP address in the instruction.

[0098] Send registration information: Send registration information to the password resource management system, including device model, serial number, supported algorithms, etc.

[0099] Configuration: The target cryptographic machine configures its own network interface based on the received IP address so that it can communicate with the cryptographic resource management system through the IP address.

[0100] By performing an IP polling operation and when the cipher machine IP is obtained, the cipher machine IP is sent to the target cipher machine through the secure channel; the target cipher machine is configured to register with the cipher resource management system through the cipher machine IP, the following beneficial effects can be achieved:

[0101] Automatic discovery: Through IP polling, cryptographic devices in the network can be automatically discovered without manual intervention.

[0102] Secure communication: The secure channel ensures the confidentiality and integrity of the communication data.

[0103] Unified management: All cryptographic equipment is registered and managed in a unified manner, facilitating centralized control and scheduling.

[0104] Flexible configuration: IP addresses can be dynamically assigned to cryptographic machines to improve system flexibility.

[0105] In an optional embodiment of the present invention, the step of connecting the target cryptographic machine to the proxy service based on the device information includes:

[0106] Determine the cryptographic machine management interface of the target cryptographic machine based on the device information;

[0107] Calling the cryptographic machine management interface to obtain the current status information and specific machine parameters of the target cryptographic machine;

[0108] Generate a registration instruction for the target cryptographic machine based on the current state information and the specific machine parameters;

[0109] The target cryptographic machine is connected to the proxy service based on the registration instruction.

[0110] Determine the cryptographic machine management interface based on device information:

[0111] Device information acquisition: The device model, manufacturer and other information obtained through the SNMP protocol can be used as a keyword for database query.

[0112] Database query: A device information database is maintained in the cryptographic resource management system, which stores the management interface information of different models of cryptographic machines, including IP addresses, ports, protocols (HTTP, HTTPS, SNMP, etc.), authentication methods, etc.

[0113] Interface matching: Search the database for the corresponding management interface information based on the device information.

[0114] Call the cryptographic machine management interface to obtain status information:

[0115] Interface call: Use the corresponding protocol (HTTP, HTTPS, SNMP, etc.) to send a request to the cryptographic machine to obtain its current status information.

[0116] Status information content: including the operating status of the cryptographic machine, hardware information, software version, key usage, etc.

[0117] Parameter acquisition: Get some specific parameters of the cryptographic machine at the same time, such as supported algorithms, key length, maximum number of concurrent connections, etc.

[0118] Generate registration instructions for the target cipher machine:

[0119] Instruction format: According to the instruction format of the proxy service, construct an instruction containing the following information:

[0120] Command type: Registration command

[0121] Target device: IP address of the target cryptographic machine

[0122] Device information: model, version, serial number, etc. obtained from the cryptographic machine

[0123] Management interface information: Management interface information obtained from database query

[0124] Other parameters: such as keys, certificates, etc.

[0125] Instruction content: The instruction content should be clear and unambiguous to ensure that the proxy service can correctly parse and execute it.

[0126] Connect the target cipher machine to the proxy service based on the registration instruction:

[0127] Send instruction: Send the generated registration instruction to the proxy service through a secure channel.

[0128] Proxy processing: After receiving the instruction, the proxy service parses the instruction content and performs the following operations:

[0129] Verify the legitimacy of the instruction: Check whether the instruction format is correct and whether the signature is valid.

[0130] Connect to the cipher machine: Connect to the target cipher machine according to the management interface information in the command.

[0131] Perform registration operation: send a registration request to the cryptographic machine to bring the cryptographic machine under management.

[0132] Update database: Update the database of the cryptographic resource management system and record the registration information of the cryptographic machine.

[0133] By determining the cryptographic machine management interface of the target cryptographic machine based on the device information; calling the cryptographic machine management interface to obtain the current state information and specific machine parameters of the target cryptographic machine; generating a registration instruction for the target cryptographic machine based on the current state information and the specific machine parameters; and connecting the target cryptographic machine to the proxy service based on the registration instruction. The newly discovered cryptographic machine can be connected to the proxy service to achieve unified management. The whole process involves multiple links such as device discovery, information acquisition, instruction generation, and secure communication.

