Algorithm library operation implementation method supporting password card and related device

Abstract

The invention discloses an algorithm library operation implementation method supporting a password card and a related device, an algorithm library is provided with a software algorithm interface and a hardware algorithm interface, the algorithm library calls the software algorithm interface and / or the hardware algorithm interface to complete a preset operation task, the software algorithm interface is in signal connection with a server, and the hardware algorithm interface is in signal connection with the server. A preset operation task is realized in the server through a preset algorithm; the hardware algorithm interface is in signal connection with the password card so as to realize a preset operation task in the password card through a preset algorithm; and the software algorithm interface is compatible with the hardware algorithm interface. Compared with the prior art, the software algorithm interface and the hardware algorithm interface are arranged in the algorithm library at the same time, a user can select a proper use mode according to actual requirements, the software algorithm interface and the hardware algorithm interface are compatible and can collaboratively share loads, the deployment cost is low, and the implementation is easy. And the deployment is more flexible and convenient.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic algorithm libraries, and in particular to a method and a related device for realizing algorithm library operation supporting a cryptographic card. Background Art

[0002] Due to factors such as size and price, password cards cannot be used in all business scenarios. Therefore, it is necessary to develop an algorithm library so that users can choose the appropriate usage method according to actual needs. Summary of the invention

[0003] The purpose of the present invention is to provide an algorithm library operation implementation method and related devices supporting password cards to solve the technical problems in the prior art and allow users to choose a suitable usage method according to actual needs.

[0004] In a first aspect, the present invention provides a method for implementing an algorithm library operation supporting a password card, the method being used to implement a preset operation task, the algorithm library having a software algorithm interface and a hardware algorithm interface, the algorithm library calling the software algorithm interface and / or the hardware algorithm interface to complete the preset operation task, wherein:

[0005] The software algorithm interface is connected to the server signal so as to implement the preset computing task in the server through the preset algorithm;

[0006] The hardware algorithm interface is connected to the password card signal so as to realize the preset calculation task through the preset algorithm in the password card;

[0007] in:

[0008] The software algorithm interface and the hardware algorithm interface are compatible with each other.

[0009] As described above, in the algorithm library operation implementation method supporting the password card, the software algorithm interface and the hardware algorithm interface form the primary interface of the algorithm library, and the algorithm library also has a secondary interface and a tertiary interface. The primary interface, the secondary interface, the tertiary interface, and the password card are connected in sequence by signals, wherein:

[0010] The software algorithm interface is used to receive raw data and use the server to implement the preset computing task using the raw data. The hardware algorithm interface is used to receive raw data and call the secondary interface, pass the raw data to the secondary interface, and encapsulate the output data passed by the secondary interface into a format consistent with the software algorithm interface.

[0011] The secondary interface is used to construct an instruction data packet using the original data and call the tertiary interface to pass the instruction data packet to the tertiary interface, and integrate the operation result of the password card transmitted by the tertiary interface into output data and then transmit it to the hardware algorithm interface;

[0012] The third-level interface is used to transmit the instruction data packet to the password card, and receive the operation result of the password card and then transmit it to the second-level interface.

[0013] As described above, a method for implementing algorithm library operation supporting a password card, wherein preferably, the method comprises the following steps:

[0014] The hardware algorithm interface receives the original data and calls the secondary interface to pass the original data to the secondary interface;

[0015] The secondary interface constructs a command data packet using the original data and calls the tertiary interface, and transmits the command data packet to the tertiary interface;

[0016] The third-level interface transmits the instruction data packet to the password card, and the password card completes the preset calculation task after receiving the instruction data packet, and sends the calculation result to the third-level interface, and the third-level interface sends the calculation result to the second-level interface;

[0017] The secondary interface integrates the operation results into output data and transmits them to the hardware algorithm interface. The hardware algorithm interface adjusts the format of the data to be compatible with the software interface and then outputs it to the user.

[0018] As described above, a method for implementing algorithm library operations that supports password cards, wherein preferably, the hardware algorithm interface includes a hardware internal interface and a hardware external interface, the hardware internal interface uses the key stored inside the password card for operations, and the hardware external interface uses the external key for operations.

