Password security hardware sharing method and device, electronic equipment and storage medium

Abstract

The invention relates to a password security hardware sharing method and device, electronic equipment and a storage medium, and the method comprises the steps: receiving a call request of an encrypted open source library, and initiating the call request when an application program calls the encrypted open source library based on an operation parameter to execute a target operation; in response to the calling request, calling a target service client according to the configuration file, so as to request a target service server to call password security hardware through the target service client to execute a target operation based on the operation parameter; receiving an operation result returned by the target service client, wherein the operation result is obtained by executing the target operation by the password security hardware and is returned to the target service client through the target service server; and returning an operation result to the application program through the encrypted open source library. According to the scheme, the operation execution part is transferred to the server side by using the client-server side architecture, the server side calls the password security hardware for implementation, the security of the key is protected by using the physical security of the password security hardware, and the security is enhanced.

Description

Technical Field

[0001] The present disclosure relates to the field of encrypted storage technologies, and in particular, to a method, apparatus, electronic device, and storage medium for sharing cryptographic security hardware. Background Art

[0002] OpenSSL is an open-source implementation of the Secure Socket Layer (SSL) protocol, integrating a powerful cryptographic algorithm library. This library covers various main cryptographic algorithms, key management, certificate management, etc., and provides rich Application Programming Interfaces (APIs), facilitating developers to carry out application development, testing, and secure communication implementation.

[0003] Currently, in related technologies, when an application needs to perform operations such as encryption / decryption, signature / verification, etc., it usually relies on the encryption / decryption, signature / verification services provided by the OpenSSL open-source library to implement corresponding operations. In this way, each operation is completed on the host device of the application, and the key is also stored on the host device, presenting security risks. Summary of the Invention

[0004] To solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a method, apparatus, electronic device, and storage medium for sharing cryptographic security hardware.

[0005] In a first aspect, the present disclosure provides a method for sharing cryptographic security hardware, including:

[0006] Receiving a call request for an encryption open-source library, where the call request is initiated when an application calls the encryption open-source library based on operation parameters to perform a target operation;

[0007] In response to the call request, calling a target service client according to a configuration file, so as to request a target service server to call cryptographic security hardware through the target service client to perform the target operation based on the operation parameters;

[0008] Receiving an operation result returned by the target service client, where the operation result is obtained by the cryptographic security hardware performing the target operation and returned to the target service client by the target service server;

[0009] Returning the operation result to the application through the encryption open-source library.

[0010] In a second aspect, the present disclosure provides a device for sharing cryptographic security hardware, including:

[0011] A first receiving module, configured to receive a call request for an encrypted open-source library, where the call request is initiated when an application calls the encrypted open-source library to perform a target operation based on operation parameters;

[0012] A calling module, configured to, in response to the call request, call a target service client according to a configuration file, so as to request a target service server to call a password security hardware through the target service client to perform the target operation based on the operation parameters;

[0013] A second receiving module, configured to receive an operation result returned by the target service client, where the operation result is obtained by the password security hardware performing the target operation and returned to the target service client by the target service server;

[0014] A sending module, configured to return the operation result to the application through the encrypted open-source library.

[0015] In a third aspect, the present disclosure provides an electronic device, including a processor and a memory; the processor is configured to execute the password security hardware sharing method as described in the first aspect by calling a program or instruction stored in the memory.

[0016] In a fourth aspect, the present disclosure provides a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when the computer-executable instructions are executed by a processor, the password security hardware sharing method as described in the first aspect is implemented.

[0017] In a fifth aspect, the present disclosure provides a computer program product, including a computer program, where when the computer program is executed by a processor, the password security hardware sharing method as described in the first aspect is implemented.

[0018] The technical solution provided by the embodiments of the present disclosure has the following advantages compared with the prior art:

[0019] In this solution, a call request for an encrypted open-source library is received. The call request is initiated when the application invokes the encrypted open-source library based on operation parameters to perform a target operation. In response to the call request, a target service client is invoked according to a configuration file, so that the target service server is requested through the target service client to call a password security hardware to perform the target operation based on the operation parameters. An operation result returned by the target service client is received, where the operation result is obtained by the password security hardware performing the target operation and returned to the target service client through the target service server. The operation result is returned to the application through the encrypted open-source library. By adopting the solution of the present disclosure, the operation execution part is transferred to the server side by using a client-server architecture and implemented by the server side calling the password security hardware. The physical security of the password security hardware is used to protect the security of the key, enhancing the security. Moreover, the password security hardware is deployed on the server side instead of the host device of the application, reducing the chance of physical contact with the password security hardware and further improving the security. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings herein are incorporated into the specification and form a part of the specification, showing embodiments consistent with the present disclosure and used together with the specification to explain the principles of the present disclosure.

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the accompanying drawings required for use in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, other accompanying drawings can also be obtained based on these accompanying drawings without creative efforts.

