Sensitive data import and export system and method based on substrate management controller

Abstract

The invention discloses a sensitive data import and export system and method based on a substrate management controller, and relates to the technical field of information security, and the system comprises an encryption algorithm selection module which is used for selecting a target encryption algorithm based on a context-aware intelligent encryption algorithm negotiation strategy; corresponding encryption, decryption and communication operations are carried out through the encryption module, the decryption module and the communication module; the zero-trust adaptation module is used for dynamically adjusting the import and export operation authority based on a zero-trust strategy; the security level of the system is improved through the key management module, the authentication module and the data integrity check module; and the plug-in module is used for loading each module in a plug-in form, and reserving an interface for future algorithm replacement and encryption strategy expansion, so that the technical problems that in the related technology, the export function is limited, complete backup cannot be carried out, the flexible encryption capability is lacked, the client encryption capability and an algorithm negotiation mechanism are lacked, and different encryption compliance requirements are difficult to adapt are solved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a system and method for importing and exporting sensitive data based on a baseboard management controller. Background Art

[0002] The current industry-wide security mechanism uses functional restrictions to achieve data protection. For example, some baseboard management controller (BMC) implementations prohibit the export of configuration files containing user authentication information and block the import of encrypted sensitive data. While this security strategy effectively reduces the risk of data leakage, it creates significant functional conflicts in actual operations and maintenance. This imbalance between security and convenience severely restricts operational efficiency, creating a significant conflict between security management and business needs, especially in scenarios such as large-scale data center automated operations and maintenance, cross-room configuration migration, and rapid reconstruction of disaster recovery systems.

[0003] The existing technical architecture lacks a middleware system with algorithm negotiation capabilities to securely coordinate the transmission and processing of sensitive data between clients and servers. This is specifically manifested in the following three aspects: 1. At the encryption mechanism level, there is a lack of a standardized encryption and decryption protocol framework between the client and the server, which makes it impossible for both ends to establish a unified encryption processing process and difficult to achieve end-to-end secure data exchange.

[0004] 2. At the key management level, the existing solution lacks a dynamic key negotiation and management module and cannot support key functions such as the generation, exchange, and rotation of security keys, which directly restricts the system's ability to process sensitive data.

[0005] 3. At the algorithm selection level, the system lacks a flexible encryption algorithm selection mechanism. It can neither intelligently match symmetric or asymmetric encryption methods according to data types, nor adapt to changing requirements in scenarios with different security levels.

[0006] In the field of BMC configuration management, existing technologies mainly use the following two methods to process sensitive information: 1. Restrict the export of sensitive data: The exported content is processed compulsorily through the preset security policy, that is, when generating the configuration file, sensitive fields are automatically erased or replaced; 2. Static encryption mode: This mode uses a pre-set encryption algorithm to automatically encrypt sensitive fields. However, in this mode, the encryption algorithm and key management policy are fixed in the system firmware. There are no user-configurable encryption parameter options, and the protection strength cannot be dynamically adjusted according to different security requirements.

[0007] In addition, there are widespread security gaps in the configuration import process. Even if users update sensitive information locally, due to the lack of standardized client encryption modules and secure transmission protocols, these key data are often temporarily stored in plain text in the local environment, making the configuration file editing and transmission process a potential attack surface, making it difficult for BMC configuration management to strike a balance between security and functionality.

[0008] Existing BMC configuration import and export methods have the following main defects: 1. Functional integrity defects: Due to mandatory restrictions of security policies, the system cannot completely export configuration files containing sensitive fields, seriously affecting the reliability of system migration and disaster recovery.

[0009] 2. Rigid encryption mechanism: Existing encryption schemes are implemented using pre-fixed algorithms, making it difficult to switch between symmetric encryption, asymmetric encryption, and other strategies based on actual user needs.

[0010] 3. No client-side encryption capability: From user input to server receipt, sensitive data lacks necessary encryption protection measures on the client side, posing a huge risk of data leakage.

[0011] 4. Lack of negotiation mechanism: There is a lack of a negotiation mechanism for encryption algorithms and keys between the client and the server, which makes it impossible to dynamically negotiate encryption and decryption strategies, lacks a secure channel for key exchange, and makes it difficult to ensure version compatibility.

[0012] 5. Lack of security verification: The existing import and export processes cannot verify data integrity and identity authenticity, making it difficult to detect configuration tampering and unable to identify illegal requests, exposing the system to high-risk threats such as man-in-the-middle attacks and data forgery.

[0013] 6. Scalability bottleneck: Existing encryption methods cannot adapt to new encryption algorithms, are difficult to meet regional compliance requirements, and do not support user-customized security policies.

[0014] In summary, the export function of existing technologies is limited, and they cannot perform complete backups. They lack flexible encryption capabilities and client encryption capabilities and algorithm negotiation mechanisms. In addition, existing technologies do not have data integrity and authentication mechanisms, have poor scalability, and are difficult to adapt to different encryption compliance requirements, which urgently need to be resolved. Summary of the Invention

[0015] The present application provides a sensitive data import and export system and method based on a baseboard management controller to at least solve the technical problems in related technologies, such as limited export functions, inability to perform complete backup, lack of flexible encryption capabilities, and lack of client encryption capabilities and algorithm negotiation mechanisms. In addition, the existing technology does not have data integrity and authentication mechanisms, has poor scalability, and is difficult to adapt to different encryption compliance requirements.

[0016] The present application also provides a sensitive data import and export system based on a baseboard management controller, including: an encryption algorithm selection module, configured to collect corresponding context information through a target client and a target server respectively, generate a list of encryption algorithms supported by the target client and the target server according to the context information, score the list of encryption algorithms, perform negotiation and optimal selection operations on the scored list of encryption algorithms to obtain a corresponding target encryption algorithm, and determine a key corresponding to the target encryption algorithm; an encryption module, configured to, in the sensitive data import stage, obtain the original plaintext sensitive data input by a client user, or in the sensitive data export stage, obtain corresponding exported sensitive data from the baseboard management controller of the target server, and encrypt the original plaintext sensitive data or the exported sensitive data by using the target encryption algorithm and the key to obtain corresponding sensitive encrypted data; a decryption module, configured to, in the sensitive data import stage, decrypt the sensitive encrypted data by using the key through the encryption and decryption system of the target server to obtain sensitive decrypted data; a communication module, configured to, in the sensitive data export stage, export the sensitive encrypted data that has passed a preset data integrity verification operation to the target client application, or in the sensitive data import stage, import the sensitive decrypted data that has passed the preset data integrity verification operation into the baseboard management controller of the target server; a zero-trust adaptation module, configured to, in the sensitive data export stage and the sensitive data import stage, perform dynamic identity authentication, real-time policy engine decision-making, session duration verification, and context verification operations based on a preset zero-trust policy to dynamically adjust the import and export operation permissions.

[0017] The present application provides a method for importing and exporting sensitive data based on a baseboard management controller during the sensitive data import phase, including the following steps: sending a configuration import request to the encryption and decryption system of the target client through the target client application, so that the encryption and decryption system of the target client obtains the list of encryption algorithms supported by the target server according to the configuration import request; based on the list of encryption algorithms, performing an encryption algorithm negotiation operation between the encryption and decryption system of the target server and the encryption and decryption system of the target client, so as to determine the corresponding target encryption algorithm and the key corresponding to the target encryption algorithm on the target server; obtaining the plaintext sensitive data input by the client user, and encrypting the plaintext sensitive data by using the target encryption algorithm through the encryption and decryption system of the target client to obtain the corresponding sensitive encrypted data, and performing data integrity verification on the sensitive encrypted data to obtain the sensitive encrypted data that passes the data integrity verification; decrypting the sensitive encrypted data by using the key in the encryption and decryption system of the target server to obtain the corresponding sensitive decrypted data, performing data integrity verification on the sensitive decrypted data, and importing the sensitive decrypted data that passes the data integrity verification into the baseboard management controller of the target server.

[0018] The present application provides a method for importing and exporting sensitive data based on a baseboard management controller during the sensitive data export phase, including the following steps: sending a configuration export request to the encryption and decryption system of the target client through the target client application, so that the encryption and decryption system of the target client obtains the list of encryption algorithms supported by the encryption and decryption system of the target server according to the configuration export request; based on the list of encryption algorithms, performing an encryption algorithm negotiation operation between the encryption and decryption system of the target server and the encryption and decryption system of the target client, so as to determine the corresponding target encryption algorithm and the key corresponding to the target encryption algorithm on the target server; sending a sensitive data request to the baseboard management controller of the target server through the target client application, so that the baseboard management controller obtains the corresponding exported sensitive data and sends the exported sensitive data to the encryption and decryption system of the target server, so as to encrypt the exported sensitive data by using the target encryption algorithm in the encryption and decryption system of the target server, and sending the encrypted exported sensitive data to the encryption and decryption system of the target client; combining the encrypted sensitive data and the preset configuration data in the encryption and decryption system of the target client to obtain the corresponding target configuration information, and exporting the target configuration information to the target client application.

