Password application middleware in butt joint with multi-platform password service and use method

Abstract

The embodiment of the invention provides a password application middleware butted with multi-platform password services and a use method, the middleware is independently deployed and butted with a plurality of third-party services to decouple the third-party services to be butted with each password service independently supporting a national cryptographic algorithm cloud tool, and the middleware comprises a KMS universal module, a middleware application module and a middleware application module, the cloud tool display module is used for displaying at least one encryption method and decryption method supporting a national cryptographic algorithm, packaging encryption and decryption information of each cloud tool, and calling an encryption / decryption service of the corresponding cloud tool according to the information configured by the third-party service and the encryption and decryption information for packaging each cloud tool; and the confidentiality storage module is used for intercepting a sensitive data operation of the third-party service and encrypting / decrypting a service field in the sensitive data operation according to a confidentiality evaluation attribute table pre-configured by the third-party service. The password application middleware is applied to the application system of the third-party service, so that the problems of high docking difficulty and high docking cost in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of software development, and in particular to a cryptographic application middleware for connecting to multi-platform cryptographic services, a method for using the cryptographic application middleware for connecting to multi-platform cryptographic services, an electronic device, and a computer-readable medium. Background Art

[0002] As the core technology and basic support for protecting network and information security, cryptography plays an irreplaceable and important role in identity recognition, security isolation, information encryption, integrity protection and non-repudiation. According to relevant laws and regulations, information systems should use national secret algorithms to protect key information and basic settings, formulate cryptographic application transformation plans, and create a more compliant and secure cloud service base.

[0003] In the selection of cryptographic algorithms, it is necessary to strictly follow the relevant specifications of SM1, SM2, SM3, and SM4 formulated by the National Cryptography Administration, and use cryptographic products with commercial cryptographic product model certificates issued by the National Cryptography Administration. Cryptographic products from different manufacturers or platforms are used in different ways. If the application system in the private deployment scenario wants to implement cryptographic application transformation, it needs to connect with multiple manufacturers, which is difficult to transform and has high connection costs. Summary of the invention

[0004] The embodiment of the present invention provides a cryptographic application middleware for connecting to multi-platform cryptographic services and a method for using the same, so as to solve the problems of high difficulty and high cost of connecting in the prior art.

[0005] The embodiment of the present invention discloses a cryptographic application middleware for connecting to multi-platform cryptographic services, wherein the cryptographic application middleware is independently deployed and connected to multiple third-party services to decouple the third-party services from connecting to cryptographic services of each independently supporting a national cryptographic algorithm cloud tool, including:

[0006] KMS general module, used to display at least one encryption method and decryption method that supports the national secret algorithm, and encapsulate the encryption and decryption information of each cloud tool, and call the encryption / decryption service of the corresponding cloud tool according to the information configured by the third-party service and the encryption and decryption information of each cloud tool;

[0007] Storage confidentiality module, used to intercept sensitive data operations of third-party services and encrypt / decrypt business fields in sensitive data operations according to the confidentiality attribute table pre-configured by the third-party service;

[0008] The storage integrity module is used to perform signature operations on the business fields according to the sensitive data operations intercepted by the storage confidentiality module and record them in a specified database table according to the confidentiality attribute table.

[0009] Optionally, the middleware further includes:

[0010] The elastic scaling module is used to adjust the encryption and decryption resources of the cloud tool according to the frequency and time of sensitive data operations of the third-party service.

[0011] Optionally, the middleware further includes:

[0012] The third-party service call interface is used to configure the application system of the third-party service on the local side, to call the third-party service when it is connected to the business, or to configure the secret review attribute table and database table;

[0013] The data table of the third-party service is used to store the secret review attribute table and database table of the third-party service in the local third-party service application system.

[0014] Optionally, the encryption and decryption information of each cloud tool encapsulated in the KMS general module includes:

[0015] KMS authentication information, signature information, encryption tool identifier, and decryption tool identifier.

[0016] Optionally, the middleware also includes: multiple interfaces for connecting to cloud databases, and interfaces for connecting to KMS and cryptographic machines of multiple cloud tools.