[0134] In an optional embodiment of the present invention, the password resource management system is configured with a registration interface and further includes:

[0135] Receiving an agent registration instruction sent by the agent service;

[0136] Based on the proxy registration instruction, a registration interface is called to obtain the proxy resources reported by the proxy service; the proxy resources include proxy IP information, port information and proxy certificate public key information.

[0137] In actual applications, the registration interface of the password resource management system can be specifically used to receive the registration request sent by the proxy service.

[0138] For example, when a new proxy service is started and connected to the password resource management system, it will send a registration instruction to the system, which contains relevant information about the proxy service. The password resource management system incorporates the proxy service and its resources into its own management system by parsing the instruction.

[0139] The proxy registration instruction contains the necessary information that the proxy service reports to the password resource management system, mainly including:

[0140] Proxy IP information: The IP address of the proxy service, used for communication between the password resource management system and the proxy service.

[0141] Port information: The port number that the proxy service listens on, used to establish a connection.

[0142] Proxy certificate public key information: The digital certificate public key of the proxy service, which is used to verify the identity of the proxy service and establish a secure communication channel.

[0143] The processing flow of the registration interface:

[0144] Receiving instructions: The password resource management system listens to the registration interface. Once it receives the registration instruction sent by the proxy service, it will trigger the corresponding processing logic.

[0145] Instruction parsing: The system will parse the received instructions and extract information such as proxy IP, port, certificate public key, etc.

[0146] Data verification: The system verifies the received data to ensure its integrity and legitimacy. For example, it verifies whether the format of the certificate public key is correct and complies with predefined rules.

[0147] Storage information: If the verification is successful, the system will store the proxy service information in the database. This information includes the proxy's IP, port, public key, and other related metadata, such as registration time, status, etc.

[0148] Generate Response: The system sends a response to the proxy service to let it know whether the registration was successful. If successful, the response may contain some additional information, such as the public key of the password resource management system's certificate.

[0149] The significance of reporting agent resources is:

[0150] Unified management: All proxy service information is centrally stored in the password resource management system to facilitate unified management and scheduling.

[0151] Secure communication: The public key information of the proxy certificate is the basis for establishing a secure communication channel and can ensure the security of data transmission.

[0152] Dynamic expansion: When a new proxy service is added, dynamic expansion can be achieved through the registration interface.

[0153] The registration interface of the password resource management system is the key to achieve dynamic expansion and centralized management of the system. Through this interface, the password resource management system can obtain information about proxy services, establish a secure communication channel, and achieve unified management of proxy services.

[0154] In an optional embodiment of the present invention, the step of establishing a secure channel with the proxy service includes:

[0155] Generate a certificate public key based on the proxy IP information, the port information and the proxy certificate public key information, and generate a random number;

[0156] Encrypting the certificate public key based on the random number to generate an encrypted certificate public key;

[0157] Sending the encryption certificate public key to the proxy service; the proxy service decrypts the encryption certificate public key to generate an encryption channel key;

[0158] A secure channel is established with the proxy service based on the encryption channel key.

[0159] A combination of asymmetric and symmetric encryption is used to establish a secure channel between the password resource management system and the proxy service. The whole process can be divided into the following steps:

[0160] Generate random numbers and encryption certificate public keys:

[0161] The cryptographic resource management system can generate a certificate public key after receiving the proxy IP information, port information and proxy certificate public key information, and generate a random number, which will serve as the basis for generating a symmetric key.

[0162] At the same time, the password resource management system uses the certificate public key provided by the proxy service to encrypt the generated random number to obtain an encrypted certificate public key.

[0163] Send encryption certificate public key:

[0164] Send the encrypted certificate public key to the proxy service.

[0165] The proxy service decrypts and generates a symmetric key:

[0166] The proxy service uses its own private key to decrypt the received encryption certificate public key and obtains the random number generated by the password resource management system.

[0167] The proxy service also generates a random number locally and performs an XOR operation on the two random numbers to obtain a symmetric key.

[0168] The proxy service encrypts and returns:

[0169] The proxy service uses the public key of the password resource management system to encrypt the locally generated random number and sends the encryption result back to the password resource management system.

[0170] The password resource management system generates a symmetric key:

[0171] The cryptographic resource management system uses its own private key to decrypt the received encrypted data and obtain the random number generated by the proxy service.