[0019] The present application further provides an electronic device, including: a memory for storing a computer program; a processor for implementing the steps of any one of the above methods for importing and exporting sensitive data based on a baseboard management controller when executing the computer program.

[0020] The present application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned methods for importing and exporting sensitive data based on a baseboard management controller are implemented.

[0021] The present application also provides a computer program product including a computer program, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned methods for importing and exporting sensitive data based on a baseboard management controller are implemented.

[0022] Through the present application, it is possible to allow sensitive data to be securely exported in encrypted form, ensure the integrity of the configuration file and not disclose sensitive information; it can implement local encryption processing of the plaintext input of sensitive fields when the user imports the configuration to ensure transmission security; in addition, the present application designs an encryption and decryption module independent of the BMC system, which is deployed on the client and the server to implement local encryption and remote decryption of data; and an encryption algorithm negotiation mechanism is introduced to support multiple strategies such as symmetric encryption and asymmetric encryption, and users can freely choose; at the same time, the present application provides a key management, authentication and authorization, and data integrity verification module to improve the security level of the overall system; in addition, the present application constructs a standardized communication protocol to ensure secure communication between the encryption and decryption systems of the client and the server, encrypt and verify each step in the data interaction process, and reserve interfaces for future algorithm replacement and encryption strategy expansion, with good scalability and compatibility. Therefore, it can solve the technical problems in the related art, such as limited export function, inability to perform complete backup, lack of flexible encryption ability, lack of client encryption ability and algorithm negotiation mechanism, and in addition, the existing technology does not have a data integrity and authentication mechanism, poor scalability, and difficulty in adapting to different encryption compliance requirements, and achieves the technical effect of overcoming the problem of secure processing of sensitive data in the BMC configuration import and export process, effectively improving the integrity, security and flexibility of configuration management. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] To more clearly illustrate the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0024] Figure 1 FIG. is an example diagram of a system for importing and exporting sensitive data based on a baseboard management controller according to an embodiment of the present application; Figure 2 FIG. is a schematic diagram of the architecture of an encryption algorithm selection module provided by an embodiment of the present application; Figure 3Schematic diagram of an encryption module architecture provided by an embodiment of the present application; Figure 4 Schematic diagram of the cooperation between an encryption module and other modules provided by an embodiment of the present application; Figure 5 Schematic diagram of a decryption module architecture provided by an embodiment of the present application; Figure 6 Schematic diagram of the cooperation between a decryption module and other modules provided by an embodiment of the present application; Figure 7 Schematic diagram of a communication module architecture provided by an embodiment of the present application; Figure 8 Schematic diagram of a key management module architecture provided by an embodiment of the present application; Figure 9 Schematic diagram of the cooperation between a key management module and other modules provided by an embodiment of the present application; Figure 10 Schematic diagram of a data integrity verification module architecture provided by an embodiment of the present application; Figure 11 Schematic diagram of the cooperation between a data integrity verification module and other modules provided by an embodiment of the present application; Figure 12 Schematic diagram of an authentication and authorization module architecture provided by an embodiment of the present application; Figure 13 Schematic diagram of the cooperation between an authentication and authorization module and other modules provided by an embodiment of the present application; Figure 14 Schematic diagram of the overall architecture of a sensitive information encryption and decryption system provided by an embodiment of the present application; Figure 15 Flowchart of a method for importing and exporting sensitive data based on a baseboard management controller applied in the sensitive data import stage provided by an embodiment of the present application; Figure 16 Schematic diagram of the timing for importing sensitive data configuration provided by an embodiment of the present application; Figure 17 Flowchart of a method for importing and exporting sensitive data based on a baseboard management controller applied in the sensitive data export stage provided by an embodiment of the present application; Figure 18 Schematic diagram of the timing for exporting sensitive data configuration provided by an embodiment of the present application.

[0025] Among them, 10 - Sensitive Data Import and Export System Based on Baseboard Management Controller, 100 - Encryption Algorithm Selection Module, 200 - Encryption Module, 300 - Decryption Module, 400 - Communication Module, 500 - Zero Trust Adaptation Module, 600 - Authentication and Authorization Module, 700 - Key Management Module, 800 - Data Integrity Verification Module, 900 - Plug-in Module. Detailed Implementation Manner

[0026] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0027] It should be noted that in the description of the present application, the terms "include", "comprise" or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or device including a series of elements not only includes those elements but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. The terms "first", "second", etc. in the present application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0028] To enable those skilled in the art of this technology to better understand the solution of the present application, the present application will be further described in detail below in conjunction with the accompanying drawings and specific implementation manners.

[0029] Combined with the specific application environment architecture or specific hardware architecture on which the execution of the sensitive data import and export method based on the baseboard management controller depends, the specific application environment architecture or specific hardware architecture is described herein.

[0030] An embodiment of the present application provides a sensitive data import and export system based on a baseboard management controller.

[0031] As Figure 1 shown, it is an example diagram of the sensitive data import and export system based on the baseboard management controller in the embodiment of the present application. Among them, the sensitive data import and export system 10 based on the baseboard management controller includes: an encryption algorithm selection module 100, an encryption module 200, a decryption module 300, a communication module 400, and a zero trust adaptation module 500.

[0032] Among them, the encryption algorithm selection module 100 is used to collect corresponding context information through the target client and the target server respectively, generate a list of encryption algorithms supported by the target client and the target server according to the context information, score the list of encryption algorithms, and perform negotiation and optimal selection operations on the scored list of encryption algorithms to obtain the corresponding target encryption algorithm and determine the key corresponding to the target encryption algorithm.

[0033] In the embodiment of the present application, first, a list of encryption algorithms supported by the server can be obtained, and through the list of encryption algorithms, an encryption algorithm negotiation operation is performed between the server and the client, so as to select a consistent encryption algorithm (i.e., the target encryption algorithm) for the communication between the client and the BMC side, and determine the key corresponding to the target encryption algorithm to ensure the algorithm.

[0034] Specifically, the embodiment of the present application can select a consistent encryption algorithm based on context-aware intelligent encryption algorithm negotiation. The specific process is as follows: 1. Context information collection stage: When establishing an initial connection, the client and the server respectively collect the following real-time environment parameters: (1) Device capabilities: CPU (Central Processing Unit, central processing unit) performance, memory occupancy, hardware acceleration support (such as AES-NI (Advanced Encryption Standard New Instructions, advanced encryption standard new instructions), national cryptography chip); (Two) Network status: current delay, bandwidth stability, packet loss rate; (3) Security policy: compliance requirements (such as GDPR (General Data Protection Regulation, general data protection regulation), equal protection 2.0), data sensitivity level; (4) Threat intelligence: recent attack events against specific algorithms (such as AES (Advanced Encryption Standard, advanced encryption standard) side-channel attack warning).

[0035] These data are exchanged through a lightweight encryption channel to ensure transmission security and integrity.

[0036] 2. Candidate algorithm generation and scoring Based on the collected context information, both parties generate a list of candidate algorithms (i.e., a list of encryption algorithms) respectively and score them in multiple dimensions: (1) Security score: algorithm strength (such as a 256-bit key is better than a 128-bit key), quantum resistance; (2) Performance score: calculation overhead, memory occupancy, network adaptability; (3) Compliance Scoring: Whether it meets the corresponding data compliance requirements.

[0037] 3. Negotiation and Optimal Selection: The client and the server exchange the scored candidate list and reach an agreement through the following steps: (1) Priority Intersection Screening: Select the top 3 algorithms supported by both parties with the highest scores; (2) Environment Adaptation Adjustment: Exclude inapplicable options based on real-time network fluctuations (such as sudden increases in latency); (3) Final Confirmation: Confirm the selected algorithm combination through digital signature to prevent man-in-the-middle tampering.

[0038] If there are disagreements (such as the client prioritizing performance while the server enforcing compliance), then initiate a hierarchical fallback mechanism: First Priority: Solutions that meet all hard requirements (such as compliance); Second Priority: Solutions that optimize the main metrics (such as security or performance); Third Priority: Emergency algorithms that ensure basic communication.

[0039] 4. Dynamic Optimization during Session: Continuously monitor environmental changes during communication and trigger the following adaptive behaviors: (1) When the network deteriorates: Automatically switch to lightweight algorithms; (2) When an attack is detected: Immediately enable anti-quantum temporary algorithms; (3) When device resources are insufficient: Degrade the encryption strength but maintain the minimum security threshold.