[0022] Figure 1 The principle block diagram of the password security hardware sharing method according to an exemplary embodiment of the present disclosure is shown;

[0023] Figure 2 The flowchart of the password security hardware sharing method provided by an exemplary embodiment of the present disclosure;

[0024] Figure 3 The flowchart of the password security hardware sharing method provided by another exemplary embodiment of the present disclosure;

[0025] Figure 4 The encryption flowchart of the password security hardware sharing method according to an exemplary embodiment of the present disclosure is shown;

[0026] Figure 5 The decryption flowchart of the password security hardware sharing method according to an exemplary embodiment of the present disclosure is shown;

[0027] Figure 6 The signature flowchart of the password security hardware sharing method according to an exemplary embodiment of the present disclosure is shown;

[0028] Figure 7 Shows a schematic diagram of the signature verification process of the password security hardware sharing method according to an exemplary embodiment of the present disclosure;

[0029] Figure 8 Shows a schematic diagram of the key pair generation process of the password security hardware sharing method according to an exemplary embodiment of the present disclosure;

[0030] Figure 9 Is a schematic structural diagram of a password security hardware sharing device provided by an embodiment of the present disclosure. Detailed implementation manners

[0031] In order to be able to more clearly understand the above objects, features and advantages of the present disclosure, the solutions of the present disclosure will be further described below. It should be noted that, without conflict, the embodiments of the present disclosure and the features in the embodiments can be combined with each other.

[0032] Many specific details are set forth in the following description in order to provide a thorough understanding of the present disclosure, but the present disclosure may be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only a part of the embodiments of the present disclosure, rather than all of the embodiments.

[0033] Before explaining the specific implementation manners of the present disclosure, the technologies that the present disclosure may involve are explained as follows:

[0034] OpenSSL is an open-source implementation of the Secure Sockets Layer protocol, integrating a powerful cryptographic algorithm library. It is widely used in secure communication between clients and servers, supports multiple encryption protocols, and ensures the confidentiality and integrity of data transmission. OpenSSL provides an engine mechanism. Through this mechanism, users can encapsulate the encryption and decryption algorithms supported by the hardware as engine interfaces for registration. This mechanism also allows the special functions supported by the hardware to be called through the control (ctrl) interface of the engine, such as accessing data in the secure storage area, locking or unlocking operations of the device, etc. This design enables OpenSSL to flexibly integrate hardware acceleration functions, improving the encryption processing efficiency and data security.

[0035] GmSSL is an open-source library that enhances the Chinese cryptographic standard based on OpenSSL, aiming to support various commercial cryptographic algorithms approved by the State Cryptography Administration of China and provide encryption functions that comply with the Chinese national cryptographic standard (national cryptographic standard).

[0036] An encryption card is a specially designed hardware device used to perform encryption and decryption operations, improving data security and processing efficiency, and is widely used especially in industries with high security requirements. The encryption card realizes encryption operations through hardware acceleration, providing data encryption and decryption functions, digital signature and verification functions, and hash calculation functions; supports key generation, storage, and protection to ensure the privacy and non-disclosure of keys; and usually also provides a hardware-based authentication mechanism for access control and identity identification. Encryption cards are commonly used for the protection of sensitive data, such as in scenarios like financial transactions, e-government, smart grids, and the Internet of Things.

[0037] The implementation manners of the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0038] Figure 1 The principle block diagram of the password security hardware sharing method according to an exemplary embodiment of the present disclosure is shown, as Figure 1 shown, in the client, there are deployed an application program with at least one operation requirement such as encryption, decryption, signature, signature verification (i.e., verifying signatures), key pair generation, an encryption open-source library (such as the OpenSSL open-source library, GmSSL open-source library), an open-source library engine (such as the OpenSSL engine, GmSSL engine), and a service client. The service client obtains services such as encryption, decryption, signature, and signature verification by calling the corresponding service server. The server includes a service server and password security hardware. The service server calls the password security hardware through the password security hardware service API interface provided by the password security hardware to implement the core encryption and decryption parts of encryption, decryption, signature, and signature verification, and provides corresponding services to the client. Thus, the core encryption and decryption parts of encryption, decryption, signature, and signature verification are transferred to the service server in the open-source library engine using the client-server (CS) architecture, reducing the chance of physical contact with the password security hardware, simplifying the deployment and management of the password security hardware, and enhancing the security of key usage; and, by combining the open-source library engine technology and the CS service mode, centralized deployment and distributed use of the password security hardware are realized, the function sharing of the password security hardware is achieved, hardware encryption and decryption can be deployed quickly and flexibly, the management of the password security hardware is facilitated, the physical contact risk of the password security hardware is reduced, and the storage security of the key is further strengthened.

[0039] It should be noted that Figure 1 only one client is taken as an example to explain the present disclosure, and it cannot be used as a limitation to the present disclosure. In actual applications, multiple clients can access the server and communicate with the server to share and use the password security hardware in the server. Among them, the application programs deployed in multiple clients can use different encryption open-source libraries such as the OpenSSL open-source library and GmSSL open-source library to implement functions such as encryption, decryption, and signature.

