Distributed cryptographic service framework system and cryptographic service processing method

Abstract

This application provides a distributed cryptographic service framework system and a cryptographic service processing method. The distributed cryptographic service framework system includes one or more business applications and a cryptographic service management system. Each business application corresponds to a locally deployed cryptographic service system client and a local cryptographic module. The business application sends a cryptographic service request to the cryptographic service management system. When the validity of identity authentication, authorization scope, and remote verification report is verified, the cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application. The cryptographic service system client stores the authorization policy, and the local cryptographic module retains the cryptographic resources. The local cryptographic module provides cryptographic services to the cryptographic service request. Based on the distributed cryptographic service framework system and cryptographic service processing method provided in this example, the security, flexibility, and scalability of cryptographic services can be improved, as well as resource utilization can be increased, thereby improving the efficiency of cryptographic operations.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to a distributed cryptographic service framework system and a cryptographic service processing method. Background Technology

[0002] With the continuous changes in network service models, more and more business systems are adopting cloud or cloud+distributed deployment methods. Cryptographic services are mainly provided to business systems by connecting cryptographic devices with them.

[0003] In the current network service model, existing technologies mainly connect distributed business systems with centralized cryptographic servers through a unified API interface. The business system sends sensitive data to the cryptographic server, which then performs cryptographic operations on the sensitive data to provide cryptographic services to the business system.

[0004] However, existing technologies, which centralize all cryptographic operations on a single server, may encounter performance bottlenecks, leading to inefficient cryptographic operations. Summary of the Invention

[0005] This application provides a distributed cryptographic service framework system and a cryptographic service processing method, which can improve the efficiency of cryptographic operations.

[0006] In a first aspect, embodiments of this application provide a distributed cryptographic service framework system, characterized in that it includes: one or more business applications and a cryptographic service management system, wherein each business application corresponds to a locally deployed cryptographic service system client and a local cryptographic module;

[0007] Any business application sends a cryptographic service request to the cryptographic service management system;

[0008] The cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service application request;

[0009] If both identity authentication and authorization scope verification pass, the cryptographic service management system determines whether the cryptographic service request requires the local cryptographic module to provide cryptographic services.

[0010] If a local cryptographic module is required to provide cryptographic services, the cryptographic service management system sends a local cryptographic module challenge request to the business application.

[0011] The business application sends the local cryptographic module challenge request to the cryptographic service system client, so that the cryptographic service system client sends the local cryptographic module challenge request to the local cryptographic module;

[0012] The local cryptographic module returns the generated remote proof report to the cryptographic service system client, so that the cryptographic service system client returns the remote proof report to the business application.

[0013] The business application sends the remote proof report to the cryptographic service management system;

[0014] The cryptographic service management system verifies the validity of the remote proof report;

[0015] If the validity of the remote proof report is verified, the cryptographic service management system determines the authorization policy and required cryptographic resources corresponding to the business application.

[0016] The cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application.

[0017] The business application sends the authorization policy and cryptographic resources to the cryptographic service system client, so that the cryptographic service system client saves the authorization policy and forwards the cryptographic resources to the local cryptographic module, so that the local cryptographic module uses the cryptographic resources to perform cryptographic services;

[0018] The business application sends a password service request to the corresponding password service system client;

[0019] The cryptographic service system client invokes the corresponding local cryptographic module based on the authorization policy, so that the local cryptographic module provides cryptographic services to the cryptographic service request.

[0020] In one possible implementation, the cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service request, including:

[0021] The cryptographic service management system obtains the unique user identity carried in the cryptographic service application request;

[0022] The cryptographic service management system verifies the correctness of the unique user identity. If the unique user identity is correct, the cryptographic service management system determines that the identity authentication has passed the verification; otherwise, the cryptographic service management system determines that the identity authentication has failed the verification.

[0023] The password service management system determines the authorization scope corresponding to the business application based on the unique user identity.

[0024] If the cryptographic service request is within the authorized scope, the cryptographic service management system determines that the authorized scope has passed verification; otherwise, the cryptographic service management system determines that the authorized scope has not passed verification.

[0025] In one possible implementation, after the cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service request, it further includes:

[0026] If identity authentication or authorization scope verification fails, the cryptographic service management system rejects the cryptographic service application request.

[0027] In one possible implementation, the cryptographic service management system determines whether the cryptographic service request requires cryptographic services from the local cryptographic module, including:

[0028] The cryptographic service management system obtains the preset specified information from the cryptographic service application request;

[0029] Based on the specified information, the cryptographic service management system determines whether the business application specifies the use of the corresponding local cryptographic module;

[0030] If the business application specifies the use of the corresponding local cryptographic module, the cryptographic service management system determines that the cryptographic service application request requires the local cryptographic module to provide cryptographic services; otherwise, the cryptographic service management system determines that the cryptographic service application request does not require the local cryptographic module to provide cryptographic services.