[0040] Each adjustment requires re-verifying device integrity and user permissions.

[0041] 5. Termination and Audit: Perform security cleanup when the session ends: (1) Destroy the temporary session key; (2) Record the algorithm usage log (including the reasons for selection and environmental parameters); (3) Generate an encrypted digest for compliance audit.

[0042] Thus, the embodiments of the present application break the fixed priority through multi-factor dynamic weights, adjust the decision weights of security / performance / compliance according to real-time scenarios, can maintain secure communication in scenarios such as network jitter and device degradation, each algorithm selection can trace the decision logic, and at the same time can disguise the algorithm negotiation message as regular business data to resist traffic analysis attacks.

[0043] Optionally, in an embodiment of the present application, the encryption algorithm selection module 100 includes: a policy management unit, an algorithm capability identification unit, a negotiation processing unit, and an interface service unit.

[0044] Among them, the policy management unit is used to dynamically adjust the security level of each encryption algorithm in the encryption algorithm list based on a preset current security policy, and configure the enabling or disabling of the algorithm list.

[0045] The algorithm capability identification unit is used to obtain the encryption algorithm list supported by the target server, and query the enabling or disabling algorithm list to obtain the corresponding algorithm query result.

[0046] The negotiation processing unit is used to send the encryption algorithm list to the target client, and when the target client selects an encryption algorithm from the encryption algorithm list, and based on the algorithm query result and the security level, perform encryption algorithm negotiation on the encryption algorithm to generate a target encryption algorithm.

[0047] The interface service unit is used to output the target encryption algorithm to the encryption module 200, and provide an interface for the encryption algorithm selection module 100, so that the key management module 700 and the communication module 400 can call the encryption algorithm selection module 100.

[0048] During the actual execution process, as Figure 2 shown, the encryption algorithm selection module 100 in the embodiment of the present application is mainly composed of a policy management unit, an algorithm capability identification unit, a negotiation processing unit, and an interface service unit.

[0049] Specifically, the policy management unit in the embodiment of the present application is mainly used to set the default preferred encryption algorithm (such as preferentially using a more secure or faster one) by the user to configure the preferred algorithm, and the system administrator can configure the algorithm enabling or disabling list to prevent the use of insecure algorithms; in addition, the policy management unit also supports policy IDs (auditable / rollback), that is, unique identifiers that identify and distinguish different policies, and can dynamically adjust the algorithm security level.

[0050] The algorithm capability identification unit can obtain the encryption algorithm list supported by the local end (i.e., the client or the server), and query the enabling or disabling algorithms in the system policy. Among them, in the embodiment of the present application, the encryption algorithm list (i.e., various supported encryption algorithms) includes symmetric encryption algorithms (such as AES-128, AES-256, etc.); asymmetric encryption algorithms (such as RSA (Rivest-Shamir-Adleman, asymmetric encryption algorithm), SM2, etc.); hybrid encryption algorithms, such as ECHD (Elliptic Curve Diffie-Hellman, key exchange algorithm) combined with AES (using symmetric encryption after negotiating the key).

[0051] The negotiation processing unit can be used to send the list of encryption algorithms supported by this segment to the peer end, receive the encryption algorithm selected by the peer end, and perform verification on it to confirm the final negotiation result, so as to obtain the target encryption algorithm.

[0052] The interface service unit is used to output the currently selected encryption algorithm (i.e., the target encryption algorithm) to the encryption module 200, and provide the API (Application Programming Interface) of the encryption algorithm selection module 100, so that the subsequent key management module 700 and communication module 400 can call the encryption algorithm selection module 100 to select the encryption path and determine the method of generating and transmitting keys.

[0053] Thus, the embodiment of the present application can select a consistent encryption algorithm between the client and the server by constructing the encryption algorithm selection module 100, effectively ensuring the accuracy and security of encrypting and decrypting sensitive data.

[0054] Optionally, in an embodiment of the present application, the negotiation processing unit is specifically used for: obtaining the target encryption algorithm in the list of encryption algorithms selected by the client user through the front-end interface of the target client application, and sending the target encryption algorithm to the encryption and decryption system of the target client; sending the target encryption algorithm to the encryption and decryption system of the target server through the encryption and decryption system of the target client, so as to judge whether the target server supports the target encryption algorithm through the encryption and decryption system of the target server; if the target server does not support the target encryption algorithm, reselect a new target encryption algorithm from the list of target encryption algorithms through the target client; if the target server supports the target encryption algorithm, determine the type of the target encryption algorithm; when the type of the target encryption algorithm is symmetric encryption, obtain the shared key corresponding to the symmetric encryption through the key management module 700, and generate a confirmation message supporting the target encryption algorithm; when the type of the target encryption algorithm is asymmetric encryption, call the key management module 700 through the encryption and decryption system of the target server to generate a key pair corresponding to the target encryption algorithm, return the public key in the key pair, and generate a confirmation message supporting the target encryption algorithm.

[0055] It should be noted that the process of encrypting algorithm negotiation in the embodiment of the present application is as follows: 1. The client sends an import BMC configuration request or an export BMC configuration request to the locally installed EDS (Encryption-Decryption System) system. 2. After the local EDS system receives the corresponding request, it updates the list of encryption algorithms supported by itself. 3. After the update is completed, the corresponding list of encryption algorithms is returned to the client for it to select. 4. The client user can select an encryption algorithm (i.e., the target encryption algorithm) from the list of encryption algorithms that comply with the current security policy through the front-end interface of the target client application, and send this algorithm to the local EDS. 5. After receiving the encryption algorithm request, the local EDS remotely sends this encryption algorithm to the EDS system on the server side. 6. The server-side EDS system determines whether it supports this encryption algorithm. If it supports this encryption algorithm, it determines the type of this encryption algorithm. When it is a symmetric encryption algorithm type, it can directly return to confirm support for this algorithm. When it is an asymmetric encryption algorithm type, it returns the public key in the key pair and confirms the algorithm. The client will perform subsequent operations after confirmation. If it does not support this encryption algorithm, this embodiment can directly return that this encryption algorithm is not supported and let the client re-select the encryption algorithm. 7. The client receives the algorithm confirmation information and directly performs subsequent operations. If it receives that the algorithm is not supported, it directly repeats the above encryption algorithm negotiation process.

[0056] Thus, the embodiments of the present application can support multiple strategies such as symmetric encryption (such as AES) and asymmetric encryption (such as RSA) by introducing an encryption algorithm negotiation mechanism. Users can freely select and switch between symmetric encryption, asymmetric encryption and other strategies according to their own needs, making the encryption method more flexible, so as to implement the negotiation mechanism of the encryption algorithm and key between the client and the server, and ensure that both parties adopt consistent and compatible encryption and decryption strategies.

[0057] In the actual execution process, those skilled in the art can also perform encryption algorithm negotiation operations in other ways. As a feasible way, the embodiments of the present application can also implement the encryption algorithm negotiation method based on the dynamic environment perception strategy, and the specific process is as follows: 1. Initial capability exchange phase: When the client and the server establish a connection, they first exchange their encryption capability declaration files. This file contains: (1) List of supported encryption algorithms (such as AES-256, SM4, etc.); (2) Hardware acceleration capability (such as whether it supports the AES-NI instruction set); (3) Current device status (CPU load, memory margin, battery power, etc.); (4) Compliance requirements (such as FIPS 140-3, GDPR, etc.); Both parties use digital signatures to ensure the integrity of the file and prevent tampering.

[0058] 2. Environment assessment and candidate algorithm generation: Based on the received capability declarations, the client and the server each execute: (1)Network quality detection: Measure the current round-trip delay, bandwidth, and packet loss rate; (2)Security requirements analysis: Determine the required encryption strength according to the data type (such as payment data, ordinary text); (3)Performance constraint calculation: Combine the device status and exclude algorithms that exceed the computing power load; (4)Subsequently, both parties generate their top 3 candidate algorithm combinations and sort them by priority. For example, AES-256-GCM (high security, medium performance), ChaCha20-Poly1305 (medium security, high performance), SM4-CBC (compliance first, low latency).

[0059] 3. Two-way optimal negotiation: The client and the server exchange the candidate algorithm lists and determine the final selection through a weighted voting mechanism: (1)Security weight (70%): Algorithm strength, key length, authentication method; (2)Performance weight (30%): Encryption speed, memory occupancy, network adaptability; Both parties calculate the comprehensive scores of each candidate algorithm and select the highest score and the mutually supported solution. If there is a tie, an alternative negotiation strategy is enabled (such as preferentially selecting a more energy-efficient algorithm).