[0040] As Figure 1 shown, in the password security hardware sharing method of the present disclosure, when an application needs to perform operations such as encryption, decryption, signature, and signature verification using an encryption open-source library, the encryption open-source library performs preprocessing such as padding (padding is optional according to requirements) on the data to be encrypted / signed, and then calls the service client through the registered open-source library engine. The service client then remotely sends a request to the service server through a network interface. The request may include the uniqueness identifier (key identifier) of the key stored in the password security hardware, the account and authentication information for using the key. These information can be pre-configured in the configuration file of the open-source library engine. After the service server authenticates the account and permissions for the requested encryption / decryption / signature service, it calls the key corresponding to the key identifier in the password security hardware to complete the corresponding operation. The operation result is then returned to the application in the order of the password security hardware, the service server, the service client, the open-source library engine, and the encryption open-source library (when the data to be encrypted / signed is padded, the decrypted and signature-verified data returned by the engine needs to be depadded in the encryption open-source library).

[0041] When the application requests the encryption open-source library to generate a key pair, the password security hardware returns the public key in the key pair. After the public key is passed into the encryption open-source library, the encryption open-source library generates a pseudo-private key and the public key to form a pseudo-key pair and returns it to the application. The real private key is stored in the key security hardware. The returned pseudo-key pair is not used in the entire algorithm processing process of this solution. Thus, the information security of the private key is guaranteed.

[0042] In this solution, by using the widely used encryption open-source library as an external interface, it is convenient for application development and docking. It realizes the use of remote password security hardware for encryption and decryption operations without modifying the application that uses the encryption open-source library for encryption and decryption operations, and there is no need to deploy password security hardware on the host device of the application. By using the open-source library engine technology to replace the core encryption / decryption API interface of the encryption open-source library, the core encryption / decryption part of encryption, decryption, signature, and signature verification is transferred to the more secure password security hardware for execution, and the physical security of the password security hardware is used to protect the security of the key.

[0043] Figure 2 is a schematic flowchart of the password security hardware sharing method provided by an exemplary embodiment of the present disclosure. This method can be executed by the password security hardware sharing application device provided by the embodiments of the present disclosure and can be applied to Figure 1 the open-source library engine in

[0044] As Figure 2 shown, the password security hardware sharing method may include the following steps:

[0045] Step 101: Receive a call request for an encrypted open-source library. The call request is initiated when an application calls the encrypted open-source library to perform a target operation based on operation parameters.

[0046] Among them, the encrypted open-source library can be one of open-source libraries such as the OpenSSL open-source library and the GmSSL open-source library.

[0047] In this embodiment, the application refers to a user program for encryption / decryption / signature verification. It depends on the OpenSSL / GmSSL open-source library to implement corresponding functions, and the encrypted open-source library uses engine technology. When any of the applications deployed in multiple clients accessing the server needs to perform operations such as encryption, decryption, signature, signature verification, and key pair generation, it can call the encrypted open-source library based on the corresponding operation parameters to perform the corresponding operations. That is to say, the target operation can be any one of encryption, decryption, signature, signature verification, and key pair generation, and different target operations correspond to different operation parameters. For example, the operation parameter corresponding to the encryption operation is the data to be encrypted, the operation parameter corresponding to the decryption operation is the ciphertext data, the operation parameter corresponding to the signature operation is the data to be signed, the operation parameter corresponding to the signature verification operation is the signature data, and the operation parameter corresponding to the key pair generation operation is the key type.

[0048] When the application calls the encrypted open-source library to perform a target operation, the encrypted open-source library initiates a call request to the corresponding open-source library engine to call the open-source library engine.

[0049] Step 102: In response to the call request, call the target service client according to the configuration file, so as to request the target service server to call the password security hardware to perform the target operation based on the operation parameters through the target service client.

[0050] In this embodiment, after the open-source library engine receives the call request from the encrypted open-source library, in response to the call request, it calls the target service client according to the configuration file. When calling the target service client, it passes the target operation and operation parameters to the target service client.

[0051] Exemplarily, the configuration file may include the client identifier of the service client to be called (referred to as the target service client), and the open-source library engine calls the corresponding target service client according to the client identifier configured in the configuration file.

[0052] In this embodiment, the target service client, in response to the call operation of the open-source library engine, passes the target operation and operation parameters to the service server that interacts with it (referred to as the target service server), and requests the target service server to call the password security hardware to perform the target operation based on the operation parameters.

[0053] Among them, the password security hardware can be, but is not limited to, an encryption card, a smart password key (USB Key, Ukey), or an encryption chip.

[0054] Step 103: Receive the operation result returned by the target service client. The operation result is obtained by the password security hardware executing the target operation and returned to the target service client through the target service server.

[0055] In this embodiment, the password security hardware responds to the request of the target service server, executes the target operation based on the operation parameters to obtain the corresponding operation result, and returns the operation result to the target service server. The target service server then sends it to the target service client, and then the target service client returns it to the open source library engine.

[0056] Step 104: Return the operation result to the application through the encrypted open source library.

[0057] In this embodiment, after the open source library engine receives the operation result returned by the target service client, it returns the operation result to the encrypted open source library, and then the encrypted open source library feeds back the operation result to the application, enabling the application to obtain the corresponding service. For the application, it only needs to call the encrypted open source library to obtain the corresponding operation result. A series of operations such as the encrypted open source library calling the open source library engine and the open source library engine calling the target service client are imperceptible to the application. And through the client-server mode, multiple clients can share and use the same password security hardware imperceptibly based on the encrypted open source library.