[0031] In one possible implementation, the remote proof report includes a digital signature;

[0032] Accordingly, the cryptographic service management system verifies the validity of the remote proof report, including:

[0033] The cryptographic service management system verifies the digital signature in the remote proof report;

[0034] If the digital signature in the remote proof report is within its validity period, the cryptographic service management system determines that the remote proof report has passed the validity verification; otherwise, the cryptographic service management system determines that the remote proof report has failed the validity verification.

[0035] In one possible implementation, the cryptographic service management system determines the authorization policy and required cryptographic resources corresponding to the business application, including:

[0036] The cryptographic service management system determines the corresponding authorization policy based on the cryptographic service request from the business application.

[0037] The cryptographic service management system determines the cryptographic resources required for the authorization scope based on the authorization scope corresponding to the business application.

[0038] In one possible implementation, the remote proof report includes a temporary public key;

[0039] Accordingly, the cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application, including:

[0040] The cryptographic service management system signs the authorization policy;

[0041] The cryptographic service management system uses the temporary public key to encrypt the cryptographic resources;

[0042] The cryptographic service management system sends the signed authorization policy and encrypted cryptographic resources to the business application.

[0043] In one possible implementation, the cryptographic service system client invokes the corresponding local cryptographic module based on the authorization policy, including:

[0044] The cryptographic service system client determines whether the cryptographic service request meets the corresponding authorization policy;

[0045] If the cryptographic service request meets the corresponding authorization policy, then the corresponding local cryptographic module is invoked;

[0046] If the cryptographic service request does not meet the corresponding authorization policy, the cryptographic service request will be rejected.

[0047] In one possible implementation, before any business application sends a cryptographic service request to the cryptographic service management system, the method further includes:

[0048] Each of the business applications sends a registration application to the cryptographic service management system, wherein the registration application includes registration information;

[0049] The password service management system determines the unique user identity and authorization scope corresponding to the business application based on the registration information;

[0050] The cryptographic service management system adds the unique user identity and authorization scope corresponding to the business application to the management information to complete the registration of the business application.

[0051] Secondly, this application provides a cryptographic service processing method, which is applied to the distributed cryptographic service framework system described above, and the method includes:

[0052] Any business application sends a cryptographic service request to the cryptographic service management system;

[0053] The cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service application request;

[0054] If both identity authentication and authorization scope verification pass, the cryptographic service management system determines whether the cryptographic service request requires the local cryptographic module to provide cryptographic services.

[0055] If a local cryptographic module is required to provide cryptographic services, the cryptographic service management system sends a local cryptographic module challenge request to the business application.

[0056] The business application sends the local cryptographic module challenge request to the cryptographic service system client, so that the cryptographic service system client sends the local cryptographic module challenge request to the local cryptographic module;

[0057] The local cryptographic module returns the generated remote proof report to the cryptographic service system client, so that the cryptographic service system client returns the remote proof report to the business application.

[0058] The business application sends the remote proof report to the cryptographic service management system;

[0059] The cryptographic service management system verifies the validity of the remote proof report;

[0060] If the validity of the remote proof report is verified, the cryptographic service management system determines the authorization policy and required cryptographic resources corresponding to the business application.

[0061] The cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application.

[0062] The business application sends the authorization policy and cryptographic resources to the cryptographic service system client, so that the cryptographic service system client saves the authorization policy and forwards the cryptographic resources to the local cryptographic module, so that the local cryptographic module uses the cryptographic resources to perform cryptographic services;

[0063] The business application sends a password service request to the corresponding password service system client;

[0064] The cryptographic service system client invokes the corresponding local cryptographic module based on the authorization policy, so that the local cryptographic module provides cryptographic services to the cryptographic service request.