[0172] The cryptographic resource management system performs an XOR operation on the random number generated by itself and the random number generated by the proxy service to obtain the same symmetric key as the proxy service.

[0173] Establishing a secure channel:

[0174] Both parties have the same symmetric key, and subsequent communication data will be encrypted and decrypted using this symmetric key, thus establishing a secure communication channel.

[0175] Advantages of Safe Channel:

[0176] Key negotiation: Through the exchange and encryption of random numbers, both parties jointly generate a symmetric key, which increases the security of the key.

[0177] Asymmetric encryption ensures identity authentication: Using the certificate public key and private key to encrypt and decrypt data can ensure the authenticity of the identities of both communicating parties.

[0178] Symmetric encryption ensures efficiency: Symmetric encryption algorithms are more efficient than asymmetric encryption algorithms and are suitable for encrypting large amounts of data.

[0179] In an optional embodiment of the present invention, the step of performing an IP polling operation includes:

[0180] Determine an IP address segment, and set a polling queue for the IP address segment;

[0181] Performing a reachability test on the IP addresses in the polling queue;

[0182] When the IP address passes the reachability test, the IP address is marked as an available IP address and stored in a cryptographic machine device pool; the cryptographic machine device pool is used to obtain the cryptographic machine IP.

[0183] Optionally, after the step of sending the cipher machine IP to the target cipher machine through the secure channel, the step further includes:

[0184] Mark the cipher machine IP as a used IP address and remove the cipher machine IP from the polling queue;

[0185] Determine the number of IPs and the polling period of the polling queue, and adjust the length of the polling queue according to the number of IPs and the polling period.

[0186] IP polling can be performed in the following ways:

[0187] 1. Determine the IP address segment and set the polling queue:

[0188] Determine the IP range: Determine the IP address segment that needs to be polled based on the actual configuration of the password resource pool.

[0189] Set up the polling queue:

[0190] Queue length L: Calculate and set the maximum length L of the polling queue based on factors such as single query time t, polling cycle T, and number of available IP addresses N.

[0191] Initial queue filling: L IP addresses are randomly selected from the IP address segment and filled into the polling queue.

[0192] 2. Perform reachability test:

[0193] Test one by one: Take an IP address from the head of the polling queue and perform a ping test or other reachability test.

[0194] Marking results:

[0195] Reachable: If the test passes, the IP address is marked as available and added to the cryptographic machine device pool.

[0196] Unreachable: If the test fails, remove the IP address from the queue.

[0197] 3. Update the polling queue:

[0198] Dynamic Adjustment:

[0199] Queue reduction: When the number of available IP addresses m is close to 80% of the total number of IP address segments N, the length of the polling queue is reduced to reduce the consumption of network resources.

[0200] Queue expansion: When the number of IPs in the polling queue is less than 20%, increase the length of the polling queue to increase the probability of finding an available IP.

[0201] 4. Processing of cipher machine IP:

[0202] Mark as used: When a cryptographic machine is discovered and connected to the system, its corresponding IP address is marked as used.

[0203] Remove from queue: Remove the IP address from the polling queue to avoid repeated testing.

[0204] Add to device pool: Add the IP address to the cryptographic machine device pool for subsequent management and scheduling.

[0205] 5. Security channel and instruction structure:

[0206] Safe Passage:

[0207] Establishment: As mentioned above, a secure communication channel is established between the cryptographic resource management system and the agent to ensure the security of instruction transmission.

[0208] Instruction transmission: Through this channel, the cryptographic resource management system sends instructions to the agent, and the agent executes the instructions and returns the results.

[0209] Instruction structure:

[0210] Standardization: Define a unified instruction format, including instruction type, target device, operating parameters, etc.

[0211] Encrypted transmission: All instructions are encrypted with symmetric keys to ensure security during transmission.

[0212] The embodiment of the present invention determines an IP address segment and sets a polling queue for the IP address segment;

[0213] Performing a reachability test on the IP addresses in the polling queue;

[0214] When the IP address passes the reachability test, the IP address is marked as an available IP address and stored in a cryptographic machine device pool; the cryptographic machine device pool is used to obtain the cryptographic machine IP.