[0058] In an alternative embodiment of the present disclosure, the account and authentication information for requesting services can also be configured through a configuration file and passed to the target service server through the target service client. Before calling the password security hardware, the target service server first performs authentication based on the account and authentication information, and manages the authorization of key usage according to the account permissions. After authenticating the account and the corresponding permissions of the account, it then calls the password security hardware to execute the target operation. Thus, the client-server architecture uses user-based authentication and permission control, which facilitates the deployment of fine-grained key usage control, refines the key usage authorization of the password security hardware, and further improves the security of the key.

[0059] The password security hardware sharing method according to an embodiment of the present disclosure receives a call request for an encrypted open-source library, where the call request is initiated when an application calls the encrypted open-source library to perform a target operation based on operation parameters; in response to the call request, a target service client is called according to a configuration file, so as to request the target service server to call the password security hardware to perform the target operation based on the operation parameters through the target service client; the operation result returned by the target service client is received, where the operation result is obtained by the password security hardware performing the target operation and returned to the target service client by the target service server; and the operation result is returned to the application through the encrypted open-source library. By adopting the solution of the present disclosure, the operation execution part is transferred to the server side by using a client-server architecture and implemented by the server side calling the password security hardware. The physical security of the password security hardware is used to protect the security of the key, enhancing the security. Moreover, the password security hardware is deployed on the server side instead of the host device of the application, reducing the chance of the password security hardware being physically contacted and further improving the security.

[0060] In an alternative embodiment of the present disclosure, as Figure 3 shown, on the basis of the foregoing embodiment, step 102 may include the following sub-steps:

[0061] Step 201, in response to the call request, perform initialization based on the configuration file, where the configuration file includes a client identifier of the service client and a key identifier, and the key identifier is used for the password security hardware to determine the key corresponding to the key identifier.

[0062] Exemplarily, the account information, server identifier, and used key identifier of the encryption / decryption / signature verification service may be configured through the configuration file of the open-source library engine using the ctrl interface of the open-source library engine in advance, and these information are written into the configuration file to be passed to the open-source library engine.

[0063] In this embodiment, after the open source library engine receives the call request of the encryption open source library, it is initialized based on the configuration file. Since the cryptographic-related services of the OpenSSL / GmSSL open source library are all implemented through the preprocessing plus basic service model during internal processing, the open source library engine only replaces the basic algorithm functions within the OpenSSL / GmSSL open source library during initialization. This allows the preprocessing of OpenSSL / GmSSL to continue to be used while the core services can be transferred to the cryptographic security hardware. For example, if the basic algorithm function of the encryption open source library uses the RSA algorithm, only init, finish, private_encrypt, private_decrypt, public_encrypt, _public_decrypt, and keygen in the configuration file are replaced; if the SM2 algorithm is used, only init, finish, sign_sig, verify_sig, do_encrypt, do_decrypt, and keygen in the configuration file are replaced. Among them, the init interface is used to initialize the service client before using the key service; finish is used to initialize the service client before releasing the key service. Therefore, by replacing only the basic algorithm functions in the encryption open source library during the initialization of the open source library engine, the precise connection between the open source library engine and the cryptographic security hardware service is conveniently achieved, avoiding the repeated design of the padding service that is already available in the OpenSSL / GmSSL open source library and has no security impact on the use of keys. The cryptographic security hardware usually only needs to provide basic cryptographic services.

[0064] Step 202: Generate an operation request according to the key identifier, target operation and operation parameters.

[0065] In this embodiment, the open source library engine obtains a key identifier from a configuration file, and generates an operation request based on the key identifier and the target operation and operation parameters obtained from the encryption open source library. The operation request carries the key identifier, target operation and operation parameters.

[0066] Step 203: Call the target service client corresponding to the client identifier based on the operation request.

[0067] In this embodiment, the open source library engine can determine the target service client corresponding to the client identifier configured in the configuration file, and then call the target service client based on the operation request. The target service client initiates a request to the target service server based on the received operation request, and the target service server calls the cryptographic security hardware to perform the target operation according to the operation request.

[0068] In the cryptographic security hardware sharing method of the disclosed embodiment, the open source library engine responds to the call request and is initialized based on the configuration file. The configuration file includes the client identifier and key identifier of the service client. The key identifier is used by the cryptographic security hardware to determine the key corresponding to the key identifier, and generates an operation request according to the key identifier, target operation and operation parameters, and then calls the target service client corresponding to the client identifier based on the operation request. Thus, the parameters required for the service are configured through the configuration file of the open source library engine. When the engine is initialized, only the basic algorithm functions of the encryption open source library are replaced. It can continue to use the preprocessing of the encryption open source library and transfer the core services to the cryptographic security hardware, thereby realizing the precise connection between the open source library engine and the cryptographic security hardware service.

[0069] In an optional embodiment of the present disclosure, the application requests encryption of the data to be encrypted, the target operation is encryption, the operation parameters include the data to be encrypted, and the target service server responds to the operation request from the target service client, and calls the cryptographic security hardware based on the key identifier, the target operation and the data to be encrypted, so that the cryptographic security hardware determines the corresponding public key according to the key identifier, and uses the public key to encrypt the data to be encrypted to generate ciphertext, and then returns the ciphertext to the target service server as the operation result.