[0017] The embodiment of the present invention also discloses a method for using a cryptographic application middleware for connecting to a multi-platform cryptographic service, including:

[0018] When receiving the operation instruction from the user end of the third-party service, sensitive data is intercepted according to the secret review attribute table of the third-party service;

[0019] Based on the intercepted data, determine whether the data involves confidentiality storage fields;

[0020] If involved, encryption / decryption is performed based on the information of the specified cloud tool configured in the secret review attribute table.

[0021] Optionally, it also includes:

[0022] Based on the intercepted data, determine whether the data involves integrity storage fields;

[0023] If involved, after the integrity signature is executed according to the information of the specified cloud tool configured in the confidentiality attribute table, the signature operation record is updated to the uti_inteqrity_siqnsture database table.

[0024] Optionally, it also includes:

[0025] According to the secret review attribute table in the database table, the integrity storage database table is scanned regularly;

[0026] According to the secret review attribute table, select the information of the specified cloud tool in the secret review attribute table to calculate the signature;

[0027] Determine whether the calculated signature is consistent with the signature in the database table;

[0028] If there is inconsistency, update the exception record to the uti_inteqrity_siqnsture database table.

[0029] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0030] The memory is used to store computer programs;

[0031] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0032] The embodiment of the present invention further discloses one or more computer-readable media on which instructions are stored. When executed by one or more processors, the processors are enabled to execute the method described in the embodiment of the present invention.

[0033] The embodiments of the present invention include the following advantages:

[0034] The cryptographic application middleware of this embodiment supports the KMS system of mainstream manufacturers and the national cryptographic algorithm of cryptographic equipment, and provides the cryptographic related functions required by the application system of third-party services in the whole process of implementing the commercial cryptographic transformation plan. The above-mentioned cryptographic application middleware can effectively reduce the connection cost between the application layer system in the third-party service and each manufacturer in the process of encryption and decryption for the third-party service, and reduce the difficulty of transformation of the application system function in the third-party service. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a structural block diagram of a cryptographic application middleware for connecting to multi-platform cryptographic services provided in an embodiment of the present invention;

[0036] Figure 2 It is a flow chart of a method for using a cryptographic application middleware for connecting to a multi-platform cryptographic service provided in an embodiment of the present invention;

[0037] Figure 3 It is a flow chart of a method for using a cryptographic application middleware for connecting to a multi-platform cryptographic service provided in an embodiment of the present invention;

[0038] Figure 4 is a block diagram of an electronic device provided in an embodiment of the present invention;

[0039] Figure 5is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0041] Reference Figure 1 , shows the cryptographic application middleware ( Figure 1 The middleware is independently deployed and connected to multiple third-party services to decouple the third-party services from connecting to the cryptographic services of each independent national secret algorithm cloud tool. The middleware may include the following modules:

[0042] The KMS general module is used to display at least one encryption method and decryption method that supports the national secret algorithm, and encapsulate the encryption and decryption information of each cloud tool (such as KMS authentication information, signature information, encryption tool identification and decryption tool identification, etc.), and call the encryption / decryption service of the corresponding cloud tool according to the information configured by the third-party service and the encryption and decryption information of each cloud tool.

[0043] For example, the KMS module can expose encryption and decryption methods, encapsulate the authentication and signature details of the KMS of each cloud platform tool (i.e., operation tool), and the encryption and decryption tools, and call the corresponding actual encryption / decryption methods according to the KMS service provider configured by the third-party service.

[0044] The encryption process of the national secret algorithm usually involves complex mathematical operations. For example, taking the SM4 symmetric encryption algorithm as an example, it groups the input plaintext data according to a specific group length (such as 128 bits), and then performs multiple rounds of nonlinear transformations through the key. Assuming that the plaintext is M and the key is K, the encrypted ciphertext C = SM4-encrypt (M, K), where the SM4-encrypt function encapsulates the specific encryption logic, including a series of operations such as initial permutation and round function operation.

[0045] In the KMS general module, the encryption method is not just a simple algorithm implementation, but also needs to be integrated with information related to the cloud tool. For example, during the encryption process, the KMS authentication information of the cloud tool needs to be considered. If the authentication fails, the encryption operation will not be able to be performed.