[0060] 4. Activation of quantum-secure hybrid mode: After determining the main algorithm, the system detects whether post-quantum cryptography is supported. If both parties support post-quantum cryptography (such as Kyber or Dilithium), a hybrid encryption channel is automatically enabled: 90% of the traffic uses traditional algorithms (such as AES), 10% of the traffic uses post-quantum cryptography algorithms (for test runs), and the stability of the post-quantum cryptography algorithms is regularly evaluated to gradually increase their traffic proportion.

[0061] 5. Dynamic adjustment and emergency switching: During the communication session, continuously monitor: (1)Network environment changes (such as automatically downgrading to ChaCha20 when switching to a mobile network); (2)Security threat detection (such as switching to SM4 when identifying a man-in-the-middle attack); (3)Device status fluctuations (such as disabling high-power-consuming algorithms when the battery is low).

[0062] If the adjustment condition is triggered, both parties quickly switch to the alternative algorithm through a lightweight negotiation protocol to ensure that the communication is not interrupted.

[0063] 6. Session termination and key destruction: At the end of the communication, the temporary session key is immediately destroyed, the algorithm usage log is recorded (for optimizing subsequent negotiations), and a session summary is generated (for auditing purposes).

[0064] Therefore, the embodiment of the present application can dynamically adapt to real-time changes in equipment, network and security requirements by negotiating encryption algorithms based on dynamic environment perception strategies, and ensure the selection of the optimal solution for both parties through weighted voting. Hybrid encryption takes into account both current security and future threats, and the negotiation process is concealed and can support emergency switching.

[0065] The encryption module 200 is used to obtain the original plaintext sensitive data input by the client user during the sensitive data import phase, or to obtain the corresponding exported sensitive data from the baseboard management controller of the target server during the sensitive data export phase, and to encrypt the original plaintext sensitive data or the exported sensitive data using the target encryption algorithm and key to obtain the corresponding sensitive encrypted data.

[0066] Furthermore, the embodiments of the present application can also obtain the original plaintext sensitive data input by the client user through the encryption module 200 during the sensitive data import stage, or obtain the corresponding sensitive data from the baseboard management controller of the server (i.e., export sensitive data) during the sensitive data export stage, and use the target encryption algorithm and key to encrypt the original plaintext sensitive data or all fields marked as "sensitive information" in the exported sensitive data to obtain the corresponding sensitive encrypted data.

[0067] Therefore, the embodiments of the present application can ensure that this information will not be exposed in plain text during transmission or storage; in addition, the encryption module 200 in the embodiments of the present application can also provide a standard encryption interface to the outside world and support multiple encryption algorithms, thereby meeting the encryption needs of users in data import and export scenarios.

[0068] Optionally, in one embodiment of the present application, the encryption module 200 includes: an encryption parameter management unit, an encryption algorithm execution unit, an encryption data packaging unit and a security interface unit.

[0069] Among them, the encryption parameter management unit is used to call the key pair generated by the key management module 700 and manage the algorithm parameters corresponding to the target encryption algorithm.

[0070] The encryption algorithm execution unit is used to obtain the original plaintext sensitive data in the sensitive data import stage, or the exported sensitive data in the sensitive data export stage, and use the target encryption algorithm and key pair to encrypt the original plaintext sensitive data or the sensitive fields in the exported sensitive data to obtain the corresponding sensitive encrypted data.

[0071] The encrypted data packaging unit is used to encapsulate sensitive encrypted data into a unified format structure.

[0072] A security interface unit for providing a standard call interface for the encryption algorithm selection module 100 and the communication module 400 to call the encryption module 200.

[0073] In a specific implementation process, the encryption module 200 of the embodiment of the present application mainly consists of an encryption parameter management unit, an encryption algorithm execution unit, an encrypted data packaging unit, and a security interface unit.

[0074] Specifically, as Figure 3 shown, the security interface unit can provide a standard call interface Encrypt(data) and verify whether the input is legal (such as non-empty, format, etc.).

[0075] The encryption parameter management unit can manage the relevant parameters of the encryption algorithm (such as IV (Initialization Vector), random number, etc.) and can call the subsequent key management module 700 to obtain the key pair or public key corresponding to the encryption algorithm.

[0076] The encryption algorithm execution unit can execute algorithms such as AES, RSA, ECC (Elliptic Curve Cryptography), etc., and receive the current algorithm instruction of the encryption algorithm selection module 100.

[0077] For example, in the sensitive data import stage, when the client user enters sensitive information (such as a password) in the UI (User Interface), the encryption algorithm execution unit of the embodiment of the present application can first receive the corresponding original plaintext sensitive data; secondly, the embodiment of the present application can call the encryption algorithm selection module 100 to determine the encryption method to be used (such as RSA public key encryption); then, the embodiment of the present application can call the key management module 700, as Figure 4 shown, to obtain the public key or symmetric key and IV; finally, the encryption algorithm execution unit can execute the encryption algorithm, that is, encrypt the sensitive field using the selected target encryption algorithm.

[0078] The encrypted data packaging unit can encapsulate the encryption result (i.e., sensitive encrypted data) into a unified format structure, which includes data such as a version number, an algorithm identifier, ciphertext, and a random factor.

[0079] As a feasible implementation, the encrypted data packaging unit in the embodiment of the present application can encapsulate the encryption result into a unified format structure, as shown below: { "alg": "AES-256-CBC", "iv": "randomIV==", "ciphertext": "base64EncodedCipher==", "version": "1.0" } After that, the embodiments of the present application can call the communication module 400, as Figure 4 shown, to transfer the encapsulated sensitive encrypted data to the communication module 400, so that the communication module 400 transmits the packed data to the remote end.

[0080] Thus, the embodiments of the present application allow sensitive data to be securely exported in encrypted form, thereby ensuring the integrity of the configuration file and not disclosing sensitive information, achieving local encryption processing of the plaintext input of sensitive fields when the user imports the configuration, and ensuring transmission security.

[0081] The decryption module 300 is used to decrypt the sensitive encrypted data by using the key through the encryption and decryption system of the target server during the sensitive data import stage to obtain the sensitive decrypted data.

[0082] After that, the decryption module 300 in the embodiments of the present application can securely decrypt the received sensitive encrypted information, restore the sensitive encrypted information to the original plaintext sensitive fields, and output them to the server application (such as BMC) for configuration update.

[0083] In addition, the decryption module 300 in the embodiments of the present application generally exists in pairs with the encryption module 200, and supports the parsing and decryption execution of multiple encryption algorithms, and can ensure key security, integrity verification, and error control at the same time.

[0084] It should be noted that, as Figure 5 shown, the decryption module 300 mainly consists of an encryption format parsing unit, a decryption algorithm execution unit, a decryption parameter management unit, and a decryption interface control unit.

[0085] Among them, the encryption format parsing unit can receive the encapsulated sensitive encrypted data, parse the corresponding encryption algorithm, IV, ciphertext, etc. according to its ciphertext structure, and the encryption format parsing unit supports multiple encapsulation formats such as JSON (JavaScript Object Notation), XML (Extensible Markup Language), and base64.

[0086] The decryption algorithm execution unit can decrypt according to the specified algorithm (such as AES, RSA, etc.) and maintain algorithm compatibility with the encryption module 200.

[0087] The decryption parameter management unit can obtain the private key or symmetric key to verify whether the initialization vector (IV) and the one-time number (Nonce) in asymmetric encryption meet the security requirements.

[0088] The decryption interface control unit provides a unified interface Decrypt(data) externally and verifies whether the input ciphertext structure conforms to the protocol.

[0089] As a feasible implementation, taking the sensitive data import phase as an example, the embodiments of the present application can transmit the encrypted data packet (i.e., sensitive encrypted data) to the server EDS through the client EDS for decryption, so as to update the BMC configuration.

[0090] Specifically, the decryption module 300 of the embodiments of the present application can first receive the ciphertext structure data corresponding to the sensitive encrypted data through the encryption format parsing unit, and the data format is as follows: { "alg": "AES-256-CBC", "iv": "base64IV==", "ciphertext": "Ciphertext content", "version": "1.0" }; Secondly, the embodiments of the present application can use the encryption format parsing unit to read fields such as the algorithm identifier (such as AES-256-CBC (Cipher Block Chaining)) and IV, and parse the above ciphertext structure; again, as Figure 6 shown, the embodiments of the present application can pull the key through the decryption algorithm execution unit, that is, call the subsequent key management module 700 to obtain the corresponding key (symmetric key or private key). If the encryption algorithm is symmetric encryption (such as AES), the pre-distributed key is pulled; if the encryption algorithm is asymmetric encryption (such as RSA), the local private key is pulled.