[0070] Figure 4 The encryption process diagram of the password security hardware sharing method of an exemplary embodiment of the present disclosure is shown, taking the password security hardware as an encryption card as an example. Figure 4 As shown, the plaintext to be encrypted (data to be encrypted) is input into the application. The application calls the open-source encryption library to fill the plaintext (optional operation as needed) and then calls the open-source encryption library to encrypt the filled data. In response to the application's call, the open-source encryption library calls its own open-source library engine to perform encryption. The open-source library engine calls the target service client according to the configuration file. The target service client then sends the filled data to be encrypted, the key identifier, and the account information requesting encryption to the target service server. After verifying the account information, the target service server calls the encryption card interface to encrypt the filled data to generate ciphertext. During encryption, the encryption card uses the public key corresponding to the key identifier to encrypt the data to be encrypted. The encryption card feeds the generated ciphertext back to the target service server, which then sends the ciphertext to the target service client that initiated the request. The target service client returns the received ciphertext to the open-source library engine, which returns the ciphertext to the open-source encryption library. The encryption library then returns the ciphertext to the application requesting encryption, and the application outputs the ciphertext.

[0071] In an optional embodiment of the present disclosure, the application requests decryption of the encrypted ciphertext, the target operation is decryption, the operation parameters include ciphertext data, and the target service server responds to the operation request from the target service client, calls the cryptographic security hardware based on the key identifier, the target operation and the ciphertext data, so that the cryptographic security hardware determines the corresponding private key according to the key identifier, and uses the private key to decrypt the ciphertext data to obtain plaintext data, and returns the plaintext data to the target service server as the operation result.

[0072] Figure 5 A schematic diagram of the decryption process of a password security hardware sharing method according to an exemplary embodiment of the present disclosure is shown, taking the password security hardware as an encryption card as an example. Figure 5 As shown, the ciphertext data to be decrypted is input into the application. The application calls the open-source encryption library for decryption. In response to the application's call, the open-source encryption library further calls its own engine for decryption. The open-source library engine calls the target service client according to the configuration file. The target service client then sends the ciphertext data to be decrypted, the key identifier, and the account information requesting decryption to the target service server. After verifying the account information, the target service server calls the encryption card interface to decrypt the ciphertext data and generate plaintext data. During decryption, the encryption card uses the private key corresponding to the key identifier to decrypt the ciphertext data. The encryption card feeds the generated plaintext data back to the target service server, which then sends the plaintext data to the target service client that initiated the request. The target service client returns the received plaintext data to the open-source library engine, which returns the plaintext data to the open-source encryption library. The open-source encryption library then returns the plaintext data to the application requesting decryption. After receiving the plaintext, the application calls the open-source encryption library to perform a de-padding operation on the plaintext data (optional operation as needed) to obtain the original data and output it.

[0073] In an optional embodiment of the present disclosure, the application requests to sign the data to be signed, then the target operation is a digital signature, and the operation parameters include the data to be signed. In this embodiment, when the encryption open source library receives the call from the application, it first performs a hash calculation on the data to be signed to obtain a hash value, and then uses the hash value as a new operation parameter to initiate a call request to the open source library engine. In response to the call request, the open source library engine generates an operation request based on the key identifier, target operation and hash value, and sends it to the target service server through the target service client. In response to the operation request from the target service client, the target service server calls the cryptographic security hardware based on the key identifier, target operation and hash value, so that the cryptographic security hardware determines the corresponding private key according to the key identifier, and uses the private key to encrypt the hash value, and returns the generated signature data to the target service server as the operation result.

[0074] Figure 6 A schematic diagram of a signature process of a cryptographically secure hardware sharing method according to an exemplary embodiment of the present disclosure is shown, taking the cryptographically secure hardware as an encryption card as an example. Figure 6 As shown, the data to be digitally signed is input into the application. The application then calls the open-source encryption library to hash the data to obtain a hash value. The application then calls the open-source encryption library to pad the resulting hash value. After padding, the library then calls the open-source encryption library to encrypt the padded hash value. The open-source encryption library then calls its own engine to perform encryption based on the padded hash value. The open-source library engine then calls the target service client according to the configuration file. The target service client then sends the padded hash value, key identifier, and account information requesting the signature to the target service server. After verifying the account information, the target service server calls the encryption card interface to encrypt the padded hash value to generate signature data. During encryption, the encryption card uses the private key corresponding to the key identifier to encrypt the padded hash value. The encryption card then feeds the generated signature data back to the target service server, which then sends the signature data to the requesting target service client. The target service client returns the received signature data to the open-source library engine, which then returns the signature data to the open-source encryption library. The encryption library then returns the signature data to the application requesting the signature, and the application then outputs the signature data.

[0075] In an optional embodiment of the present disclosure, the application requests verification of the signature data, the target operation is to verify the signature, the operation parameters include the signature data, and the target service server responds to the operation request from the target service client, and calls the cryptographic security hardware based on the key identifier, the target operation and the signature data, so that the cryptographic security hardware determines the corresponding public key according to the key identifier, and uses the public key to decrypt the signature data, and returns the decrypted signature data obtained by decryption to the target service server as the operation result. After the target service server receives the decrypted signature data, it feeds the decrypted signature data back to the open source library engine through the target service client. After the open source library engine receives the decrypted signature data, it returns the decrypted signature data to the application through the encryption open source library, wherein the application calls the encryption open source library to perform hash calculation on the signature data to obtain a hash value, and compares the hash value with the decrypted signature data to determine the verification result.