[0046] At the same time, signature information is also related to encryption engineering. Signature can ensure the integrity and non-repudiation of data. Assuming the signature function is sign, the data needs to be signed before or after the encryption operation, such as signedM=sign(M), and then the encryption operation is performed on signedM.

[0047] Furthermore, decryption is the inverse process of encryption. For the SM4 algorithm, the decryption function SM4-decrypt can restore the ciphertext C to the plaintext M, that is, M = SM4-decrypt (C, K). Similarly, in the KMS general module, the decryption process also needs to consider the information related to the cloud tool.

[0048] Before decryption, authentication is also required to ensure that only legitimate users or services can decrypt. In addition, the decrypted result also needs to be signed and verified to ensure that the data has not been tampered with during transmission.

[0049] Specifically, the decryption tool identifier corresponds to the encryption tool identifier, which can help the KMS general module accurately find the tool used for decryption among many cloud tools.

[0050] When the KMS general module receives an encryption or decryption request, it first reads the third-party service configuration information to determine the cloud tool identifier to be used, and then obtains the packaged cloud tool encryption or decryption information based on the identifier, including authentication information, signature information, encryption tool identifier, and decryption tool identifier. Then, the obtained encryption or decryption information is used to perform authentication, signature and other related operations, and finally the encryption or decryption service of the corresponding cloud tool is called.

[0051] For example, if you want to use cloud tool A for encryption operations according to the configuration, first obtain AuthInfoA for authentication, obtain SignInfoA for possible signature operations, find the correct encryption tool according to EncryptToolIdA, and then call the encryption service of cloud tool A to encrypt the data.

[0052] The storage confidentiality module is used to intercept sensitive data operations of third-party services and encrypt / decrypt business fields in sensitive data operations according to the confidentiality attribute table pre-configured by the third-party service.

[0053] In the use of cryptographic application middleware, such as Figure 2 As shown, the storage confidentiality module can intercept sensitive data operations of third-party services and encrypt and decrypt related business fields according to the util_sec_property confidentiality attribute table.

[0054] In this embodiment, the storage confidentiality module is a key line of defense in the data security system, and is mainly responsible for monitoring and managing the operations of third-party services on sensitive data.

[0055] Third-party services perform various data operations in daily operation, such as querying, modifying, inserting and deleting data. The data involved in these operations may contain sensitive information, such as users' personal identity information, corporate trade secrets, etc. The storage confidentiality module can intercept these operations in real time and conduct security review before the data is further processed.

[0056] For example, when a third-party service attempts to update a user information table in the database, the storage confidentiality module will intervene to check whether the updated data field contains sensitive information. If so, it will be processed according to pre-set rules instead of directly allowing the third-party service to operate on the data.

[0057] The confidentiality attribute table is an important basis for the storage confidentiality module to perform encryption and decryption operations. Through the confidentiality attribute table, the storage confidentiality module can achieve refined management of sensitive data operations in different business scenarios. For example, for some business fields with extremely high security requirements, such as the amount field involving fund transactions, a high-level encryption algorithm is used, while for some relatively less sensitive fields, a relatively simple encryption algorithm can be used or encryption is not performed in certain circumstances.

[0058] By setting up a storage confidentiality module, the security of processing sensitive data operations of third-party services is greatly improved. It not only ensures the confidentiality of sensitive data during operations, but also adapts to different data security requirements in different business scenarios through flexible configuration of the attribute table.

[0059] The storage integrity module is used to sign the business fields according to the confidentiality attribute table and record them in the specified database table based on the sensitive data operations intercepted by the storage confidentiality module. The storage integrity module can also intercept sensitive data operations of third-party services, such as Figure 3 As shown, the relevant business fields are signed according to the util_sec_property confidentiality attribute table. The util_sec_property confidentiality attribute table is scanned regularly through a timer to calculate the signature, and the signature is compared with the corresponding record signature of util_integrity_signature, and the abnormal record is recorded in the util_integrity_exception database table.