[0019] As described above, in a method for implementing algorithm library operations that supports a password card, preferably, when a key needs to be generated or used, the hardware internal interface transmits the index number corresponding to the key to the password card, and the password card reads or stores the key at the location corresponding to the index.

[0020] In the above-mentioned method for implementing the algorithm library operation supporting the password card, preferably, the preset algorithm adopts any one of the following:

[0021] Post-quantum algorithms;

[0022] National secret algorithm;

[0023] International classic algorithm;

[0024] A first hybrid algorithm based on the post-quantum algorithm and the national secret algorithm;

[0025] A second hybrid algorithm based on the post-quantum algorithm and the international classical algorithm;

[0026] A third hybrid algorithm based on the national secret algorithm and the international classical algorithm;

[0027] The fourth hybrid algorithm is based on the post-quantum algorithm, the national secret algorithm and the international classical algorithm.

[0028] A method for implementing algorithm library operations that supports cryptographic cards as described above, wherein, preferably, the national secret algorithm includes one or more of SM1, SM2, SM3, SM4, SM7, SM9 and ZUC, the post-quantum algorithm includes one or more of Kyber and Dilithum, and the international classical algorithm includes one or more of AES, RSA and ECDSA.

[0029] As described above, a method for implementing algorithm library operations that supports a cryptographic card, wherein preferably, the preset operation tasks include at least one of random number generation, key generation, key encapsulation / decapsulation, encryption / decryption, signing / signature verification, and hash value calculation.

[0030] In a second aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned method when executing the computer program.

[0031] In a third aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions for executing the aforementioned method.

[0032] Compared with the prior art, the present invention sets both the software algorithm interface and the hardware algorithm interface in the algorithm library, so that users can choose a suitable usage method according to actual needs, and the software algorithm interface is compatible with the hardware algorithm interface. The software algorithm interface and the hardware algorithm interface can collaborate to share the load, with low deployment cost and more flexible and convenient deployment. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flowchart of one of the operation implementation methods of the algorithm library provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but should not be construed as limiting the present invention.

[0035] In a first aspect, an embodiment of the present invention provides a method for implementing an algorithm library operation supporting a password card, the method being used to implement a preset operation task, the algorithm library comprising a software algorithm interface and a hardware algorithm interface, the algorithm library calling the software algorithm interface and / or the hardware algorithm interface to complete the preset operation task, wherein:

[0036] The software algorithm interface is used to connect to the server signal so as to implement the preset computing tasks through the preset algorithm in the server. The software algorithm interface can implement cryptographic operations through software programs on the general processor of the server (such as CPU). It does not require additional hardware support and can run on any hardware platform that supports the software.

[0037] The hardware algorithm interface is used to connect to the password card signal so as to implement the preset calculation tasks through the preset algorithm in the password card, and use the dedicated hardware of the password card to improve the security and performance of the calculation. Since the cryptographic calculation is performed on dedicated hardware, it can be optimized for specific algorithms, especially when processing complex cryptographic calculations, which can reduce the calculation time and provide faster processing speed.

[0038] in:

[0039] The software algorithm interface and the hardware algorithm interface are compatible with each other, allowing them to collaborate with each other and share the same algorithms and computing tasks, allowing the algorithm library to flexibly select the most appropriate interface under different environments and requirements without changing the preset algorithms or preset computing tasks. Keys and data can be migrated between the software algorithm interface and the hardware algorithm interface without affecting the security and performance of the algorithm library.

[0040] By making the software algorithm interface and the hardware algorithm interface compatible with each other, the software algorithm interface and the hardware algorithm interface can collaborate to share the load, with low deployment cost and more flexible and convenient deployment. Users can switch freely between the software algorithm interface and the hardware algorithm interface as needed to adapt to different performance and security requirements. In scenarios where high performance is required, computationally intensive tasks can be handed over to the hardware external interface for processing, while other tasks can be retained in the software interface. For steps that require higher security, such as signing, they can be executed using the hardware external interface to take advantage of the security features of the hardware. In the absence of hardware acceleration, a lower-cost software interface can be used, and the hardware interface can be reused when needed.