[0076] Figure 7 The following is a schematic diagram showing the signature verification process of a cryptographically secure hardware sharing method according to an exemplary embodiment of the present disclosure, taking the cryptographically secure hardware as an encryption card as an example. Figure 7As shown, the signature to be verified is input into the application, which then calls the open-source encryption library for decryption. In response to the application's call, the open-source encryption library further calls its own engine for decryption. The open-source library engine then calls the target service client according to the configuration file. The target service client then sends the signature data to be decrypted, the key identifier, and the account information requesting verification to the target service server. After verifying the account information, the target service server calls the encryption card interface to decrypt the signature data and generate decrypted signature data. During decryption, the encryption card decrypts the signature data using the public key corresponding to the key identifier. The encryption card then feeds the generated decrypted signature data back to the target service server, which then sends the decrypted signature data to the target service client that initiated the request. The target service client returns the received decrypted signature data to the open source library engine, which returns the decrypted signature data to the encryption open source library, which then returns the decrypted signature data to the application requesting decryption. After receiving the decrypted signature data, the application calls the encryption open source library to perform hash calculation on the stored data to be signed (that is, the original data used to obtain the signature data through digital signature) to obtain a hash value, and de-fills the decrypted signature data as needed, compares the de-filled data with the hash value to obtain the signature verification result and outputs it.

[0077] In an alternative embodiment of the present disclosure, when an application requests to generate a key pair, the target operation is to generate a key pair, and the operation parameters include the key type. The key type can be an asymmetric key type such as an RSA key pair or a DSA key pair. The key type can be pre-configured in the application or set / input by the user. The target service server responds to the operation request from the target service client, and calls the cryptographic security hardware based on the key identifier, the target operation, and the key type, so that the cryptographic security hardware determines the public key of the corresponding key pair according to the key identifier and the key type, and returns the public key as the operation result to the target service server. For example, the cryptographic security hardware can store key pairs of different key types in different storage partitions, and each storage partition stores only key pairs of one key type. The cryptographic security hardware can first determine the corresponding storage partition according to the key type, then determine the key pair corresponding to the key identifier from this storage partition, and then obtain the public key of this key pair and return it to the target service server. Then, the target service server feeds back the public key to the open source library engine through the target service client. After receiving the public key returned by the target service client, the open source library engine obtains a random number as the private key (referred to as a pseudo-private key, that is, this private key is not the real private key corresponding to this public key), and forms a pseudo-key pair with this public key and this pseudo-private key, and returns the pseudo-key pair to the application through the encrypted open source library. That is to say, in this embodiment, the key pair generation operation does not really generate a key pair, but requests the public key part of the key pair from the target service server through the network interface. This public key is pre-generated and stored in the cryptographic security hardware, and is obtained according to the key identifier configured in the configuration file of the open source library engine. The custom open source library engine then supplements the forged private key part to generate a pseudo-key pair and returns it to the application through the encrypted open source library.

[0078] Figure 8 FIG. shows a schematic flowchart of generating a key pair in the cryptographic security hardware sharing method according to an exemplary embodiment of the present disclosure. Taking the cryptographic security hardware as an encryption card as an example, as Figure 8As shown in the figure, the application calls an open-source encryption library to generate a key pair. In response to the call from the application, the open-source encryption library further calls its own engine to generate the key pair. The open-source library engine calls the target service client according to the configuration of the configuration file. Then, the target service client sends the information of the requested key pair (such as key identifier, key type) and the account information for requesting the key pair to the target service server. After verifying that the account information is passed, the target service server calls the encryption card interface to obtain the public key part in the key pair. Among them, when the encryption card obtains the key pair, it determines the matching key pair according to the key identifier and key type and then obtains the public key part therein. The target service server sends the public key to the target service client that initiated the request, and the target service client returns the received public key to the open-source library engine. After receiving the public key, the open-source library engine combines the public key and a forged private key into a pseudo key pair and returns it to the open-source encryption library, and the open-source encryption library returns the pseudo key pair to the application, and then the application outputs the pseudo key pair.

[0079] In an optional implementation manner of the present disclosure, the application can initiate encryption / decryption, signature, and signature verification operations based on the obtained pseudo key pair. However, it should be noted that the pseudo key pair is not used in the entire algorithm process, and the public key or private key determined by the cryptographic security hardware according to the key identifier configured in the configuration file of the open-source library engine is actually used, thus ensuring the key security.

[0080] To implement the above embodiments, the present disclosure also provides a cryptographic security hardware sharing application device.

[0081] Figure 9 For the structural schematic diagram of the cryptographic security hardware sharing device provided by an embodiment of the present disclosure, as Figure 9 shown, the cryptographic security hardware sharing device 50 includes: a first receiving module 510, a calling module 520, a second receiving module 530, and a sending module 540.