[0060] In actual applications, the storage confidentiality module intercepts sensitive data operations of third-party services. At this time, the storage integrity module can perform signature operations on relevant business fields without intercepting again. Through this operation, the optimization improves the overall efficiency and reduces unnecessary resource consumption. Because intercepting again may increase the processing burden of the system, through this collaborative mechanism, the storage integrity module can quickly obtain the required information and perform signature operations, while ensuring that the data integrity work can be completed in a timely and efficient manner.

[0061] In the specific implementation process, the storage integrity module is responsible for intercepting sensitive data operations of third-party services, and the storage integrity module further carries out work on this basis. After the storage confidentiality module intercepts sensitive data operations, the storage integrity module performs signature operations based on relevant information to ensure the integrity of these sensitive data is protected. This association mechanism enables the two modules to systematically ensure the security of data during storage and operation.

[0062] The signature operation is an operation based on a specific algorithm (such as a hash algorithm, etc.), which will generate a unique signature value for the business field.

[0063] The storage integrity module includes a timer, which is responsible for triggering the scan of the secret review attribute table at regular intervals. By setting a specific time interval, such as every hour or a specific time every day, the scan of the util_sec_property secret review attribute table is started regularly. When the timer triggers the scan, the storage integrity module recalculates the signature of the relevant business field in the secret review attribute table, and then compares the newly calculated signature with the corresponding record signature previously recorded in util_integrity_signature.

[0064] For example, assuming that the business field is "transaction-amount", the storage integrity module determines that it needs to be signed based on the secret review attribute table. Using the selected hash algorithm (such as SHA-256), the value of "transaction-amount" is used as input, and a signature value, such as "signature-value", is obtained after the algorithm operation. This signature value is then recorded together with the corresponding business field information in the specified database table;

[0065] For the "transaction-amount" business field, when the timer triggers the scan, the storage integrity module recalculates its signature to obtain the "new-signature-value", and then compares it with the "signature-value" recorded in the util_integrity_signature table. If the two signature values ​​are the same, it means that the integrity of the data has not been destroyed during this period; if they are different, it means that the data may have been tampered with. At this time, the abnormal record will be recorded in the util_integrity_exception database table for subsequent investigation and processing.

[0066] The cryptographic application middleware of this embodiment supports the KMS (Key Management Service) system of mainstream manufacturers and the national cryptographic algorithm of cryptographic equipment, and provides the cryptographic related functions required by the application system in the whole process of implementing the commercial cryptographic transformation plan. The above-mentioned cryptographic application middleware can effectively reduce the connection cost between the application layer system and various manufacturers in the third-party service in the process of encryption and decryption for third-party services, and reduce the difficulty of transformation of application system functions in third-party services.

[0067] The middleware of this embodiment also includes: an elastic expansion module;

[0068] The elastic scaling module is used to adjust the encryption and decryption resources of the cloud tool according to the frequency and time of sensitive data operations of the third-party service, such as adding multiple cloud tools or reducing cloud tools.

[0069] When the frequency of third-party services operating on sensitive data reaches a certain threshold, it indicates that the current encryption and decryption resources may not be sufficient to meet the demand. For example, if a large number of encryption requests continue to pour in within a short period of time, existing cloud tools may experience delays or performance degradation.

[0070] At this time, the elastic scaling module will adopt the strategy of adding cloud tools, that is, allocating additional cloud tool instances from the cloud platform's resource pool to participate in encryption and decryption. Assuming that there were originally only two cloud tools used for encryption operations, when the operation frequency exceeds the set threshold, the elastic scaling module can add three cloud tools, thereby expanding the total encryption resources to five cloud tools, which can effectively share the workload, improve the processing speed of encryption and decryption, and avoid operation backlogs.

[0071] On the contrary, when the frequency of third-party services operating on sensitive data is low, it is a waste to maintain too many cloud tool resources. For example, at night or during business downturns, the amount of sensitive data operations is greatly reduced. The elastic scaling module will detect this low operation frequency and then decide to reduce cloud tool resources. It can release some idle cloud tools to the resource pool of the cloud platform to reduce costs. For example, if there are originally 5 cloud tools for decryption operations, during the period of low operation frequency, the elastic scaling module can reduce 3 cloud tools and only retain two cloud tools for occasional decryption operations, thereby achieving optimal resource configuration.