[0065] This application provides a distributed cryptographic service framework system and a cryptographic service processing method. The distributed cryptographic service framework system includes one or more business applications and a cryptographic service management system. Each business application corresponds to a locally deployed cryptographic service system client and a local cryptographic module. The business application sends a cryptographic service request to the cryptographic service management system. The cryptographic service management system performs identity authentication and authorization scope verification. After successful verification, if the business application requires cryptographic services from the local cryptographic module, the cryptographic service management system verifies the validity of the remote proof report of the business application's local cryptographic module. After successful verification, the cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application, enabling the business application's local cryptographic module to provide the corresponding cryptographic service request. This application employs a distributed cryptographic service framework system. By configuring cryptographic resources for the local cryptographic module of the business application and calling the local cryptographic module to provide cryptographic services, it improves the security, flexibility, and scalability of cryptographic services. Furthermore, it optimizes resource configuration and management, enabling dynamic adjustment of cryptographic resource allocation according to business needs, improving resource utilization, and thus increasing cryptographic computation efficiency. Attached Figure Description

[0066] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0067] Figure 1 The distributed cryptographic service framework system provided in this application;

[0068] Figure 2 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 1 ;

[0069] Figure 3 Information interaction flow of a distributed cryptographic service framework system as an example Figure 1 ;

[0070] Figure 4 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 2 ;

[0071] Figure 5 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 3 ;

[0072] Figure 6 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 4 ;

[0073] Figure 7The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 5 ;

[0074] Figure 8 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 6 ;

[0075] Figure 9 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 7 ;

[0076] Figure 10 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 8 ;

[0077] Figure 11 Information interaction flow of a distributed cryptographic service framework system as an example Figure 2 .

[0078] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0079] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0080] First, let me explain the terms used in this application:

[0081] Cryptography refers to the techniques used to encrypt and decrypt information through algorithms and protocols to ensure the confidentiality, integrity, and authenticity of data.

[0082] Distributed systems: Systems composed of multiple independent nodes, capable of resource sharing and collaborative processing, often used in cloud computing and big data processing;

[0083] Local cryptographic module: refers to a cryptographic computing unit deployed on the user's local device or edge device, which can independently perform cryptographic operations, improve security and reduce latency.

[0084] Cryptographic services primarily connect to business systems via dedicated cryptographic devices. This could involve direct connection to the server's cryptographic machine via a network cable, direct connection to a cryptographic card via a high-speed Serial Computer Interconnect Express (PCIe) standard, or direct connection to a USB key via a Universal Serial Bus (USB). However, with the continuous evolution of network service models, more and more information systems are adopting cloud or cloud+distributed deployment methods. In this scenario, a single service may run on multiple hardware devices, and due to the application of virtualization technology, business functions are no longer bound to fixed hardware devices but can run and migrate across different hardware devices.

[0085] In current network service models, a centralized cryptographic service architecture is commonly used. Business applications send sensitive data to a central server for processing, and all cryptographic operation requests are handled by the central server. Furthermore, business applications interact with the central server through standardized Application Programming Interfaces (APIs) to request cryptographic services. Regarding data transmission security, encryption protocols such as Secure Sockets Layer (SSL) / Transport Layer Security (TLS) are used to ensure security during data transmission, but network latency and security vulnerabilities still exist. However, because all cryptographic operations are concentrated on a single server, existing technologies may encounter performance bottlenecks, leading to inefficient cryptographic operations.

[0086] Figure 1 The distributed cryptographic service framework system provided in this application, such as Figure 1As shown, the distributed cryptographic service framework system includes one or more business applications and a cryptographic service management system. Each business application corresponds to a locally deployed cryptographic service system client and a local cryptographic module. The business application sends a cryptographic service request to the cryptographic service management system, which performs identity authentication and authorization scope verification. After successful verification, if the local cryptographic module is required to provide cryptographic services, the cryptographic service management system sends a local cryptographic module challenge request to the business application. The business application then sends the challenge request to the cryptographic service system client, which in turn sends it to the local cryptographic module. The local cryptographic module returns a generated remote proof report to the cryptographic service system client, which in turn returns the report to the business application. The business application then sends the remote proof report to the cryptographic service management system. The cryptographic service management system verifies the validity of the remote proof report. If the verification passes, the system sends the corresponding authorization policy and required cryptographic resources to the business application. The business application then sends the authorization policy to the cryptographic service system client and the authorization policy cryptographic resources to the local cryptographic module. The business application sends a cryptographic service request to the corresponding cryptographic service system client. The cryptographic service system client, based on an authorization policy, invokes the corresponding local cryptographic module, which then provides cryptographic services to the requested application. This application employs a distributed cryptographic service framework system. By configuring cryptographic resources for the local cryptographic module of the business application and invoking the local cryptographic module to provide cryptographic services, it improves the security, flexibility, and scalability of cryptographic services. Furthermore, it optimizes resource configuration and management, enabling dynamic adjustment of cryptographic resource allocation according to business needs, thereby improving resource utilization and cryptographic computation efficiency.

[0087] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0088] Figure 2 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 1 This includes: one or more business applications and a cryptographic service management system, wherein each business application corresponds to a locally deployed cryptographic service system client and a local cryptographic module; such as Figure 2 As shown, the operation flow of the distributed cryptographic service framework system is as follows:

[0089] S201. Any business application sends a cryptographic service application request to the cryptographic service management system.