[0215] Optionally, after the step of sending the cipher machine IP to the target cipher machine through the secure channel, the step further includes:

[0216] Mark the cipher machine IP as a used IP address and remove the cipher machine IP from the polling queue;

[0217] Determining the number of IPs and the polling period of the polling queue, and adjusting the length of the polling queue by the number of IPs and the polling period, achieves the following beneficial effects:

[0218] Test method: More complex network test methods, such as TCP connection, port scanning, etc., can be used to improve the accuracy of the test.

[0219] Polling strategy: The polling frequency can be dynamically adjusted according to the network load to avoid excessive impact on the network.

[0220] IP address allocation: IP address pools can be used to uniformly manage and allocate IP addresses.

[0221] Fault handling: When a network failure or device failure is discovered, a corresponding handling mechanism is required to ensure the stability of the system.

[0222] Through the method of IP polling, the password resource management system can dynamically discover available IP addresses and add them to the password machine device pool. Combining the secure channel and the standardized instruction structure, the unified management and scheduling of the password machine are realized.

[0223] To enable those skilled in the art to better understand the embodiments of the present invention, the following uses an example to illustrate the embodiments of the present invention.

[0224] The automatic expansion of password resources can be achieved in the following ways:

[0225] Step 1: Deploy the password resource management system.

[0226] Deploy a unified password resource management platform, including the database of the management platform, the nginx proxy, and the front-end user interaction interface UI.

[0227] Step 1.1: Open the monitoring port for proxy service registration;

[0228] Open the monitoring of the proxy registration port and accept the proxy service registration application. The proxy service registration is implemented in the form of instruction interaction. For the instruction details, see 2.1 Proxy Service Deployment.

[0229] Step 1.2: Open the password machine IP monitoring;

[0230] Configure the available network address segment based on the network IP address segment allocated by the actual password resource pool. After configuration, the password resource management system will start the IP polling call method to perform the IP address reachability test. Since the number of IPs in the IP address segment may be large, full polling may consume a large amount of network resources and does not conform to the actual application situation. Therefore, based on the actual situation, the polling method is implemented in the form of dynamic expansion;

[0231] Suppose there are a total of N IP addresses in the IP address segment, the number of used IP addresses is m, the single query time is t, the upper limit of the number of IP addresses in the polling queue is L, the current number of IPs in the polling queue is l, and the polling period is T. To ensure that there are enough available IPs and the polling period is within a certain range, it is necessary to satisfy: L < T÷t. When l < 0.2L, the number of IPs needs to be expanded to L. When m > 0.8N, a warning of insufficient IP quantity needs to be issued to reserve enough time for expanding available IP addresses;

[0232] When the password resource management system discovers a password machine device newly connected to the network, it will mark the IP address as a used address and remove it from the polling queue; and obtain the machine name of the device through the snmp protocol, query the instruction channel of the proxy service corresponding to this model of machine based on the name, and send instructions to the corresponding proxy machine to notify it to perform status acquisition and registration operations on this device;

[0233] Step 1.3: Negotiate a secure channel between the cryptographic resource management system and the proxy service and an instruction structure of the cryptographic resource management instruction;

[0234] A secure channel is constructed between the cryptographic resource management system and the agent to distribute and receive cryptographic resource management instructions.

[0235] Step 2: Deploy the password resource management system agent.

[0236] The proxy service of the cryptographic resource management system is deployed on the cryptographic machine side. The proxy service implements functional adaptation based on the cryptographic machine manufacturer and model, and encapsulates the corresponding instruction functions based on the required cryptographic machine capabilities.

[0237] Step 2.1: Agent deployment;

[0238] The deployment manufacturer corresponds to the adapter agent. When the agent starts, it automatically sends the agent registration instruction to the password resource management system. The instruction structure is as follows Figure 2 As shown, Figure 2 It is a structural diagram of the instruction structure between the password resource management system and the proxy service provided in the embodiment of the present invention.

[0239] Step 2.2: Report the proxy public key;

[0240] When the proxy service is started, it is necessary to configure the certificate and password resource management IP address. When the proxy service is started, the registration interface of the password resource management system is automatically called to implement proxy resource reporting. The reported information mainly includes proxy IP, port, proxy certificate public key and other proxy related information. The registration interface returns the certificate public key of the password resource management system.