[0072] The middleware of this embodiment can use an automatic adjustment mechanism to dynamically optimize when the pressure on the middleware node is too high, thereby improving the performance of cryptographic-related functions; when the pressure on the middleware node is relatively low, it can adjust the number of resources in the opposite direction to reduce the occupancy of cluster resources and achieve dynamic expansion and contraction.

[0073] Figure 1 The national secret algorithm tools shown in the figure may include: Alibaba Cloud KMS, Tianyi Cloud KMS, Huawei Cloud KMS, and the corresponding cipher machines include Ahnheng, Geer, Jiangnan Tianan, etc. This embodiment is not limited to only Figure 1 The tools and cryptographic machines shown in the figure can be configured according to actual needs.

[0074] In addition, the code package of the middleware of this embodiment can be configured in the third-party service. In this case, the middleware also includes: a third-party service calling interface, which is used to configure the application system of the third-party service on the local side, to call the third-party service when docking the business, or to configure the secret review attribute table and database table;

[0075] The data table of the third-party service is used to store the secret review attribute table and database table of the third-party service in the local third-party service application system.

[0076] In actual applications, the middleware also includes: multiple interfaces for connecting to cloud databases, and interfaces for connecting to the KMS and cryptographic machines of multiple cloud tools, so as to facilitate the connection to each cloud KMS.

[0077] In this embodiment, in a modern complex business environment, the application system of the third-party service needs to interact with various external resources and functions. Through this call interface, the middleware can be easily integrated into the application system, so that it can use the various functions provided by the middleware, such as data encryption, decryption, integrity verification, etc.

[0078] This interface can be called when a third-party service is docking with the business. For example, when a third-party service interacts with other companies or platforms for data or cooperation projects, it is necessary to ensure the security and compliance of the data. At this time, by calling this interface, the application system can trigger the relevant functions of the middleware to process the interactive data securely, thereby ensuring the smooth progress of business docking.

[0079] The secret review attribute table and database table are important bases for the middleware to manage data security. The third-party service call interface allows the configuration of the secret review attribute table and database table on the local side. The third-party service can customize the parameters in the secret review attribute table according to its own business needs, security policies and data characteristics, such as which business fields need to be encrypted and which encryption algorithm to use. At the same time, the structure and storage rules of the database table can also be adjusted.

[0080] The secret review attribute table stores various attribute information about data security assessment, such as encryption / decryption requirements of business fields, integrity signature requirements, etc. Database tables may contain various information related to business data, such as user information tables, transaction record tables, etc. By storing these tables in the local third-party service data table, on the one hand, it is convenient for local application systems to quickly access and use this information, and on the other hand, it also improves data security and avoids the risk of data leakage during transmission. At the same time, this local storage method also enables third-party services to better manage and update these tables flexibly according to the development and changes of their own business.

[0081] In the specific implementation process, the middleware also includes connecting to cloud databases; different cloud databases can be used to store different types of business data. For example, one cloud database may be used to store user identity information, while another may be used to store transaction records. By dividing multiple cloud databases, data can be stored in a classified manner, improving the efficiency and security of data management.

[0082] As third-party service businesses continue to expand and diversify, the requirements for data storage and processing have become more complex. Multiple cloud databases can provide flexible storage solutions based on different business scenarios and data characteristics. For example, for businesses that have high requirements for data real-time, such as online payment businesses, the relevant data can be stored in a cloud database with high read and write speeds; and for businesses that have extremely high requirements for data security, such as data involving state secrets or corporate core secrets, they can be stored in a cloud database with a high level of security protection.

[0083] Furthermore, the middleware also includes interfaces for connecting to the KMS (Key Management Service) and cryptographic machines of multiple cloud tools. This interface greatly facilitates the connection with each cloud KMS.