[0091] Subsequently, the embodiments of the present application can use the decryption algorithm execution unit to select and call the corresponding library for decryption operations according to the encryption algorithm; for AES-CBC, Cipher can be initialized with IV and the key, and then decryption and padding removal are performed to restore the original data.

[0092] After that, as Figure 6As shown, when the decryption module 300 of the present application is linked with the subsequent data integrity verification module 800, the HMAC (Hash-based Message Authentication Code) or verification code of the sensitive encrypted data before decryption can be verified to ensure that it has not been tampered with; finally, the embodiment of the present application can send the plaintext data (i.e., sensitive decrypted data) to the server (such as BMC) after successful decryption to continue with the configuration update.

[0093] Thus, the embodiment of the present application can realize the decryption, integrity verification, and import result feedback of the incoming configuration by the server application, and perform closed-loop processing.

[0094] The communication module 400 is used to export the sensitive encrypted data that has passed the preset data integrity verification operation to the target client application during the sensitive data export phase, or import the sensitive decrypted data that has passed the preset data integrity verification operation to the baseboard management controller of the target server during the sensitive data import phase.

[0095] Furthermore, the embodiment of the present application can also construct the communication module 400 to manage the communication between the local application (such as the client application) and the local EDS (such as the client EDS), and manage the secure data exchange between the local EDS and the remote EDS (such as the server EDS); at the same time, through the cooperation of the communication module 400 with the subsequent authentication and authorization module 600 and data integrity verification module 800, to ensure the security and reliability of the communication and make it have the anti-tampering ability; in addition, the communication module 400 plays a central role in message scheduling and data transmission during the import and export processes.

[0096] Thus, the embodiment of the present application provides reliable technical support for the implementation of sensitive data import and export by constructing the communication module 400.

[0097] Optionally, in an embodiment of the present application, the communication module 400 includes: an interface call unit, a packaging and unpackaging unit, a secure communication management unit, and a protocol negotiation unit.

[0098] Among them, the interface call unit is used to provide corresponding call interfaces to the target client application or the baseboard management controller of the target server to receive corresponding import configuration requests or export configuration requests.

[0099] The packaging and unpackaging unit is used to provide a packaged data packet structure to perform packaging or unpackaging operations on the sensitive encrypted data through the packaged data packet structure.

[0100] The secure communication management unit is used to establish a secure channel with the encryption and decryption system of the target client or the encryption and decryption system of the target server.

[0101] A protocol negotiation unit, which is used to combine with the encryption algorithm selection module 100 to perform corresponding encryption algorithm negotiation operations to obtain corresponding target encryption algorithms.

[0102] It should be noted that the communication module 400 in the embodiments of the present application mainly consists of an interface call unit, a packaging and unpackaging unit, a secure communication management unit, and a protocol negotiation unit, as Figure 7 shown.

[0103] Specifically, the interface call unit can provide corresponding call interfaces to the client application or the server BMC, and receive import configuration requests or export configuration requests.

[0104] The protocol packaging and unpackaging unit provides a packet structure for packaging encrypted data and meta-information into a packet structure supported by the communication module 400, such as {header, algorithm, payload, hash}, etc., and can perform corresponding unpackaging operations.

[0105] The secure communication management unit can establish a secure channel with a remote EDS (such as a server EDS), such as a TLS (Transport Layer Security) / SSH (Secure Shell) secure channel, to prevent man-in-the-middle attacks or session replay, and can dynamically adjust the security level of the encryption algorithm.

[0106] The protocol negotiation unit can cooperate with the encryption algorithm selection module 100 to complete the encryption algorithm negotiation operation and manage the handshake and state machine in the encryption algorithm negotiation stage.

[0107] In the specific implementation process, the communication module 400 constructed by the above units in the embodiments of the present application executes the communication processes of two types: sensitive data import and sensitive data export, as described below: 1. Sensitive data export communication process: (1) Send an export configuration request to the client EDS through the client application; (2) The client EDS negotiates the encryption algorithm with the server EDS to obtain the target encryption algorithm; (3) The server EDS requests sensitive data that needs to be encrypted from the server application (i.e., BMC); (4) Encrypt the sensitive data using the target encryption algorithm in the server EDS and generate an integrity check value; (5) Return the encrypted configuration content (i.e., sensitive encrypted data, etc.) to the server application (BMC) through the server EDS.

[0108] 2. Sensitive data import communication process: (1) The client user can fill in the original plaintext sensitive data in the client application; (2) The client EDS negotiates with the server EDS on the encryption algorithm to obtain the target encryption algorithm and the key corresponding to this algorithm; (3) The client EDS encrypts the original plaintext sensitive data using the target encryption algorithm and generates an integrity check value; (4) The client EDS sends the encrypted data (i.e., sensitive encrypted data) to the server EDS; (5) The server EDS decrypts the sensitive encrypted data using the key to obtain the corresponding sensitive decrypted data, and calls the data integrity verification module 800 to perform integrity verification on the sensitive decrypted data; (6) The server EDS updates the configuration of the server BMC.

[0109] Thus, the embodiments of the present application establish a communication module 400 through the interface call unit, the encapsulation and decapsulation unit, the secure communication management unit, and the protocol negotiation unit to construct a standardized communication protocol, thereby ensuring the secure communication between the client EDS and the server EDS, and encrypting and verifying each step in the data interaction process, effectively guaranteeing the security and reliability of the import and export of sensitive data.

[0110] Optionally, in an embodiment of the present application, the sensitive data import and export system 10 based on the baseboard management controller of the present application embodiment further includes: an authentication and authorization module 600, a key management module 700, a data integrity verification module 800, and a plug-in module 900.

[0111] Among them, the authentication and authorization module 600 is used to perform authentication and authorization operations on the client user or entity accessing the system before importing or exporting sensitive data, so that the client user or entity only performs authorized operations.

[0112] The key management module 700 is used to generate, store, and distribute the key corresponding to the target encryption algorithm.

[0113] The data integrity verification module 800 is used to generate the integrity check value corresponding to the sensitive encrypted data or the sensitive decrypted data, and perform data integrity verification on the sensitive encrypted data or the sensitive decrypted data according to the integrity check value, so as to output the corresponding sensitive encrypted data or the sensitive decrypted data when the sensitive encrypted data or the sensitive decrypted data passes the data integrity verification, otherwise generate and record the data exception information corresponding to the sensitive encrypted data or the sensitive decrypted data.

[0114] The plug-in module 900 is used to load the encryption algorithm selection module 100, the encryption module 200, the decryption module 300, the authentication and authorization module 600, the data integrity verification module 800, and the key management module 700 in the form of plug-ins, and run them in a preset isolation sandbox, and support hot loading or unloading of algorithm plug-ins during the running process.

[0115] In addition, before importing or exporting sensitive data, the embodiments of the present application can also ensure that the client users or entities accessing the system are trustworthy through the authentication and authorization module 600, and can only perform the operations they are authorized to perform; the authentication and authorization operations involved in the authentication and authorization module 600, as the first step of the security defense line of the entire encryption system, must complete authentication and permission verification before importing and exporting sensitive data to prevent security problems such as unauthorized access, spoofing attacks, and permission overstep operations.

[0116] Secondly, the embodiments of the present application can also be responsible for the generation, storage, distribution, rotation, access control, auditing, and destruction of keys in the entire system through the key management module 700. Both symmetric and asymmetric keys can be uniformly managed, and provide key support for the encryption module 200 and the decryption module 300.

[0117] After that, the embodiments of the present application can also construct a data integrity verification module 800 to detect whether sensitive data is tampered with or damaged during network transmission or storage, and prevent man-in-the-middle attacks, data tampering, or unexpected error codes; at the same time, the data integrity verification module 800 can also cooperate with the authentication and authorization module 600 and the key management module 700 to ensure that the data comes from a trusted party and has not been changed.

[0118] Furthermore, those skilled in the art should understand that the encryption / integrity algorithms of existing import / export solutions are basically hard-coded, which is difficult to support subsequent customer-customized algorithms and lacks scalability. Therefore, the embodiments of the present application can construct a plug-in module to establish a modular and plug-in algorithm management framework, so as to support the loading of encryption, decryption, integrity, and authentication algorithms in the form of plug-ins, as well as hot loading or unloading of algorithm plug-ins during runtime, and can provide a standardized plug-in interface specification for facilitating third-party development and extension of plug-ins; at the same time, the plug-ins can run in an isolation sandbox to prevent affecting the stability of the main system.

[0119] Thus, the embodiments of the present application enhance the security level of the overall system by providing the key management module 700, the authentication and authorization module 600, and the data integrity verification module 800, and can further enhance the security and adaptability of the system through the plug-in module 900.

[0120] Optionally, in an embodiment of the present application, the key management module 700 includes: a key generator, a key memory, a key negotiator, a key rotator, an access controller, an audit recorder, and a key destroyer.