[0090] Combined with scenario examples, Figure 3 Information interaction flow of a distributed cryptographic service framework system as an example Figure 1 ,like Figure 3 As shown, in the first step, each business application can send a password service request to the password service management system. The password service request can include information used to identify the business application.

[0091] S202, The cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service application request.

[0092] Based on the received cryptographic service request, the cryptographic service management system determines the identity information and authorization scope of the business application, where the authorization scope refers to the range of cryptographic services the business application can use. Simultaneously, it determines the identity information carried in the cryptographic service request and the required cryptographic services. Identity authentication of the cryptographic service request mainly involves determining whether the identity information carried in the request matches the corresponding identity information, while authorization scope verification mainly involves determining whether the cryptographic services required by the request are within the corresponding authorization scope.

[0093] S203. If both identity authentication and authorization scope verification are successful, the cryptographic service management system determines whether the cryptographic service application request requires the local cryptographic module to provide cryptographic services.

[0094] Based on the scenario example, if the identity information carried in the password service request is equal to the corresponding identity information, and the password service required by the password service request is within the corresponding authorization scope, then the identity authentication and authorization scope of the password service request are deemed successful. At this point, it can be determined whether the password service request specifies that a local password module is required to provide password services. The local password module provides password services by encrypting and decrypting relevant data for the business application.

[0095] S204. If a local cryptographic module is required to provide cryptographic services, the cryptographic service management system sends a local cryptographic module challenge request to the business application.

[0096] In step ②, when the local cryptographic module is required to provide cryptographic services, the cryptographic service management system sends a local cryptographic module challenge request to the business application. The local cryptographic module challenge request is a remote proof challenge to the local cryptographic module.

[0097] S205. The business application sends the local cryptographic module challenge request to the cryptographic service system client, so that the cryptographic service system client sends the local cryptographic module challenge request to the local cryptographic module.

[0098] In the scenario example, in steps ③ and ④, the business application receives the challenge request from the local cryptographic module and sends the challenge request to the local cryptographic module through communication between the business application and the cryptographic service system client, and between the cryptographic service system client and the local cryptographic module.

[0099] S206. The local cryptographic module returns the generated remote proof report to the cryptographic service system client, so that the cryptographic service system client returns the remote proof report to the business application.

[0100] In the example scenario, in steps ⑤ and ⑥, after receiving the challenge request from the local cryptographic module, the local cryptographic module generates a corresponding remote proof report and returns it to the business application.

[0101] S207. The business application sends the remote proof report to the cryptographic service management system.

[0102] In step 7, using a scenario example, the business application returns the received remote proof report to the cryptographic service management system.

[0103] S208. The cryptographic service management system verifies the validity of the remote proof report.

[0104] Based on a scenario example, the password service management system verifies the validity of remote reports to determine whether the local password module corresponding to the business application can provide the corresponding password services.

[0105] S209. If the validity of the remote proof report is verified, the cryptographic service management system determines the authorization policy and required cryptographic resources corresponding to the business application.

[0106] Based on the scenario example, if the validity of the remote verification report meets the requirements, it is determined that the local cryptographic module corresponding to the business application can provide the corresponding cryptographic services.

[0107] S210, The cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application.

[0108] In step ⑧, after the validity of the remote proof report is verified, the cryptographic service management system will send the authorization policy related to the encryption and decryption of the data of the business application and the required cryptographic resources to the business application. The cryptographic resources may be computing resources and storage resources required for encryption and decryption operations.

[0109] S211. The business application sends the authorization policy and cryptographic resources to the cryptographic service system client, so that the cryptographic service system client saves the authorization policy and forwards the cryptographic resources to the local cryptographic module, so that the local cryptographic module uses the cryptographic resources to perform cryptographic services.

[0110] In step 9 and step 10, after receiving the authorization policy and the required password resources, the business application sends them to the password service system client. The password service system client retains the authorization policy and forwards the password resources to the local password module.

[0111] S212, The business application sends a cryptographic service request to the corresponding cryptographic service system client.

[0112] Based on the scenario example, after receiving the password resources, the local password module uses those resources to provide password services to the corresponding business applications. Therefore, the business applications can first directly send the password service request to the password service system client.

[0113] S213. The cryptographic service system client calls the corresponding local cryptographic module based on the authorization policy, so that the local cryptographic module provides cryptographic services to the cryptographic service request.

[0114] Based on the scenario example, the password service system client calls the corresponding local password module according to the obtained authorization policy. The local password module responds to the password service request and processes the password service request based on the received password resources to complete the corresponding password service for the business application.