[0084] KMS plays a vital role in data security. It is responsible for key generation, storage, distribution and management. By connecting to the KMS of multiple cloud tools through this interface, the middleware can obtain reliable key resources for data encryption and decryption operations. This ensures the confidentiality of data during storage and transmission, and prevents data from being illegally obtained or tampered with.

[0085] A cryptographic machine is a device specifically used for encryption and decryption operations, with a high degree of security and processing power. The interface for connecting to the cryptographic machine enables the middleware to fully utilize the functions of the cryptographic machine and further improve the efficiency and security of data encryption and decryption. When processing large amounts of sensitive data, such as when financial institutions process massive amounts of user funds transaction data, the cryptographic machine can provide fast and secure encryption and decryption services, and through this interface, integration with the middleware ensures data security for the entire system.

[0086] The cryptographic application middleware provided in this embodiment supports docking with multi-platform cryptographic services, encapsulates the authentication, signature details, and password review tools of the mainstream cloud platform KMS and mainstream cryptographic equipment manufacturers, and can be deployed and changed as an independent module. Figure 1 The cryptographic application middleware shown in can also be connected to various databases such as Mysql, Oracle, etc.

[0087] There are two key points for the third-party service application system when implementing the national secret transformation: confidentiality transformation and integrity transformation. Confidentiality transformation can conveniently switch and use multiple national secret algorithms by calling the encryption and decryption functions and digital certificate functions provided by the middleware. Integrity transformation can automatically implement the integrity verification of important data by configuring the integrity protection parameters of the secret evaluation middleware, reducing the intrusion of the transformation function on the normal business of the application system.

[0088] To better understand the above Figure 1 The util_sec_property secret evaluation attribute table used by the cryptographic application middleware, the util_integrity_signature storage integrity signature table, and the util_integrity_exception storage integrity exception record table are given as examples below. The data structures of these tables are shown in Table 1, Table 2, and Table 3. At the same time, combined with Figure 2 and Figure 3 The following describes how to use the above-mentioned cryptographic application middleware.

[0089] Compared with the traditional password evaluation transformation, the password application middleware of this embodiment has a code package that can be located at the bottom layer of the application system in the third-party service. It connects to the KMS and password machines of multiple platforms, shielding the implementation details and differences of the KMS and password machines of different platforms. Users can choose the underlying KMS or password machine that needs to be connected according to their needs without redevelopment. At the same time, it also supports users to customize and develop access to new KMS and password machines based on the unified access protocol of the middleware.

[0090] The data structures of the storage confidentiality and storage integrity components in Table 1, Table 2, and Table 3, the traditional cryptographic evaluation transformation loads the database tables and fields that need to participate in the storage confidentiality and storage integrity through the configuration file, and the modification and adjustment of the fields usually requires a restart to take effect. The cryptographic application middleware of this embodiment can also support the interface to adjust the database tables and fields supported by the storage integrity, and after the adjustment, the storage integrity signature can be recalculated without restarting the application.

[0091] Table 1: util_sec_property secret review property table

[0092]

[0093] Table 2: util_integrity_signature storage integrity signature table

[0094]

[0095] Table 3: util_integrity_exception storage integrity exception record table

[0096]

[0097]

[0098] Reference Figure 2 , shows a flowchart of the steps of using a cryptographic application middleware for connecting to a multi-platform cryptographic service provided in an embodiment of the present invention, which may specifically include the following steps:

[0099] When receiving the operation instruction from the user end of the third-party service, it is intercepted according to the secret rating attribute table of the third-party service database;

[0100] Based on the intercepted data, determine whether the data involves confidentiality storage fields;

[0101] If involved, encryption / decryption is performed based on the information of the specified cloud tool configured in the secret review attribute table.

[0102] In a specific embodiment, when the cryptographic application middleware receives an operation instruction from the user end of the third-party service, this is the starting point of the entire process. These operation instructions may cover various data operations, such as data query, insertion, update or deletion operations, involving the interaction between the third-party service and the cryptographic application middleware.

[0103] The cryptographic application middleware intercepts the operation instructions according to the database secret review attribute table of the third-party service. The secret review attribute table contains various regulations and attribute information for data operations, which are used to filter out operations that require special processing (such as encryption / decryption, integrity verification, etc.). For example, the secret review attribute table stipulates that certain types of data operations or operations related to specific business fields need to be intercepted for further processing.