[0241] Step 2.3: Instruct secure channel establishment

[0242] After completing the agent information registration, the password resource management system will actively establish a secure channel with the agent. The channel establishment process is as follows:

[0243] 1. The password resource management system generates a random number, encrypts the random number using the proxy certificate public key, and transmits it to the proxy server via the UDP protocol;

[0244] 2. The agent obtains a random number by decrypting the local certificate private key;

[0245] 3. The agent generates a random number locally and performs an XOR operation with the random number from the cryptographic resource management system to obtain the encryption channel key.

[0246] 4. The agent uses the public key of the password resource management system's certificate to encrypt the locally generated random number and returns the encrypted result to the password resource management system;

[0247] 5. The cryptographic resource management system uses the local certificate public key to decrypt the random number, and XORs the random number with the local random number to generate the encryption channel key;

[0248] 6. The cryptographic resource management system stores the corresponding relationship between the secure channel, the communication key and the agent ID in a cache;

[0249] 7. Both parties use communication keys to encrypt instructions and exchange data.

[0250] Step 3: The cipher machine accesses the proxy.

[0251] When the capacity of the cipher machine needs to be expanded, the cipher machine IP address needs to be configured according to the polling IP address range configured by the cipher resource management system.

[0252] Step 3.1: Register the password machine information

[0253] When the password resource management system polls the IP and finds a new connected device, it will obtain the machine model through the SNMP protocol, confirm the manufacturer and model of the password machine through matching, query the message channel of the corresponding manufacturer's agent service, and issue the new password machine IP address.

[0254] Step 3.2: Report the cipher machine information

[0255] Based on the cipher machine model obtained by the cipher machine agent, confirm the cipher machine management interface of the corresponding manufacturer, obtain the current status of the cipher machine and specific machine parameters, form a new cipher machine registration instruction, and report it to the cipher resource management system. The cipher machine data storage is uniformly managed by the cipher resource management system.

[0256] Step 4: The password resource management system realizes the unified application of password resources.

[0257] The password resource management system provides a unified interface capability to the outside world. Based on the secure channel between the agent, it can implement command issuance and data collection, thereby achieving unified control of the agent. For the upper-level system, it only needs to call the unified interface of the password service platform and view the visual interface of the system to complete the operation call of password resources of various manufacturers and models.

[0258] Step 5: Access and adapt the new manufacturer's cryptographic machine

[0259] The agent uniformly specifies the cryptographic resource capabilities that need to be called by each cryptographic resource, and implements function calls through instructions. When a new cryptographic machine needs to be connected, it only needs to be based on the cryptographic capability call package provided by the manufacturer and the function encapsulation based on the call method provided, so that the cryptographic machine manufacturer can be quickly connected and the function adapted. Because the capabilities of cryptographic resources are generally universal, only the calling methods vary greatly, and this method can achieve rapid access to multiple scenarios and multiple needs without changing the overall technical architecture and the original function code.

[0260] Description of password resource management system and proxy service.

[0261] The password resource management system includes the following modules:

[0262] The unified interface module is used to provide a unified password capability calling interface to the outside world.

[0263] The cryptographic resource registration module is used to actively discover cryptographic machines and collect initial information about them.

[0264] The password resource management module is used to generate password resource management instructions.

[0265] The agent control module is used to establish a secure channel with the agent, negotiate communication keys, complete agent selection and issue control instructions.

[0266] The proxy service includes the following modules:

[0267] The automatic registration module is responsible for actively reporting the proxy information to the password resource management system to complete the establishment of a secure channel.

[0268] The instruction receiving module is responsible for monitoring the secure channel, managing the secure channel keys, and parsing the cryptographic resource management instructions received by the secure channel.

[0269] The cryptographic resource control module is responsible for calling the corresponding capabilities of the cryptographic resources based on the received instructions, and constructing return information to return to the cryptographic resource management system.

[0270] refer to Figure 2 , Figure 2 is a schematic diagram of the structure of the instruction structure between the password resource management system and the proxy service provided in an embodiment of the present invention;

[0271] The overall structure of the secure channel transmission instructions between the cryptographic resource management systems is divided, in which the distance explains the main instruction structure of the agent registration, cryptographic machine registration, and cryptographic machine capability call, and explains the structural form of the overall instruction. The transmission of instructions between the cryptographic resource management system and the agent is achieved by building a secure channel. Through the form of instructions, the cryptographic resource management system manages and controls the agent, and then realizes the stateless management of the cryptographic machine.