[0121] Among them, the key generator is used to determine the symmetric key or asymmetric key corresponding to the target encryption algorithm according to the type of the target encryption algorithm, and automatically generate a key pair corresponding to the symmetric key or asymmetric key.

[0122] The key memory is used to store the key pair based on a preset key security access policy.

[0123] The key negotiator is used to perform a key negotiation operation between the target client and the target server to generate a corresponding shared key.

[0124] The key rotator is used to switch the key pair based on a preset rotation period.

[0125] The access controller is used to manage the usage permissions of the key pair.

[0126] The audit recorder is used to record the operation data corresponding to all operation behaviors corresponding to the key pair.

[0127] The key destroyer is used to destroy the key pair, generate a corresponding destruction record, and save the destruction record in the audit recorder.

[0128] It should be noted that, as Figure 8 shown, the key management module 700 in the embodiment of the present application mainly includes multiple components such as a key generator, a key memory, a key negotiator, a key rotator, an access controller, an audit recorder, and a key destroyer.

[0129] Specifically, the main functions of each component are as follows: 1. The key generator mainly has the following functions: (1) Symmetric key support: 1) Support AES-128 / 192 / 256; 2) Use CSPRNG (Cryptographically Secure Pseudo-Random Number Generator, secure random number generator) to generate keys.

[0130] (2) Asymmetric key support: 1) Support RSA (2048 / 3072 / 4096 bits), ECC (P-256, P-384).

[0131] (3) Automatically generate a public-private key pair; (4) Configuration interface: 1) The client user can specify the algorithm type, key length, and whether to export the public key.

[0132] 2. The key storage can achieve local secure storage (file encryption storage can be used) and key encrypted storage (the service key can be wrapped with the master key), and support tagged key access, such as obtaining the key according to the key_id.

[0133] 3. The key negotiator is mainly used to negotiate the shared key (mainly the symmetric key) between the client and the server, as described below: (1) Algorithm support: 1) Diffie-Hellman (key exchange protocol / algorithm, DH) / Elliptic Curve DH (ECDH, elliptic curve Diffie-Hellman key exchange); 2) TLS (Transport Layer Security) 1.3 Pre-Shared Key (PSK) mode.

[0134] (2) Negotiation steps: 1) The client and the server negotiate the key algorithm; 2) Both parties generate key materials (i.e., public key exchange); 3) Generate the shared key for subsequent encrypted communication.

[0135] 4. The key rotator can support the life cycle management of keys and can perform the following functions: (1) Automatic rotation: 1) Based on time: rotate every 30 days, for example; 2) Based on the number of uses: rotate after encrypting N times, for example.

[0136] (2) Manual rotation: 1) Triggered through the management API or interface.

[0137] 5. The access controller is mainly used to manage the usage permissions of keys and can perform operations such as role division and permission authentication mechanism, as described below: (1) Role division: 1) Administrator (generate, delete, export); 2) Application program (for encryption and decryption use).

[0138] (2) Permission authentication mechanism: Such as Figure 9As shown, the embodiments of the present application can invoke the token / session / certificate authentication provided by the authentication and authorization module 600 to confirm the legitimacy of the operator, and can distribute the corresponding keys to the encryption module 200, the decryption module 300, and the communication module 400. The specific policies are as follows: rules: - user: "admin" allow: ["generate", "rotate"] - user: "app" allow: ["encrypt", "decrypt"] 6. The audit recorder can record all key-related operations for security auditing. The specific recorded content is as follows: (1) Operation type (such as generation, export, rotation); (2) Initiator identity; (3) Operation time, IP (Internet Protocol), key ID (Identifier); (4) Secure storage; (5) Write to the database and encrypt the signature to prevent tampering (such as HMAC or signature chain).

[0139] The recorded log is as follows: { "event": "KEY_GENERATE", "key_id": "user_cfg_key", "operator": "admin1",[[ID=�4]] "timestamp": "2025-05-07T12:01:23Z", "result": "success" }<^ 7. The key destroyer supports manual destruction or automatic destruction upon expiration: (1) Encrypted storage destruction: File-level secure erasure (overwrite multiple times); (2) Memory clearing: Call the encrypted library interface to clear the heap memory.

[0140] Among them, in the embodiments of the present application, the destruction records can be retained in the audit log.

[0141] Thus, the embodiments of the present application can cover the entire life cycle through the constructed key management module 700 to achieve full-process control of key generation, distribution, storage, rotation, destruction, etc., and support key access permission management.

[0142] Optionally, in an embodiment of the present application, the data integrity verification module 800 includes: a hash generation unit, a digest comparison unit, an exception alarm unit, and a log recording unit.

[0143] Among them, the hash generation unit is used to calculate the sender hash value and the receiver hash value corresponding to the sensitive encrypted data respectively at the sender and receiver ends of the sensitive encrypted data based on a preset hash algorithm, and determine whether the sender hash value and the receiver hash value meet the preset data matching requirements. Among them, when the sender hash value and the receiver hash value meet the preset data matching requirements, it is determined that the sensitive encrypted data passes the data integrity verification.

[0144] The digest comparison unit is used to generate a digest corresponding to the sensitive decrypted data, sign the digest with the private key of the sender, and send the signed digest and the sensitive decrypted data to the receiver to determine whether the digest meets the preset signature legality requirements through the public key of the receiver. Among them, when the digest meets the signature legality requirements, it is determined that the sensitive decrypted data passes the data integrity verification.

[0145] The exception alarm unit is used to perform corresponding data exception alarm operations and record the corresponding data exception information when the sender hash value and the receiver hash value do not meet the preset data matching requirements, or the digest does not meet the signature legality requirements.

[0146] The log recording unit is used to record the data integrity verification information of the sensitive encrypted data.

[0147] In the specific implementation process, the data integrity verification module 800 in the embodiments of the present application is mainly composed of main components such as a hash generator, a digest verifier, a signature verifier, a timestamp binder, and an integration interface, which are specifically described as follows: 1. Hash generator: 1) Responsible for calculating the hash value of the original or encrypted data; 2) The supported hash algorithms are SHA (Secure Hash Algorithm)-256, SHA-3 series, BLAKE2, or SM3; 3) Data processing granularity: Can process the whole segment or by blocks (to prevent memory problems of large files).

[0148] 2. Digest verifier: (1) Verify the integrity of the data at the receiver end: (2) The receiving end recalculates the hash of the received data; (3) Compare it with the original hash attached by the sending end. If they match, it indicates that the data has not been tampered with. Otherwise, an integrity error is prompted.

[0149] 3. The signature verifier can add a digital signature to the data hash in sensitive operation scenarios to prevent data forgery, as described below: (1) Signature process (sending end, such as a local client): Generate a digest corresponding to the data, sign it using the private key, and send the signature and the data to the receiving end together; (2) Verification process (receiving end, such as a server): Use the public key of the sending end to verify the legality of the signature. If the signature verification fails, reject the processing of the data.

[0150] 4. Timestamp binder: This timestamp binder can be used to bind the generation time of the data, avoid replay attacks, and attach a timestamp field during each import / export, and also participate in the hash signature for the timestamp; verify at the receiving end whether the timestamp is within the allowed range, and reject if it exceeds.

[0151] 5. Integration interface: This integration interface can provide a unified interface for the encryption module 200, decryption module 300, and communication module 400. The embodiments of the present application can perform corresponding import or export processes based on this integration interface, as described below: (1) Export process: 1) Before the client exports, encrypt the sensitive data to generate corresponding hash values (i.e., the sending - end hash value) and the receiving - end hash value; (2) Perform a digital signature on the hash value; (3) Send the sensitive encrypted data, the hash value, and the corresponding digital signature to the server together.

[0152] (2) Import process: 1) The server receives the data (i.e., the sensitive encrypted data, the hash value, and the corresponding digital signature); 2) Use the public key to verify the digital signature and verify the hash value; 3) If the sending - end hash value and the receiving - end hash value are consistent, and the digital signature verification is successful, it can be determined that the sensitive encrypted data has not been tampered with; 4) Send the sensitive encrypted data to the decryption module 300 for decryption processing.

[0153] Combining the functional logics of the above - mentioned main components, the embodiments of the present application can determine multiple logical units in the specific implementation process, such as a logical hash generation unit, a digest comparison unit, an exception alarm unit, and a log recording unit, asFigure 10 As shown below: 1. Hash generation unit: Calculate the digest based on algorithms such as SHA-256 In the embodiments of the present application, first, the hash generation unit can calculate the sender hash value and the receiver hash value corresponding to the sensitive encrypted data at the sender and receiver ends of the sensitive encrypted data based on the hash algorithm, and determine whether the corresponding hash values meet the data matching requirements (such as whether the sender hash value and the receiver hash value are the same). Thus, when the sender hash value and the receiver hash value meet the data matching requirements, it is determined that the sensitive encrypted data passes the data integrity verification.