[0041] In the embodiment provided by the present invention, the algorithm library adopts a hierarchical design, having a primary interface, a secondary interface and a tertiary interface, and the primary interface, the secondary interface, the tertiary interface and the password card are connected in sequence by signals, wherein:

[0042] The first-level interface includes the software algorithm interface and the hardware algorithm interface, which together provide users with an entry point for interacting with the algorithm library. The software algorithm interface directly receives the raw data to be processed from the user or other system components, and uses the server to use its general-purpose processor and preset algorithm to use the raw data to implement the preset computing tasks. The hardware algorithm interface is used to receive the raw data and call the second-level interface, pass the raw data to the second-level interface, and encapsulate the output data passed by the second-level interface into a format consistent with the software algorithm interface, ensuring that its format is consistent with the output of the software algorithm interface, so that users can get a consistent experience when using the two interfaces.

[0043] As an abstract layer, the secondary interface hides the specific implementation details of the hardware. In the algorithm library, it serves as a bridge between the primary interface and the tertiary interface, responsible for coordinating the transmission of data and the execution of tasks. The secondary interface uses the original data to construct instruction data packets, which contain all the information required for the password card to perform operations. Once the instruction data packet is constructed, the secondary interface calls the tertiary interface and passes the instruction data packet to the tertiary interface. The tertiary interface is an interface that directly interacts with the password card and is responsible for sending the data packet to the password card. After the password card completes the operation, the secondary interface receives the operation result of the password card from the tertiary interface, integrates the operation result of the password card transmitted by the tertiary interface into output data, and then transmits it to the primary interface, completing the entire operation task process.

[0044] The third-level interface is designed as a universal interface that can support different models and brands of password cards. The role of the third-level interface in the algorithm library is to serve as a bridge for direct interaction with the password card. It is responsible for transferring the instruction data packet from the secondary interface to the password card, and after the password card completes the operation, it passes the result back to the secondary interface. Specifically, the third-level interface receives instruction data packets from the secondary interface, which contain specific operation tasks that the password card needs to perform. The third-level interface communicates with the password card through a hardware communication protocol (such as SPI, I2C, USB, etc.) and sends the instruction data packet to the password card. After the password card executes the operation task in the instruction data packet, the third-level interface is responsible for receiving the operation result and passing the received operation result to the secondary interface.

[0045] In the embodiment provided by the present invention, by designing the algorithm library in layers, it is helpful to provide a user-friendly abstraction layer, while maintaining the flexibility and security of the underlying hardware and software implementation, and helping to improve the maintainability and scalability of the algorithm library. The first-level interface provides users with two mutually compatible entry points for interacting with the algorithm library, namely the software algorithm interface and the hardware algorithm interface. The second-level interface ensures the efficient operation of the algorithm library and provides the necessary error handling and data integration functions, so that the first-level interface can interact smoothly with the password card. The third-level interface ensures the efficient and secure communication between the algorithm library and the password card, and also provides necessary support for the second-level interface.

[0046] In a feasible implementation, the hardware algorithm interface includes a hardware internal interface and a hardware external interface, both of which need to be compatible with the software algorithm interface, and the encapsulation provides a calling method consistent with the software interface to maintain interface consistency.

[0047] The hardware internal interface uses the keys stored inside the password card for calculations. These keys are usually stored in the hardware security module (HSM) of the password card. Since the keys never leave the password card, the risk of the keys being intercepted during transmission is reduced, and the keys are not easily accessed or leaked externally. By reading and storing the keys directly on the password card, a high degree of security is provided. It is suitable for scenarios that require high security, and can reduce data transmission delays and improve overall performance.

[0048] When a key needs to be generated or used, the hardware internal interface only needs to pass the index number corresponding to the password card key, and the password card will read or store the key at the location corresponding to the index. By using the index number to reference the key, the hardware internal interface simplifies the key management and calling process. This method allows the system to access the key through a unique identifier without directly handling the key itself.