[0104] In an optional implementation, the above-mentioned method further includes:

[0105] Based on the intercepted data, determine whether the data involves integrity storage fields;

[0106] If involved, after the integrity signature is executed according to the information of the specified cloud tool configured in the confidentiality attribute table, the signature operation record is updated to the uti_inteqrity_siqnsture database table.

[0107] For example, if the confidential storage is a user's bank account, the confidentiality attribute table may specify the use of a specific cloud platform's KMS (key management service) tool and the SM4 symmetric encryption algorithm for encryption operations. When decrypting, the corresponding key and algorithm are used according to the configuration information in the confidentiality attribute table to ensure the confidentiality of the data during storage and transmission.

[0108] In addition to determining the confidentiality storage field, the cryptographic application middleware also needs to determine whether the intercepted data involves the integrity storage field. The integrity storage field is related to the integrity of the data during storage and operation, ensuring that the data has not been tampered with. These fields may be related to business logic, such as order amounts, transaction records and other important data.

[0109] If the integrity storage field is involved, the cryptographic application middleware will perform an integrity signature operation based on the information of the specified cloud tool configured in the cryptographic review attribute table. The integrity signature operation is an operation based on a specific algorithm (such as a hash algorithm) that generates a unique signature value for the data to verify the integrity of the data. Afterwards, the cryptographic application middleware updates the signature operation record to the util_integrity_signature database table. This database table is specifically used to store integrity signature-related records for subsequent integrity verification and other operations.

[0110] In another optional implementation, the above method further includes:

[0111] According to the secret review attribute table in the database table, the integrity storage database table is scanned regularly;

[0112] According to the secret review attribute table, select the information of the specified cloud tool in the secret review attribute table to calculate the signature;

[0113] Determine whether the calculated signature is consistent with the signature in the database table;

[0114] If there is inconsistency, update the exception record to the uti_inteqrity_siqnsture database table.

[0115] Specifically, if the calculated signature is inconsistent with the signature in the database table, this indicates that the integrity of the data may be compromised. At this time, the cryptographic application middleware will update the exception record to the uti_inteqrity_siqnsture database table. This exception record may contain information such as operation time, business fields involved, possible causes, etc., to facilitate subsequent troubleshooting and data repair.

[0116] The method of this embodiment intercepts sensitive data operations of third-party services through the cryptographic application middleware that encapsulates the authentication, signature details, and cryptographic review tools of the mainstream cloud platform KMS and mainstream cryptographic device manufacturers, and encrypts / decrypts the business fields in the sensitive data operations according to the cryptographic review attribute table pre-configured by the third-party service, which can effectively reduce the connection cost between the application layer system in the third-party service and each manufacturer, and reduce the difficulty of modifying the application system functions in the third-party service.

[0117] For the application layer system in the third-party service, since the password application middleware has assumed most of the functions related to the password service, such as data processing according to the password rating attribute table, the application system does not need to undergo large-scale functional transformation. This enables third-party services to more easily adapt to the needs of multi-platform password services and improves the scalability and compatibility of the system.

[0118] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0119] In addition, an embodiment of the present invention further provides an electronic device, such as Figure 4As shown, it includes a processor 1301, a communication interface 1302, a memory 1303 and a communication bus 1304, wherein the processor 1301, the communication interface 1302, and the memory 1303 communicate with each other through the communication bus 1304.

[0120] Memory 1303, used for storing computer programs;

[0121] The processor 1301 is used to implement the following steps when executing the program stored in the memory 1303:

[0122] When receiving the operation instruction from the user end of the third-party service, it is intercepted according to the secret rating attribute table of the third-party service database;

[0123] Based on the intercepted data, determine whether the data involves confidentiality storage fields;

[0124] If involved, encryption / decryption is performed based on the information of the specified cloud tool configured in the secret review attribute table.