[0082] Among them, the first receiving module 510 is configured to receive a call request from the open-source encryption library, and the call request is initiated when the application calls the open-source encryption library to execute a target operation based on operation parameters;

[0083] The calling module 520 is configured to, in response to the call request, call the target service client according to the configuration file, so as to request the target service server to call the cryptographic security hardware to execute the target operation based on the operation parameters through the target service client;

[0084] The second receiving module 530 is configured to receive the operation result returned by the target service client, where the operation result is obtained by the cryptographic security hardware executing the target operation and returned to the target service client by the target service server;

[0085] The sending module 540 is used to return the operation result to the application through the encryption open source library.

[0086] Optionally, the calling module 520 is further configured to:

[0087] In response to the call request, initialization is performed based on a configuration file, the configuration file including a client identifier and a key identifier of the service client, the key identifier being used by the cryptographic security hardware to determine a key corresponding to the key identifier;

[0088] Generate an operation request based on the key identifier, target operation and operation parameters;

[0089] The target service client corresponding to the calling client identifier based on the operation request.

[0090] Optionally, the target operation is encryption, and the operation parameters include the data to be encrypted; the target service server responds to the operation request and calls the cryptographic security hardware based on the key identifier, the target operation and the data to be encrypted, so that the cryptographic security hardware determines the corresponding public key according to the key identifier, and uses the public key to encrypt the data to be encrypted to generate ciphertext, and returns the ciphertext to the target service server as the operation result.

[0091] Optionally, the target operation is decryption, and the operation parameters include ciphertext data; the target service server responds to the operation request and calls the cryptographic security hardware based on the key identifier, target operation and ciphertext data, so that the cryptographic security hardware determines the corresponding private key according to the key identifier, and uses the private key to decrypt the ciphertext data to obtain plaintext data, and returns the plaintext data to the target service server as the operation result.

[0092] Optionally, the target operation is a digital signature, and the operation parameters include the data to be signed. When the encryption open source library receives a call from the application, it performs a hash calculation on the data to be signed to obtain a hash value, and uses the hash value as a new operation parameter to initiate a call request to the open source library engine. The call module 520 is also used to generate an operation request based on the key identifier, target operation, and hash value. Then, in response to the operation request, the target service server calls the cryptographic security hardware based on the key identifier, target operation, and hash value, so that the cryptographic security hardware determines the corresponding private key based on the key identifier, encrypts the hash value using the private key, and returns the generated signature data as the operation result to the target service server.

[0093] Optionally, the target operation is to verify a signature, and the operation parameters include signature data; in response to the operation request, the target service server calls the cryptographic security hardware based on the key identifier, the target operation, and the signature data, so that the cryptographic security hardware determines the corresponding public key according to the key identifier, decrypts the signature data using the public key, and returns the decrypted signature data as the operation result to the target service server. After receiving the decrypted signature data, the target service server feeds back the decrypted signature data to the open source library engine through the target service client. The sending module 540 is further configured to: return the decrypted signature data to the application program through the encrypted open source library, where the application program calls the encrypted open source library to perform a hash calculation on the data to be signed to obtain a hash value, and compares the hash value with the decrypted signature data to determine the signature verification result.

[0094] Optionally, the target operation is to generate a key pair, and the operation parameters include the key type; in response to the operation request, the target service server calls the cryptographic security hardware based on the key identifier, the target operation, and the key type, so that the cryptographic security hardware determines the public key of the corresponding key pair according to the key identifier and the key type, and returns the public key as the operation result to the target service server; the target service server feeds back the public key to the open source library engine through the target service client. The sending module 540 is further configured to: obtain a random number as a pseudo private key; form a pseudo key pair with the public key and the pseudo private key; and return the pseudo key pair to the application program through the encrypted open source library.

[0095] The cryptographic security hardware sharing device provided in the embodiments of the present disclosure can execute the cryptographic security hardware sharing method provided in the embodiments of the present disclosure, and has the corresponding functional modules and beneficial effects for executing the method. The content not described in detail in the embodiments of the present disclosure device can be referred to the description in any method embodiment of the present disclosure.

[0096] The embodiments of the present disclosure further provide an electronic device, including a processor and a memory; the processor is configured to execute the steps of the various embodiments of the cryptographic security hardware sharing method as described in the foregoing embodiments by calling the program or instruction stored in the memory. To avoid repeated description, it will not be elaborated here.

[0097] The embodiments of the present disclosure further provide a computer-readable storage medium, which stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the various embodiments of the cryptographic security hardware sharing method as described in the foregoing embodiments are implemented. To avoid repeated description, it will not be elaborated here.

[0098] The embodiments of the present disclosure further provide a computer program product, including a computer program, and when the computer program is executed by a processor, the steps of the various embodiments of the cryptographic security hardware sharing method as described in the foregoing embodiments are implemented. To avoid repeated description, it will not be elaborated here.

[0099] It should be noted that in this document, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprising", "including" or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0100] The above are only specific embodiments of the present disclosure, enabling those skilled in the art to understand or implement the present disclosure. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but rather to the broadest scope consistent with the principles and novel features disclosed herein.