[0049] The hardware external interface uses external keys for calculations. These keys may come from software, user input, or other external systems, providing greater flexibility and can be replaced as needed, suitable for scenarios that require flexibility and configurability.

[0050] In a feasible implementation manner, the preset algorithm adopts any of the following:

[0051] Post-quantum algorithms provide quantum-resistant data protection to ensure data security in the quantum computing era, including one or more algorithms in Kyber and Dilithum.

[0052] National secret algorithm refers to the cryptographic algorithm approved by the State Cryptography Administration, including one or more of SM1, SM2, SM3, SM4, SM7, SM9 and ZUC.

[0053] International classic algorithms refer to cryptographic algorithms that are widely used internationally, including one or more of AES, RSA, and ECDSA.

[0054] The first hybrid algorithm based on post-quantum algorithms and national secret algorithms combines post-quantum algorithms and national secret algorithms to provide a more flexible security solution. This hybrid approach can introduce post-quantum algorithms to meet future security challenges while maintaining the compatibility of traditional algorithms.

[0055] The second hybrid algorithm based on post-quantum algorithms and international classical algorithms combines post-quantum algorithms and international classical algorithms to provide a more flexible security solution. This hybrid approach can introduce post-quantum algorithms to meet future security challenges while maintaining the compatibility of traditional algorithms.

[0056] The third hybrid algorithm based on the national secret algorithm and the international classical algorithm combines the national secret algorithm and the international classical algorithm to provide stronger security and flexibility.

[0057] The fourth hybrid algorithm based on post-quantum algorithms, national secret algorithms and international classical algorithms combines post-quantum algorithms, national secret algorithms and international classical algorithms to provide a more flexible security solution. This hybrid approach can introduce post-quantum algorithms to meet future security challenges while maintaining the compatibility of traditional algorithms.

[0058] By designing a variety of preset algorithms, the algorithm library provided by the embodiment of the present invention allows users to select suitable algorithms according to actual needs. Whether it is a traditional national encryption algorithm or an emerging post-quantum algorithm, support can be found in the same algorithm library, providing users with a comprehensive, flexible and forward-looking security solution to protect data from current and future potential threats.

[0059] In the embodiments provided by the present invention, the preset computing tasks include at least one of random number generation, key generation, key encapsulation / decapsulation, encryption / decryption, signing / signature verification, and hash value calculation. Since the software algorithm interface and the hardware algorithm interface are compatible with each other, each preset computing task can be independently implemented by the software algorithm interface and the hardware algorithm interface. Users can flexibly switch between software and hardware solutions according to performance, security or cost requirements.

[0060] For example: Generate a key pair according to the software algorithm interface -> Sign the software algorithm interface -> Verify the software algorithm interface signature. In the process of completing the relevant functions, any one or several steps can be replaced with the hardware external interface to complete the functions normally, such as:

[0061] Hardware algorithm interface generates key pair -> software algorithm interface signature -> software algorithm interface signature verification. Or, software algorithm interface generates key pair -> hardware algorithm interface signature -> software algorithm interface signature verification. Or, hardware algorithm interface generates key pair -> software algorithm interface signature -> hardware algorithm interface signature verification. The above operations are all feasible, and users can choose the interface they use according to actual needs.

[0062] Reference Figure 1As shown, the present invention provides a method for implementing an algorithm library, which is used to implement a preset computing task in a password card through a preset algorithm. The algorithm library includes a primary interface, a secondary interface, and a tertiary interface. The implementation method includes the following steps:

[0063] Step S101: The hardware algorithm interface receives the original data and calls the secondary interface to pass the original data to the secondary interface. Specifically, the hardware algorithm interface is the entry point for the user to interact with the algorithm library. It receives the original data from the user or other systems. After receiving the original data, the hardware algorithm interface calls the secondary interface and passes the original data to it.

[0064] The hardware algorithm interface is used to receive raw data and call the secondary interface, pass the raw data to the secondary interface, and encapsulate the output data passed by the secondary interface into a format consistent with the software algorithm interface, ensuring that its format is consistent with the output of the software algorithm interface, so that users can get a consistent experience when using the two interfaces.