[0125] Alternatively, judging whether the data involves an integrity storage field based on the intercepted data;

[0126] If involved, after the integrity signature is executed according to the information of the specified cloud tool configured in the confidentiality attribute table, the signature operation record is updated to the uti_inteqrity_siqnsture database table.

[0127] Alternatively, the integrity storage database table is scanned periodically according to the secret review attribute table in the database table;

[0128] According to the secret review attribute table, select the information of the specified cloud tool in the secret review attribute table to calculate the signature;

[0129] Determine whether the calculated signature is consistent with the signature in the database table;

[0130] If there is inconsistency, update the exception record to the uti_inteqrity_siqnsture database table.

[0131] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0132] The communication interface is used for communication between the above terminal and other devices.

[0133] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0134] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0135] like Figure 5 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 1401 is also provided, in which instructions are stored. When the computer-readable storage medium 1401 is run on a computer, the computer executes the method of using the cryptographic application middleware for connecting to multi-platform cryptographic services described in the above embodiment.

[0136] In another embodiment provided by the present invention, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the method for using the cryptographic application middleware for connecting to multi-platform cryptographic services described in the above embodiment.

[0137] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0138] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0139] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0140] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A cryptographic application middleware for connecting to multi-platform cryptographic services, characterized in that: The middleware is independently deployed and connected to multiple third-party services to decouple the third-party services from connecting to the cryptographic services of each independent national cryptographic algorithm cloud tool, including: KMS general module, used to display at least one encryption method and decryption method that supports the national secret algorithm, and encapsulate the encryption and decryption information of each cloud tool, and call the encryption / decryption service of the corresponding cloud tool according to the information configured by the third-party service and the encryption and decryption information of each cloud tool; Storage confidentiality module, used to intercept sensitive data operations of third-party services and encrypt / decrypt business fields in sensitive data operations according to the confidentiality attribute table pre-configured by the third-party service; The storage integrity module is used to perform signature operations on the business fields according to the sensitive data operations intercepted by the storage confidentiality module and record them in a specified database table according to the confidentiality attribute table.

2. The middleware according to claim 1, characterized in that: The middleware also includes: The elastic scaling module is used to adjust the encryption and decryption resources of the cloud tool according to the frequency and time of sensitive data operations of the third-party service.

3. The middleware according to claim 1, characterized in that: The middleware also includes: The third-party service call interface is used to configure the application system of the third-party service on the local side, to call the third-party service when it is connected to the business, or to configure the secret review attribute table and database table; The data table of the third-party service is used to store the secret review attribute table and database table of the third-party service in the local third-party service application system.

4. The middleware according to claim 1, characterized in that: The encryption and decryption information of each cloud tool encapsulated in the KMS general module includes: KMS authentication information, signature information, encryption tool identifier, and decryption tool identifier.

5. The middleware according to claim 1, characterized in that: The middleware also includes: multiple interfaces for connecting to cloud databases, and interfaces for connecting to KMS and cryptographic machines of multiple cloud tools.

6. A method for using a cryptographic application middleware for connecting to a multi-platform cryptographic service, characterized in that: include: When receiving the operation instruction from the user end of the third-party service, sensitive data is intercepted according to the secret review attribute table of the third-party service; Based on the intercepted data, determine whether the data involves confidentiality storage fields; If involved, encryption / decryption is performed based on the information of the specified cloud tool configured in the secret review attribute table.

7. The method of use according to claim 6, characterized in that: Also includes: Based on the intercepted data, determine whether the data involves integrity storage fields; If involved, after the integrity signature is executed according to the information of the specified cloud tool configured in the confidentiality attribute table, the signature operation record is updated to the uti_inteqrity_siqnsture database table.

8. The method of use according to claim 6, characterized in that: Also includes: According to the secret review attribute table in the database table, the integrity storage database table is scanned regularly; According to the secret review attribute table, select the information of the specified cloud tool in the secret review attribute table to calculate the signature; Determine whether the calculated signature is consistent with the signature in the database table; If there is inconsistency, update the exception record to the uti_inteqrity_siqnsture database table.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 6 to 8 when executing the program stored in the memory.

10. A computer-readable medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 6 to 8.

Images