[0101] In addition, although the operations are depicted in a particular order, this should not be construed as requiring that the operations be performed in the particular order shown or in sequential order. In certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although a number of specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the present disclosure. Certain features described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, the various features described in the context of a single embodiment can also be implemented separately or in any suitable sub-combination in multiple embodiments.

[0102] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. On the contrary, the specific features and acts described above are merely example forms of implementing the claims.

Claims

1. A method for sharing cryptographic security hardware, characterized in that, The method comprises: receiving a call request of an encryption open source library, wherein the call request is initiated when an application calls the encryption open source library to perform a target operation based on an operation parameter; In response to the call request, calling the target service client according to the configuration file, so as to request the target service server to call the cryptographic security hardware through the target service client to perform the target operation based on the operation parameters; Receiving an operation result returned by the target service client, wherein the operation result is obtained by the cryptographic security hardware executing the target operation and returned to the target service client through the target service server; The operation result is returned to the application through the encryption open source library.

2. The method according to claim 1, wherein The step of calling the target service client according to the configuration file in response to the calling request includes: In response to the call request, initialization is performed based on the configuration file, the configuration file including a client identifier and a key identifier of the service client, the key identifier being used by the cryptographic security hardware to determine a key corresponding to the key identifier; Generate an operation request according to the key identifier, the target operation and the operation parameters; The target service client corresponding to the client identifier is called based on the operation request.

3. The method according to claim 2, wherein The target operation is encryption, and the operation parameters include data to be encrypted; The target service server responds to the operation request and calls the cryptographic security hardware based on the key identifier, the target operation and the data to be encrypted, so that the cryptographic security hardware determines the corresponding public key according to the key identifier, and uses the public key to encrypt the data to be encrypted to generate ciphertext, and returns the ciphertext to the target service server as the operation result.

4. The method according to claim 2, wherein The target operation is decryption, and the operation parameters include ciphertext data; The target service server responds to the operation request and calls the cryptographic security hardware based on the key identifier, the target operation and the ciphertext data, so that the cryptographic security hardware determines the corresponding private key according to the key identifier, and uses the private key to decrypt the ciphertext data to obtain plaintext data, and returns the plaintext data to the target service server as the operation result.

5. The method according to claim 2, wherein The target operation is digital signature, and the operation parameters include data to be signed; When the encryption open source library receives the call from the application, it performs hash calculation on the data to be signed to obtain a hash value, and uses the hash value as a new operation parameter to initiate the call request to the open source library engine; The open source library engine generates the operation request according to the key identifier, the target operation and the hash value; In response to the operation request, the target service server calls the cryptographic security hardware based on the key identifier, the target operation and the hash value, so that the cryptographic security hardware determines the corresponding private key according to the key identifier, encrypts the hash value using the private key, and returns the generated signature data as the operation result to the target service server.

6. The method according to claim 2, characterized in that, The target operation is to verify the signature, and the operation parameters include signature data; In response to the operation request, the target service server invokes the cryptographic security hardware based on the key identifier, the target operation, and the signature data, so that the cryptographic security hardware determines the corresponding public key according to the key identifier, decrypts the signature data by using the public key, and returns the decrypted signature data as the operation result to the target service server; After receiving the decrypted signature data, the target service server feeds back the decrypted signature data to the open-source library engine through the target service client; Returning the operation result to the application program through the encrypted open-source library includes: Returning the decrypted signature data to the application program through the encrypted open-source library, where the application program invokes the encrypted open-source library to perform a hash calculation on the data to be signed to obtain a hash value, and compares the hash value with the decrypted signature data to determine the signature verification result.

7. The method according to claim 2, wherein The target operation is to generate a key pair, and the operation parameters include the key type; In response to the operation request, the target service server invokes the cryptographic security hardware based on the key identifier, the target operation, and the key type, so that the cryptographic security hardware determines the public key of the corresponding key pair according to the key identifier and the key type, and returns the public key as the operation result to the target service server; The target service server feeds back the public key to the open-source library engine through the target service client; Returning the operation result to the application program through the encrypted open-source library includes: Obtaining a random number as a pseudo-private key; Combining the public key and the pseudo-private key into a pseudo-key pair; Returning the pseudo-key pair to the application program through the encrypted open-source library.

8. A password security hardware sharing device, characterized in that, including: A first receiving module, configured to receive a call request of the encrypted open-source library, where the call request is initiated when the application program invokes the encrypted open-source library to execute a target operation based on operation parameters; An invocation module, configured to, in response to the call request, invoke the target service client according to a configuration file, so as to request the target service server to invoke the cryptographic security hardware to execute the target operation based on the operation parameters through the target service client; A second receiving module, configured to receive the operation result returned by the target service client, where the operation result is obtained by the cryptographic security hardware executing the target operation and returned to the target service client through the target service server; A sending module, configured to return the operation result to the application program through the encrypted open-source library.

9. An electronic device, characterized in that, including a processor and a memory; By invoking the program or instruction stored in the memory, the processor is configured to execute the cryptographic security hardware sharing method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, Computer-executable instructions are stored in the computer-readable storage medium, and when the computer-executable instructions are executed by the processor, the cryptographic security hardware sharing method according to any one of claims 1-7 is implemented.

Images