[0272] refer to Figure 3 , Figure 3 is a system architecture diagram between a password resource management system and an agent provided in an embodiment of the present invention;

[0273] Figure 3 The relationship between the password resource management system and the modules in the agent and the main capability division are explained, and how the agent can achieve management adaptation of password resources of different models and manufacturers. Through layered division and distributed management, unified management of password resources and unified capability call can be achieved.

[0274] refer to Figure 4 , Figure 4 is a functional module relationship diagram between a code resource management system and an agent provided in an embodiment of the present invention;

[0275] The main modules of the system and the function calls between modules are as follows Figure 4 As shown, the main functional modules between the password resource management system and the proxy service are explained, and the calling relationship between the main modules is simply marked.

[0276] refer to Figure 5 , Figure 5 It is a main flow chart of the cryptographic resource expansion provided in an embodiment of the present invention;

[0277] The system realizes automatic discovery and registration of password resources in the process of realizing rapid dynamic expansion of password resources. The automatic discovery function of password resources is realized by configuring the IP address of the password resource and the polling capability of the password resource management system. The flowchart of automatic discovery and active registration of password machine expansion is as follows: Figure 5 shown.

[0278] Take JAVA language as an example to implement the password resource management system. When the agent is initialized, it registers the agent through the REST interface provided by the password resource management system. After the agent is registered, it can establish a command security channel with the password resource management system. The password resource management system uses the ServerSocket object to implement port monitoring capabilities and provide the agent with the ability to establish a secure channel. The agent establishes a secure channel through the locally stored password resource management system certificate. Use JAVA's Cipher package to implement random number generation, asymmetric encryption, symmetric encryption and other functions to achieve the process of establishing a secure channel. The steps for automatic discovery and automatic registration of password resources are as follows:

[0279] Step 1: The password resource management system configures the polled IP address range and used IP addresses in the database, stores the IP addresses to be polled in the cache, and starts IP address polling. By introducing the InetAddress library, the IP address reachability test is implemented. If it fails, the next one is tried. Assuming that the timeout time for each IP address is set to 3 seconds and the password resource access delay is expected to be 5 minutes, the upper limit of the IP addresses that can be polled each time is 100. When an IP address is already in use, the address polling range is automatically removed. During the polling process, if it is found that the number of currently polled addresses is less than 20, sufficient IP addresses are automatically selected based on the available address range in the database to supplement the polling queue until it is filled to 100.

[0280] Step 2: The password resource management system introduces the SNMP4J library. When an IP address in a polling queue is found to be reachable, it attempts to connect through the connect method and obtains the target machine model, machine name and other information through the get method. Through model parsing, the corresponding agent information is queried through the agent information stored in the database, and the corresponding password machine IP and other information are sent through a secure channel.

[0281] Step 3: The agent uses the password resource information issued by the password resource management system to establish a secure channel through the UDP / TCP protocol based on the password resource management interface provided by the manufacturer, or implements device management through the SNMP protocol. It can also query the device information of the resource through HTTPS. The specific method needs to be implemented through the adaptation layer.

[0282] Step 4: The agent generates a cryptographic machine registration instruction based on the obtained cryptographic resource status information and reports it to the cryptographic resource management system through a secure channel. The cryptographic resource management system parses the data and stores it in the database.

[0283] Step 5: For the password resources that have been registered, the password service management system provides a unified REST interface for other platforms to call and provides unified password capabilities. The interface includes password resource encoding acquisition, password capability call, password capability corresponding parameters, etc. By parsing the parameters in the interface call, based on the database information, the corresponding instructions are generated and sent to the corresponding proxy service provider, and based on the form of a secure channel, a unified return result is obtained and provided to the user.

[0284] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0285] Reference Figure 6 , shows a structural block diagram of a cryptographic resource scheduling device provided in an embodiment of the present invention, which may specifically include the following modules:

[0286] The target cryptographic machine determining module 601 is used to determine the target cryptographic machine and obtain the device information of the target cryptographic machine;

[0287] The proxy service access module 602 is used to access the target cryptographic machine to the proxy service based on the device information;

[0288] A secure channel building module 603, used to build a secure channel with the proxy service and determine cryptographic resource management instructions;

[0289] The scheduling module 604 is used to schedule the cryptographic resources based on the cryptographic resource management instruction through the secure channel.