[0115] The method provided in this example can improve the security, flexibility, and scalability of cryptographic services, optimize resource configuration and management, dynamically adjust the allocation of cryptographic resources according to business needs, improve resource utilization, and increase the efficiency of cryptographic operations.

[0116] Optional, Figure 4 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 2 ,like Figure 4 As shown, S202 includes:

[0117] S401, The cryptographic service management system obtains the unique user identity carried in the cryptographic service application request.

[0118] With the help of scenario examples, a unique user identity can be a specific identity identifier, such as an ID card number.

[0119] S402. The cryptographic service management system verifies the correctness of the unique user identity. If the unique user identity is correct, the cryptographic service management system determines that the identity authentication has passed the verification; otherwise, the cryptographic service management system determines that the identity authentication has failed the verification.

[0120] In the scenario example, the unique user identity of a business application is assigned by the password service management system. Therefore, the password service management system can store the unique user identity corresponding to the business application locally. The password service management system compares the unique user identity stored locally with the unique user identity carried in the password service application. If they are equal, the unique user identity carried in the password service application is determined to be correct; if they are not equal, the unique user identity carried in the password service application is determined to be incorrect.

[0121] S403, The password service management system determines the authorization scope corresponding to the business application based on the unique user identity.

[0122] Based on the scenario example, the authorization scope corresponding to the business application is allocated by the password service management system. Therefore, the authorization scope corresponding to the business application can be stored locally in the password service management system. The password service management system can determine the corresponding authorization scope from the local storage based on the unique user identity of the business application.

[0123] S404. If the cryptographic service application request is within the authorized scope, the cryptographic service management system determines that the authorized scope has passed verification; otherwise, the cryptographic service management system determines that the authorized scope has not passed verification.

[0124] Based on the scenario example, the scope of authorization can be the range of authorized content that can be encrypted and decrypted. If the content to be encrypted or decrypted requested by the cryptographic service application is within the authorized range of content that can be encrypted and decrypted, the scope of authorization is verified. If the content to be encrypted or decrypted requested by the cryptographic service application is not within the authorized range of content that can be encrypted and decrypted, the scope of authorization fails to pass the verification.

[0125] Based on the method provided in this example, the identity authentication and authorization scope verification of the cryptographic service application request can be completed.

[0126] Optionally, following S202, the following may also be included:

[0127] If identity authentication or authorization scope verification fails, the cryptographic service management system rejects the cryptographic service application request.

[0128] In the scenario example, if the unique user identity corresponding to the business application stored locally in the password service management system does not match the unique user identity carried in the password service application, or if the encryption / decryption content required by the password service application is not within the authorized scope of content that can be encrypted / decrypted, the password service management system determines that the password service application sent by the business application is non-compliant and can reject the password service application request. Based on the method provided in this example, rejecting non-compliant password service application requests can ensure the security of password services.

[0129] Optional, Figure 5 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 3 ,like Figure 5 As shown, S203 includes:

[0130] S501, The cryptographic service management system obtains the preset specified information in the cryptographic service application request.

[0131] With the example scenario, the specified information represents whether to use the local cryptographic module when the business application sends a cryptographic service request.

[0132] S502. The cryptographic service management system determines, based on the specified information, whether the business application specifies the use of the corresponding local cryptographic module.

[0133] Based on the scenario examples, the specified information can be "yes" or "no". Based on the specified information, it can be determined whether the business application specifies the use of the corresponding local password module.

[0134] S503. If the business application specifies the use of the corresponding local cryptographic module, the cryptographic service management system determines that the cryptographic service application request requires the local cryptographic module to provide cryptographic services; otherwise, the cryptographic service management system determines that the cryptographic service application request does not require the local cryptographic module to provide cryptographic services.

[0135] Based on the scenario example, if the specified information is "Yes", the password service management system determines that a local password module is required; if the specified information is "No", the password service management system determines that a local password module is not required.

[0136] Based on the method provided in this example, it is possible to accurately determine whether a local cryptographic module is needed based on relevant specified information.

[0137] Optional, Figure 6The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 4 The remote proof report includes a digital signature;

[0138] Accordingly, such as Figure 6 As shown, S208 includes:

[0139] S601. The cryptographic service management system verifies the digital signature in the remote proof report.

[0140] With the example scenario, the digital signature is the signature corresponding to the local cryptographic module, which can be used to verify the validity of the digital signature.

[0141] S602. If the digital signature in the remote proof report is within its validity period, the cryptographic service management system determines that the validity of the remote proof report has been verified; otherwise, the cryptographic service management system determines that the validity of the remote proof report has not been verified.