[0065] Step S102: The secondary interface uses the original data to construct a command data packet and calls the third-level interface to pass the command data packet to the third-level interface. Specifically, after receiving the original data, the secondary interface constructs a command data packet according to the requirements of the preset algorithm. These data packets contain all the information required for the password card to perform operations. After the secondary interface constructs the command data packet, it calls the third-level interface and passes the command data packet to it.

[0066] As an abstract layer, the secondary interface hides the specific implementation details of the hardware. In the algorithm library, it serves as a bridge between the primary interface and the tertiary interface, responsible for coordinating data transmission and task execution. The secondary interface uses raw data to build instruction data packets, which contain all the information required for the password card to perform operations. Once the instruction data packet is built, the secondary interface calls the tertiary interface and passes the instruction data packet to the tertiary interface.

[0067] Step S103: the third-level interface transmits the instruction data packet to the password card. After receiving the instruction data packet, the password card completes the preset calculation task and sends the calculation result to the third-level interface. The third-level interface sends the calculation result to the second-level interface.

[0068] The third-level interface is designed as a universal interface that can support different models and brands of password cards. The role of the third-level interface in the algorithm library is to serve as a bridge for direct interaction with the password card. It is responsible for transferring the instruction data packet from the secondary interface to the password card, and after the password card completes the operation, it passes the result back to the secondary interface. Specifically, the third-level interface receives instruction data packets from the secondary interface, which contain specific operation tasks that the password card needs to perform. The third-level interface communicates with the password card through a hardware communication protocol (such as SPI, I2C, USB, etc.) and sends the instruction data packet to the password card. After the password card executes the operation task in the instruction data packet, the third-level interface is responsible for receiving the operation result and passing the received operation result to the secondary interface.

[0069] Step S104: The secondary interface integrates the calculation results into output data and transmits them to the hardware algorithm interface. The hardware algorithm interface adjusts the format of the data to be compatible with the software interface and then outputs it to the user.

[0070] After the password card completes the calculation, the secondary interface receives the calculation result of the password card from the tertiary interface, integrates the calculation result of the password card transmitted by the tertiary interface into output data, and transmits it to the hardware algorithm interface to complete the process of the entire calculation task.

[0071] In a second aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to implement the steps in any one of the above method embodiments.

[0072] Specifically, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0073] Specifically, in this embodiment, the processor may be configured to implement the following steps through a computer program:

[0074] Step S101: the hardware algorithm interface receives the original data and calls the secondary interface to pass the original data to the secondary interface.

[0075] Step S102: the second-level interface constructs an instruction data packet using the original data and calls the third-level interface, and transmits the instruction data packet to the third-level interface.

[0076] Step S103: the third-level interface transmits the instruction data packet to the password card. After receiving the instruction data packet, the password card completes the preset calculation task and sends the calculation result to the third-level interface. The third-level interface sends the calculation result to the second-level interface.

[0077] Step S104: The secondary interface integrates the calculation results into output data and transmits them to the hardware algorithm interface. The hardware algorithm interface adjusts the format of the data to be compatible with the software interface and then outputs it to the user.

[0078] In a third aspect, an embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to implement the steps of any of the above method embodiments when running.

[0079] Specifically, in this embodiment, the above storage medium may be configured to store a computer program for implementing the following steps:

[0080] Step S101: the hardware algorithm interface receives the original data and calls the secondary interface to pass the original data to the secondary interface.

[0081] Step S102: the second-level interface constructs an instruction data packet using the original data and calls the third-level interface, and transmits the instruction data packet to the third-level interface.

[0082] Step S103: the third-level interface transmits the instruction data packet to the password card. After receiving the instruction data packet, the password card completes the preset calculation task and sends the calculation result to the third-level interface. The third-level interface sends the calculation result to the second-level interface.

[0083] Step S104: The secondary interface integrates the calculation results into output data and transmits them to the hardware algorithm interface. The hardware algorithm interface adjusts the format of the data to be compatible with the software interface and then outputs it to the user.