[0154] 2. Digest comparison unit: Verify whether the received data has been tampered with Secondly, the embodiments of the present application can generate the digest corresponding to the sensitive decrypted data, sign it with the private key of the sender, and send the signed digest and the sensitive decrypted data to the receiver to determine whether the digest meets the signature legality requirements through the public key of the receiver. Thus, when the digest meets the signature legality requirements, it is determined that the sensitive decrypted data passes the data integrity verification.

[0155] 3. Abnormal alarm unit: Alarm and record data anomalies In addition, in the embodiments of the present application, when the sender hash value and the receiver hash value do not meet the data matching requirements, or the digest does not meet the signature legality requirements, data anomaly alarms can be issued to record the data anomaly information.

[0156] 4. Log recording unit: Track the integrity verification log Finally, the embodiments of the present application can record the data integrity verification information of the sensitive encrypted data.

[0157] In summary, as Figure 11 shown, the embodiments of the present application call the encryption module 200 through the data integrity verification module 800 to obtain the corresponding sensitive encrypted data, and generate the digest corresponding to the sensitive encrypted data through the above-mentioned logical hash generation unit, digest comparison unit, abnormal alarm unit and log recording unit, and check whether the digests at the sender and receiver ends are the same. When they are different, data anomaly alarms and log records are made, and the sensitive decrypted data that passes the data integrity verification is input into the decryption module 300.

[0158] Therefore, the embodiments of the present application embed a hash verification mechanism in the data integrity verification module 800 to perform hash value comparison verification on the imported data, thereby ensuring that the content has not been tampered with, and ensuring the credibility of the entire encryption and decryption system during the import, export, transmission and storage of sensitive data.

[0159] Optionally, in an embodiment of the present application, the plug-in module 900 includes: a plug-in management unit and a hot loading unit.

[0160] Among them, the plug-in management unit is used to provide a plug-in loading interface and a plug-in unloading interface, and register with the encryption algorithm selection module 100 through the plug-in loading interface, so as to call the plug-in loading interface through the encryption algorithm selection module 100 for encryption and decryption operations.

[0161] The hot loading unit is used to configure file or interface dynamic update policies.

[0162] During the actual execution process, the present application embodiment defines the algorithm plug-in interface specification in the plug-in module 900. Each algorithm plug-in must implement a unified interface (such as pseudo C code), as follows: struct AlgoPlugin { char name

[64] ; / / Plug-in name char version

[16] ; / / Plug-in version int (*init)(void); / / Initialization int (*encrypt)(const uint8_t* in, uint32_t in_len, uint8_t* out,uint32_t* out_len); int (*decrypt)(const uint8_t* in, uint32_t in_len, uint8_t* out,uint32_t* out_len); int (*integrity)(const uint8_t* in, uint32_t in_len, uint8_t*digest); int (*cleanup)(void); / / Clean up resources }; The plug-in is compiled into a shared library (Linux:.so / Windows:.dll) and loaded dynamically.

[0163] Secondly, the plug-in module 900 in the embodiment of the present application mainly includes a plug-in management unit and a hot loading unit, which are specifically described as follows: 1. Plug-in management unit: (1) Provide plug-in loading and unloading interfaces; (2) Verify the plug-in signature and integrity (prevent malicious plug-ins from being loaded); (3) The failure of plug-in loading does not affect the operation of the main system; (4) The plug-in runs in a sandbox isolation environment (to prevent memory and exceptions from contaminating the main process).

[0164] 2. Hot loading unit: (2) It supports loading new plug-ins without restarting the system.

[0165] (3) The configuration file or API can dynamically update the policy (enable / disable specific algorithm plug-ins).

[0166] As an implementable way, the embodiments of the present application perform the following operations through the plug-in module 900: 1. The administrator deploys the SM4 encryption plug-in to the plug-in directory.

[0167] 2. The system loads the plug-in through the API and registers it to the encryption algorithm selection module 100.

[0168] 3. The user selects the SM4 encryption algorithm during import and export.

[0169] 4. The encryption algorithm selection module 100 calls the plug-in interface to perform encryption or decryption operations.

[0170] Thus, the embodiments of the present application can enable users to flexibly expand and customize algorithms through the plug-in module 900 and meet the corresponding compliance requirements; in addition, the plug-in module 900 supports smooth algorithm upgrades, reduces the restart risk due to version changes, and enhances the system security and adaptability.

[0171] Optionally, in an embodiment of the present application, the authentication and authorization module 600 includes: an identity authentication unit, a permission discrimination unit, a session management unit, and a security audit unit.

[0172] Among them, the identity authentication unit is used to obtain the identity information, token, or certificate corresponding to the client user or entity, and perform identity authentication on the client user or entity through the identity information, token, or certificate to obtain the corresponding identity authentication result.

[0173] The permission discrimination unit is used to map the corresponding role according to the identity authentication result, query the preset permission rules, and determine whether to allow the role to perform import or export operations. If the role is allowed to perform import or export operations, then perform the corresponding sensitive data export or sensitive data export operation, otherwise return the corresponding authentication failure information.

[0174] The session management unit is used to generate a corresponding session token when allowing the role to perform import or export operations, and perform corresponding session management operations based on the session token.

[0175] A security audit unit, which is used to record authentication failure information in a preset security audit log and send the security audit log to a target email box.

[0176] It should be noted that, as Figure 12 shown, an authentication and authorization module 600 can be constructed through an identity authentication unit, an authority discrimination unit, a session management unit, and a security audit unit in the embodiments of the present application.

[0177] Among them, the identity authentication unit supports passwords, tokens, two-factor, biometrics, etc., and provides login, session initialization, and identity verification.

[0178] The authority discrimination unit can parse user identities, assign authority roles, and can verify user authorities.

[0179] The session management unit can manage user session status, token expiration, logout, etc.

[0180] The security audit unit can record authentication, authorization failure, and access logs.

[0181] The following takes the import of sensitive data as an example and, in combination with the accompanying drawings, describes the execution processes of each unit in the authentication and authorization module 600.

[0182] Figure 13 It is a collaboration schematic diagram of the authentication and authorization module 600 and other modules. As Figure 13 shown, the specific process of performing authentication and authorization in the embodiments of the present application is as follows: 1. The client application initiates a session request and calls the communication module 400 to send user identity information, a token, or a certificate along with the session request (i.e., an authentication request) to the server EDS. 2. In the server EDS, based on the authentication and authorization module 600, identity authentication is performed through methods such as passwords and usernames, Tokens (tokens), or TLS certificates (mutual authentication). 3. Map roles according to the authentication result (such as an administrator or a read-only user), and query whether the permission rules allow the configuration import operation. If not, return an authorization failure; otherwise, perform the next operation to execute the corresponding authority discrimination or authority verification operation. 4. After successful authentication (i.e., successful permission verification), generate a session token (Session Token) for subsequent interactive verification, and encrypt and save the session information to the local cache. 5. The embodiments of the present application also need to record all authentication attempts, failures, and permission errors in the log, and the log is periodically synchronized or sent to the target email box through the SMTP (Simple Mail Transfer Protocol) function to achieve security auditing.

[0183] After that, the embodiments of the present application can send the sensitive data after authentication and authorization to the corresponding client EDS or server EDS.

[0184] Thus, the embodiments of the present application integrate a two-factor authentication mechanism through the authentication and authorization module 600, supporting multi-factor verification based on methods such as tokens, certificates, passwords, time windows, etc.; in addition, the embodiments of the present application can also perform collaborative design on the client EDS and server EDS to configure and have the EDS lead functions such as encryption and decryption, key negotiation, and algorithm synchronization, enhancing data processing consistency.

[0185] It can be understood that the embodiments of the present application can well support the import status multi-level feedback mechanism, and the import process includes detailed feedback status such as algorithm confirmation failure, decryption failure, and service import failure, facilitating users to locate problems; in addition, the embodiments of the present application are designed in combination with the error knowledge base and the log system, facilitating problem location and later traceability, and improving the system operation and maintenance and auditing capabilities.

[0186] The zero-trust adaptation module 500 is used to perform dynamic authentication, real-time policy engine decision-making, session continuous verification, and context verification operations based on the preset zero-trust policy during the sensitive data export stage and the sensitive data import stage, so as to dynamically adjust the import and export operation permissions.

[0187] Those skilled in the art should understand that the zero-trust security architecture requires each operation to be re-verified and authorized, preventing internal threats, session hijacking, or lateral movement attacks; while the existing import and export technologies usually default to trust within the session after one authentication.