[0290] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0291] In addition, an embodiment of the present invention further provides an electronic device, such as Figure 7 As shown, it includes a processor 701, a communication interface 702, a memory 703 and a communication bus 704, wherein the processor 701, the communication interface 702, and the memory 703 communicate with each other through the communication bus 704.

[0292] Memory 703, used for storing computer programs;

[0293] The processor 701 is configured to implement the cryptographic resource scheduling method described in any one of the above embodiments when executing the program stored in the memory 703:

[0294] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0295] The communication interface is used for communication between the above terminal and other devices.

[0296] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0297] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0298] like Figure 8 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 801 is also provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the cryptographic resource scheduling method described in the above embodiment.

[0299] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0300] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0301] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0302] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0303] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0304] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0305] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0306] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A cryptographic resource scheduling method, characterized in that: The method is applied to a cryptographic resource management system, wherein the cryptographic resource management system is configured with a proxy service for a cryptographic machine, and comprises: Determine a target cryptographic machine and obtain device information of the target cryptographic machine; Connecting the target cryptographic machine to the proxy service based on the device information; Establishing a secure channel with the proxy service and determining cryptographic resource management instructions; The cryptographic resources are scheduled based on the cryptographic resource management instructions through the secure channel.

2. The method according to claim 1, characterized in that: Also includes: Performing an IP polling operation, and when the cipher machine IP is obtained, sending the cipher machine IP to the target cipher machine through the secure channel; The target cryptographic machine is configured to register with the cryptographic resource management system via the cryptographic machine IP.

3. The method according to claim 1 or 2, characterized in that: The step of connecting the target cryptographic machine to the proxy service based on the device information comprises: Determine the cryptographic machine management interface of the target cryptographic machine based on the device information; Calling the cryptographic machine management interface to obtain the current status information and specific machine parameters of the target cryptographic machine; Generate a registration instruction for the target cryptographic machine based on the current state information and the specific machine parameters; The target cryptographic machine is connected to the proxy service based on the registration instruction.

4. The method according to claim 3, characterized in that The password resource management system is configured with a registration interface and also includes: Receiving an agent registration instruction sent by the agent service; Based on the proxy registration instruction, a registration interface is called to obtain the proxy resources reported by the proxy service; the proxy resources include proxy IP information, port information and proxy certificate public key information.

5. The method according to claim 4, characterized in that The step of establishing a secure channel with the proxy service comprises: Generate a certificate public key based on the proxy IP information, the port information and the proxy certificate public key information, and generate a random number; Encrypting the certificate public key based on the random number to generate an encrypted certificate public key; Sending the encryption certificate public key to the proxy service; the proxy service decrypts the encryption certificate public key to generate an encryption channel key; A secure channel is established with the proxy service based on the encryption channel key.

6. The method according to claim 2, characterized in that The steps of performing the IP polling operation include: Determine an IP address segment, and set a polling queue for the IP address segment; Performing a reachability test on the IP addresses in the polling queue; When the IP address passes the reachability test, the IP address is marked as an available IP address and stored in a cryptographic machine device pool; the cryptographic machine device pool is used to obtain the cryptographic machine IP.

7. The method according to claim 6, characterized in that After the step of sending the cipher machine IP to the target cipher machine through the secure channel, the method further includes: Mark the cipher machine IP as a used IP address and remove the cipher machine IP from the polling queue; Determine the number of IPs and the polling period of the polling queue, and adjust the length of the polling queue according to the number of IPs and the polling period.

8. A cryptographic resource scheduling device, characterized in that: The device is applied to a cryptographic resource management system, and the cryptographic resource management system is configured with a proxy service for a cryptographic machine, including: A target cryptographic machine determination module is used to determine a target cryptographic machine and obtain device information of the target cryptographic machine; An agent service access module, used to connect the target cryptographic machine to the agent service based on the device information; A secure channel construction module, used to construct a secure channel with the proxy service and determine cryptographic resource management instructions; A scheduling module is used to schedule the cryptographic resources based on the cryptographic resource management instructions through the secure channel.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 7.

Images