[0084] The above describes in detail the structure, features and effects of the present invention based on the embodiments shown in the drawings. The above is only a preferred embodiment of the present invention, but the present invention is not limited to the scope of implementation shown in the drawings. Any changes made according to the concept of the present invention, or modifications to equivalent embodiments with equivalent changes, which still do not exceed the spirit covered by the description and drawings, should be within the protection scope of the present invention.

Claims

1. A method for implementing algorithm library operations supporting a password card, the method being used to implement a preset operation task, characterized in that: The algorithm library has a software algorithm interface and a hardware algorithm interface, and the algorithm library calls the software algorithm interface and / or the hardware algorithm interface to complete the preset computing task, wherein: The software algorithm interface is connected to the server signal so as to implement the preset computing task in the server through the preset algorithm; The hardware algorithm interface is connected to the password card signal so as to realize the preset calculation task through the preset algorithm in the password card; Wherein: the software algorithm interface and the hardware algorithm interface are compatible with each other.

2. The method according to claim 1, characterized in that: The software algorithm interface and the hardware algorithm interface form a primary interface of the algorithm library, and the algorithm library also has a secondary interface and a tertiary interface. The primary interface, the secondary interface, the tertiary interface, and the password card are connected in sequence by signals, wherein: The software algorithm interface is used to receive raw data and use the server to implement the preset computing task using the raw data. The hardware algorithm interface is used to receive raw data and call the secondary interface, pass the raw data to the secondary interface, and encapsulate the output data passed by the secondary interface into a format consistent with the software algorithm interface. The secondary interface is used to construct an instruction data packet using the original data and call the tertiary interface to pass the instruction data packet to the tertiary interface, and integrate the operation result of the password card transmitted by the tertiary interface into output data and then transmit it to the hardware algorithm interface; The third-level interface is used to transmit the instruction data packet to the password card, and receive the operation result of the password card and then transmit it to the second-level interface.

3. The method according to claim 2, characterized in that: The method comprises the following steps: The hardware algorithm interface receives the original data and calls the secondary interface to pass the original data to the secondary interface; The secondary interface constructs a command data packet using the original data and calls the tertiary interface, and transmits the command data packet to the tertiary interface; The third-level interface transmits the instruction data packet to the password card, and the password card completes the preset calculation task after receiving the instruction data packet, and sends the calculation result to the third-level interface, and the third-level interface sends the calculation result to the second-level interface; The secondary interface integrates the operation results into output data and transmits them to the hardware algorithm interface. The hardware algorithm interface adjusts the format of the data to be compatible with the software interface and then outputs it to the user.

4. The method according to claim 1, characterized in that: The hardware algorithm interface includes a hardware internal interface and a hardware external interface. The hardware internal interface uses the key stored inside the password card to perform calculations, and the hardware external interface uses the external key to perform calculations.

5. The method according to claim 4, characterized in that: When a key needs to be generated or used, the hardware internal interface transmits the index number corresponding to the key to the password card, and the password card reads or stores the key at the location corresponding to the index.

6. The method according to claim 1, characterized in that: The preset algorithm adopts any of the following: Post-quantum algorithms; National secret algorithm; International classic algorithm; A first hybrid algorithm based on the post-quantum algorithm and the national secret algorithm; A second hybrid algorithm based on the post-quantum algorithm and the international classical algorithm; A third hybrid algorithm based on the national secret algorithm and the international classical algorithm; The fourth hybrid algorithm is based on the post-quantum algorithm, the national secret algorithm and the international classical algorithm.

7. The method according to claim 6, characterized in that: The national secret algorithms include one or more of SM1, SM2, SM3, SM4, SM7, SM9 and ZUC, the post-quantum algorithms include one or more of Kyber and Dilithum, and the international classical algorithms include one or more of AES, RSA and ECDSA.

8. The method according to claim 1, characterized in that: The preset computing tasks include at least one of random number generation, key generation, key encapsulation / decapsulation, encryption / decryption, signing / signature verification, and hash value calculation.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores the method for executing any one of claims 1 to 8.

Images