[0142] In the example scenario, the validity period of a digital signature can be a preset time range. If the digital signature is within the preset validity period, it is considered valid, and the verification passes. If the digital signature is outside the preset validity period, it is considered invalid, and the verification fails.

[0143] The method provided in this example can be used to verify the validity of digital signatures.

[0144] Optional, Figure 7 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 5 S209 includes:

[0145] S701. The cryptographic service management system determines the corresponding authorization policy based on the cryptographic service application request of the business application.

[0146] Based on the scenario example, if the validity of the remote proof report is verified, it is determined that the local cryptographic module corresponding to the business application can be uniformly managed by the cryptographic service management system. At this time, the corresponding authorization policy is determined according to the cryptographic service application request sent by the business application.

[0147] S702. The cryptographic service management system determines the cryptographic resources required for the authorization scope based on the authorization scope corresponding to the business application.

[0148] Based on scenario examples, the cryptographic service management system determines the computing and storage resources required by the local cryptographic module corresponding to the business application when performing cryptographic services, and then defines the determined computing and storage resources as the cryptographic resources required by the local cryptographic module corresponding to the business application when performing cryptographic services.

[0149] Based on the method provided in this example, the cryptographic resources required by the local cryptographic module corresponding to the business application to provide cryptographic services can be determined.

[0150] Optionally, the remote proof report includes a temporary public key;

[0151] Accordingly, Figure 8 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 6 ,like Figure 8 As shown, S210 includes:

[0152] S801, The cryptographic service management system signs the authorization policy.

[0153] Based on the scenario example, the authorization policy issued by the password service management system needs to be signed by the password service management system.

[0154] S802, The cryptographic service management system uses the temporary public key to encrypt the cryptographic resources.

[0155] In the scenario example, the remote proof report includes the public key corresponding to the public-private key pair temporarily generated by the local cryptographic module. The cryptographic service management system encrypts the cryptographic resources to be sent to the local cryptographic module before sending them out, using the public key from the remote proof report as the encryption key. After receiving the cryptographic resources, the local cryptographic module can decrypt them using the private key corresponding to the temporarily generated public-private key pair.

[0156] S803, The cryptographic service management system sends the signed authorization policy and encrypted cryptographic resources to the business application.

[0157] Based on the scenario example, the password service management system sends the final authorization policy and password resources to the business application.

[0158] The method provided in this example, which involves signing the authorization policy and encrypting the cryptographic resources, can improve the security of both the authorization policy and the cryptographic resources.

[0159] Figure 9 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 7 ,like Figure 9 As shown, S213 includes:

[0160] S901, The cryptographic service system client determines whether the cryptographic service request meets the corresponding authorization policy.

[0161] Based on the scenario example, after the password service system client obtains the authorization policy and the local password module obtains the password resources, the business application can directly send a password service request to the password service system client. The password service system client determines whether the password service request meets the requirements according to the authorization policy, and thus determines whether the data involved in the password service request that needs to be encrypted or decrypted is within the preset authorization range.

[0162] S902. If the cryptographic service request meets the corresponding authorization policy, then the corresponding local cryptographic module is invoked.

[0163] Based on the scenario example, if the data to be encrypted in the password service request is within the preset authorization range, the password service request is determined to meet the corresponding authorization policy. At this time, the password service system client calls the local password module to process the password service request and performs encryption and decryption processing on the data to be encrypted and decrypted.

[0164] S903. If the cryptographic service request does not meet the corresponding authorization policy, the cryptographic service request is rejected.

[0165] Based on the scenario example, if the data to be encrypted in the password service request is not within the preset authorization scope, the password service request is determined to not meet the corresponding authorization policy. In this case, the password service system client will return the password service request to the business application.

[0166] Based on the method provided in this example, the cryptographic service requests of the corresponding business applications can be processed by directly calling the local cryptographic service, which improves the efficiency of cryptographic operations and reduces the security risks and performance overhead of data transmission.

[0167] Optional, Figure 10 The operational flow diagram of the distributed cryptographic service framework system provided in this application Figure 8 ,like Figure 10 As shown, before S201, it also includes:

[0168] S1001. Any of the business applications sends a registration application to the cryptographic service management system, wherein the registration application includes registration information.

[0169] Combined with scenario examples, Figure 11 Information interaction flow of a distributed cryptographic service framework system as an example Figure 2 Any business application that requires password services must first register with the password service management system, such as... Figure 11 As shown, business applications can send the corresponding registration information to the password service management system. The registration information includes the application name, affiliated organization, business type, expected frequency and scale of password function usage, etc.

[0170] S1002, The password service management system determines the unique user identity and authorization scope corresponding to the business application based on the registration information.

[0171] With a scenario example, the password service management system assigns a specific and unique user identity to the business application that sends registration information, and determines the scope of authorization based on the expected frequency and scale of password function usage in the registration information.

[0172] S1003. The cryptographic service management system adds the unique user identity and authorization scope corresponding to the business application to the management information to complete the registration of the business application.

[0173] Based on the scenario example, after determining the unique user identity and authorization scope corresponding to a business application, the password service management system can return the unique user identity and authorization scope to the business application. This allows the business application to refer to the unique user identity and authorization scope when subsequently sending password service requests. The system also adds the unique user identity and authorization scope corresponding to the business application to the management information, i.e., stores it locally, to complete the registration of the business application.

[0174] The method provided in this example can be used to complete the registration of business applications.

[0175] The cryptographic service processing method provided in this application is applied to a distributed cryptographic service framework system, and the method includes:

[0176] Any business application sends a cryptographic service request to the cryptographic service management system;

[0177] The cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service application request;

[0178] If both identity authentication and authorization scope verification pass, the cryptographic service management system determines whether the cryptographic service request requires the local cryptographic module to provide cryptographic services.

[0179] If a local cryptographic module is required to provide cryptographic services, the cryptographic service management system sends a local cryptographic module challenge request to the business application.

[0180] The business application sends the local cryptographic module challenge request to the cryptographic service system client, so that the cryptographic service system client sends the local cryptographic module challenge request to the local cryptographic module;

[0181] The local cryptographic module returns the generated remote proof report to the cryptographic service system client, so that the cryptographic service system client returns the remote proof report to the business application.

[0182] The business application sends the remote proof report to the cryptographic service management system;

[0183] The cryptographic service management system verifies the validity of the remote proof report;

[0184] If the validity of the remote proof report is verified, the cryptographic service management system determines the authorization policy and required cryptographic resources corresponding to the business application.

[0185] The cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application.

[0186] The business application sends the authorization policy and cryptographic resources to the cryptographic service system client, so that the cryptographic service system client saves the authorization policy and forwards the cryptographic resources to the local cryptographic module, so that the local cryptographic module uses the cryptographic resources to perform cryptographic services;

[0187] The business application sends a password service request to the corresponding password service system client;

[0188] The cryptographic service system client invokes the corresponding local cryptographic module based on the authorization policy, so that the local cryptographic module provides cryptographic services to the cryptographic service request.

[0189] The cryptographic service processing method provided in this embodiment is applied to a distributed cryptographic service framework system and can execute the operation process provided in the distributed cryptographic service framework system embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0190] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A distributed cryptographic service framework system, characterized in that, include: One or more business applications and a cryptographic service management system, wherein each business application corresponds to a locally deployed cryptographic service system client and a local cryptographic module; Any business application sends a cryptographic service request to the cryptographic service management system; The cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service application request; If both identity authentication and authorization scope verification pass, the cryptographic service management system determines whether the cryptographic service request requires the local cryptographic module to provide cryptographic services. If a local cryptographic module is required to provide cryptographic services, the cryptographic service management system sends a local cryptographic module challenge request to the business application. The business application sends the local cryptographic module challenge request to the cryptographic service system client, so that the cryptographic service system client sends the local cryptographic module challenge request to the local cryptographic module; The local cryptographic module returns the generated remote proof report to the cryptographic service system client, so that the cryptographic service system client returns the remote proof report to the business application. The business application sends the remote proof report to the cryptographic service management system; The cryptographic service management system verifies the validity of the remote proof report; If the validity of the remote proof report is verified, the cryptographic service management system determines the authorization policy and required cryptographic resources corresponding to the business application. The cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application. The business application sends the authorization policy and password resources to the password service system client, so that the password service system client saves the authorization policy and forwards the password resources to the local password module, so that the local password module uses the password resources to perform password services; The business application sends a password service request to the corresponding password service system client; The cryptographic service system client invokes the corresponding local cryptographic module based on the authorization policy, so that the local cryptographic module provides cryptographic services to the cryptographic service request.

2. The distributed cryptographic service framework system according to claim 1, characterized in that, The cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service application request, including: The cryptographic service management system obtains the unique user identity carried in the cryptographic service application request; The cryptographic service management system verifies the correctness of the unique user identity. If the unique user identity is correct, the cryptographic service management system determines that the identity authentication has passed the verification; otherwise, the cryptographic service management system determines that the identity authentication has failed the verification. The password service management system determines the authorization scope corresponding to the business application based on the unique user identity. If the cryptographic service request is within the authorized scope, the cryptographic service management system determines that the authorized scope has passed verification; otherwise, the cryptographic service management system determines that the authorized scope has not passed verification.

3. The distributed cryptographic service framework system according to claim 2, characterized in that, After the cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service application request, it further includes: If identity authentication or authorization scope verification fails, the cryptographic service management system rejects the cryptographic service application request.

4. The distributed cryptographic service framework system according to claim 1, characterized in that, The cryptographic service management system determines whether the cryptographic service request requires cryptographic services from the local cryptographic module, including: The cryptographic service management system obtains the preset specified information from the cryptographic service application request; Based on the specified information, the cryptographic service management system determines whether the business application specifies the use of the corresponding local cryptographic module; If the business application specifies the use of the corresponding local cryptographic module, the cryptographic service management system determines that the cryptographic service application request requires the local cryptographic module to provide cryptographic services; otherwise, the cryptographic service management system determines that the cryptographic service application request does not require the local cryptographic module to provide cryptographic services.

5. The distributed cryptographic service framework system according to claim 1, characterized in that, The remote verification report includes a digital signature; Accordingly, the cryptographic service management system verifies the validity of the remote proof report, including: The cryptographic service management system verifies the digital signature in the remote proof report; If the digital signature in the remote proof report is within its validity period, the cryptographic service management system determines that the remote proof report has passed the validity verification; otherwise, the cryptographic service management system determines that the remote proof report has failed the validity verification.

6. The distributed cryptographic service framework system according to claim 1, characterized in that, The cryptographic service management system determines the authorization policy and required cryptographic resources corresponding to the business application, including: The cryptographic service management system determines the corresponding authorization policy based on the cryptographic service request from the business application. The cryptographic service management system determines the cryptographic resources required for the authorization scope based on the authorization scope corresponding to the business application.

7. The distributed cryptographic service framework system according to claim 1, characterized in that, The remote proof report includes a temporary public key; Accordingly, the cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application, including: The cryptographic service management system signs the authorization policy; The cryptographic service management system uses the temporary public key to encrypt the cryptographic resources; The cryptographic service management system sends the signed authorization policy and encrypted cryptographic resources to the business application.

8. The distributed cryptographic service framework system according to claim 1, characterized in that, The cryptographic service system client invokes the corresponding local cryptographic module based on the authorization policy, including: The cryptographic service system client determines whether the cryptographic service request meets the corresponding authorization policy; If the cryptographic service request meets the corresponding authorization policy, then the corresponding local cryptographic module is invoked; If the cryptographic service request does not meet the corresponding authorization policy, the cryptographic service request will be rejected.

9. The distributed cryptographic service framework system according to any one of claims 1-8, characterized in that, Before any of the business applications sends a cryptographic service request to the cryptographic service management system, the method further includes: Each of the business applications sends a registration application to the cryptographic service management system, wherein the registration application includes registration information; The password service management system determines the unique user identity and authorization scope corresponding to the business application based on the registration information; The cryptographic service management system adds the unique user identity and authorization scope corresponding to the business application to the management information to complete the registration of the business application.

10. A cryptographic service processing method, characterized in that, The method is applied to the distributed cryptographic service framework system as described in claim 1, and the method includes: Any business application sends a cryptographic service request to the cryptographic service management system; The cryptographic service management system performs identity authentication and authorization scope verification on the cryptographic service application request; If both identity authentication and authorization scope verification pass, the cryptographic service management system determines whether the cryptographic service request requires the local cryptographic module to provide cryptographic services. If a local cryptographic module is required to provide cryptographic services, the cryptographic service management system sends a local cryptographic module challenge request to the business application. The business application sends the local cryptographic module challenge request to the cryptographic service system client, so that the cryptographic service system client sends the local cryptographic module challenge request to the local cryptographic module; The local cryptographic module returns the generated remote proof report to the cryptographic service system client, so that the cryptographic service system client returns the remote proof report to the business application. The business application sends the remote proof report to the cryptographic service management system; The cryptographic service management system verifies the validity of the remote proof report; If the validity of the remote proof report is verified, the cryptographic service management system determines the authorization policy and required cryptographic resources corresponding to the business application. The cryptographic service management system sends the authorization policy and the required cryptographic resources to the business application. The business application sends the authorization policy and password resources to the password service system client, so that the password service system client saves the authorization policy and forwards the password resources to the local password module, so that the local password module uses the password resources to perform password services; The business application sends a password service request to the corresponding password service system client; The cryptographic service system client invokes the corresponding local cryptographic module based on the authorization policy, so that the local cryptographic module provides cryptographic services to the cryptographic service request.

Images