[0188] Therefore, the embodiments of the present application introduce a zero-trust policy for import and export operations to achieve dynamic authentication, minimum privilege dynamic authorization, real-time risk assessment and policy engine decision-making, continuous session verification, and context verification. The specific implementation process is as follows: 1. Dynamic authentication mechanism: Each import and export operation of the embodiments of the present application must re-pass authentication, and the specific process is as described below: (1) The import and export request triggers the zero-trust identity module (i.e., the zero-trust adaptation module 500); (2) The zero-trust identity module performs risk assessment in combination with the environmental context (such as IP, geographical location, device fingerprint); (3) If the risk is high, stronger verification is required (for example, tokens, biometric authentication, and SMS OTP (One-Time Password)); (4) The verification result generates a session token in real time, which is only used for the current import and export session.

[0189] In addition, during the actual execution process, the embodiments of the present application can also implement the above dynamic authentication mechanism based on a zero-trust dynamic authentication method, which is specifically described as follows: 1. Sensitive operation triggering stage: When a user or system initiates a sensitive data import / export request: (1) The operation is intercepted and marked as a highly sensitive action; (2) The system automatically freezes the current data stream and enters the verification preparation state; (3) Generate a unique operation ID and record the operation context (such as data type, target system, timestamp).

[0190] 2. Multi-dimensional identity re-verification: Perform three-layer progressive verification: (1) Device fingerprint verification 1) Detect the current device hardware features (such as the TPM (Trusted Platform Module) chip ID); 2) Verify whether the network access location complies with the preset security policy; 3) Compare the device behavior baseline (such as the mouse movement pattern).

[0191] (2) Dynamic biometric authentication 1) Trigger real-time liveness detection (such as blinking in front of the screen); 2) Collect behavioral biometric features (such as keyboard typing rhythm); 3) Use voiceprint recognition to verify the operator's identity.

[0192] (3) Contextual permission confirmation 1) Check whether the current session meets the principle of least privilege; 2) Verify whether the operation time is within the preset security window; 3) Confirm whether the data flow conforms to the workflow rules.

[0193] 3. Micro-segmentation policy execution: Dynamically construct a temporary data channel according to the verification result: (1) Isolate the transmission path through SDN (Software-Defined Networking) technology; (2) Automatically apply encryption policies (such as encrypting sensitive fields separately); (3) Limit the scope of accessible API endpoints.

[0194] 4. Operation process monitoring: Implement real-time behavior analysis: (1)Monitor abnormal patterns of data streams (such as sudden large - volume transmissions); (2)Track the integrity of the operation chain (to prevent man - in - the - middle attacks); (3)Record a complete audit trail (traceable to specific commands).

[0195] 5. Automatic session fusing: Set up a dual - termination mechanism: (1)Destroy the temporary access credentials immediately after the operation is completed; (2)Force the refresh of the session key; (3)Clear the sensitive data cache in memory.

[0196] 6. Intelligent feedback optimization: The system automatically analyzes the current verification process: (1)Calculate the risk score and update the user trust value; (2)Optimize the challenge difficulty for the next verification; (3)Mark abnormal patterns for the security team to review.

[0197] Thus, the embodiments of the present application break the traditional session - maintaining mechanism through continuous identity confirmation, behavior - chain integrity, dynamic micro - isolation, and adaptive verification. Each sensitive operation is re - authenticated, and a temporary data channel is created on demand to achieve nano - level isolation.

[0198] 2. Dynamic effectiveness of the least - privilege policy: (1)Generate a minimized permission set in real - time for the content of each import / export request (such as the type of imported configuration items, the scope of exported data); (2)The permission policy is generated in real - time by the policy engine based on the sensitivity of configuration items, user roles, and operation context; (3)When an import / export operation is executed, if a request for an over - privilege operation is detected, immediately reject it and give an alarm.

[0199] 3. Real - time decision - making of the policy engine: (1)The system integrates a policy engine, and the decision - making factors include the current user identity and role, session context (device, location, time), historical behavior baseline (refer to the anomaly detection module), and the sensitivity of the current request; (2)The engine outputs decisions based on the factors, such as allow, strengthen verification, block, or require manual approval.

[0200] 4. Continuous session verification and context verification: (1)Continuously verify the session context during the import / export process; (2)If there are significant changes in the session environment (such as IP mutation, device mutation), trigger session interruption or secondary authentication.

[0201] Thus, embodiments of the present application can re-verify identities and permissions through the zero-trust adaptation module 500 during each import / export operation to prevent internal threats and session hijacking. In addition, embodiments of the present application can also automatically and dynamically adjust operation permissions, reduce the risk of data leakage, and support real-time policy updates, enhancing the system's ability to respond to dynamic threats.

[0202] In summary, embodiments of the present application can deploy an encryption / decryption system EDS independent of the BMC system on the client and the server through components such as the encryption algorithm selection module 100, communication module 400, encryption module 200, decryption module 300, authentication and authorization module 600, key management module 700, and data integrity verification module 800. The overall architecture of the encryption / decryption system is as Figure 14 shown. Among them, the encryption / decryption system is the interaction layer; the encryption algorithm selection module 100, communication module 400, encryption module 200, decryption module 300, authentication and authorization module 600, and key management module 700 constitute the core processing layer; the data integrity verification module 800 is the data verification layer, thereby constructing a multi-module hierarchical security architecture to enable the encryption module 200, decryption module 300, key management module 700, authentication and authorization module 600, data integrity module, etc. to work together to form a system-level security protection system, realize local encryption and remote decryption of data, and reserve interfaces for future algorithm replacement and encryption policy expansion, with good scalability and compatibility.

[0203] Embodiments of the present application also provide a method for importing and exporting sensitive data based on a baseboard management controller.

[0204] As Figure 15 shown, it is a flowchart of the method for importing and exporting sensitive data based on a baseboard management controller in the sensitive data import stage of the application of the embodiment of the present application. Among them, the method for importing and exporting sensitive data based on a baseboard management controller includes the following steps: In step S1501, a configuration import request is sent to the encryption / decryption system of the target client through the target client application, so that the encryption / decryption system of the target client can obtain the list of encryption algorithms supported by the target server according to the configuration import request.

[0205] In step S1502, based on the list of encryption algorithms, an encryption algorithm negotiation operation is performed between the encryption / decryption system of the target server and the encryption / decryption system of the target client to determine the corresponding target encryption algorithm and the key corresponding to the target encryption algorithm on the target server.

[0206] In the sensitive data import stage, that is, when the BMC imports a configuration file containing sensitive information, its operation timing is as Figure 16 shown.

[0207] In the actual implementation process, an embodiment of the present application can first send a configuration import request to the client EDS through the client application, so that the EDS of the target client updates the supported encryption algorithm list according to the configuration import request, obtains the encryption algorithm list supported by the server, and returns the encryption algorithm list supported by the server to the client application for encryption algorithm negotiation operations between the EDS of the target server and the EDS of the client, so as to determine the corresponding target encryption algorithm and the key corresponding to the target encryption algorithm on the server side.

[0208] Therefore, the encryption algorithm selection strategy of the embodiment of the present application has a certain degree of intelligence and can perform algorithm optimization based on policies, priorities, security levels, and performance indicators.

[0209] Optionally, in an embodiment of the present application, based on the encryption algorithm list, an encryption algorithm negotiation operation is performed between the encryption and decryption systems of the target server and the encryption and decryption systems of the target client to determine the corresponding target encryption algorithm and the key corresponding to the target encryption algorithm on the target server, including: obtaining the target encryption algorithm in the encryption algorithm list selected by the client user through the front-end interface of the target client application, and sending the target encryption algorithm to the encryption and decryption system of the target client; sending the target encryption algorithm to the encryption and decryption system of the target server through the encryption and decryption system of the target client to determine whether the target server supports the target encryption algorithm through the encryption and decryption system of the target server; if the target server does not support the target encryption algorithm, reselect a new target encryption algorithm from the encryption algorithm list through the target client; if the target server supports the target encryption algorithm, determine the type of the target encryption algorithm; when the type of the target encryption algorithm is symmetric encryption, obtain the shared key corresponding to the symmetric encryption and generate a confirmation message supporting the target encryption algorithm; when the type of the target encryption algorithm is asymmetric encryption, generate a key pair corresponding to the target encryption algorithm through the encryption and decryption system of the target server, return the public key in the key pair, and generate a confirmation message supporting the target encryption algorithm.

[0210] It should be noted that as Figure 16 shown, the user can select the corresponding target encryption algorithm from the encryption algorithm list through the front-end interface of the client application, and send the target encryption algorithm and the corresponding configuration import file to the client EDS to request the use of the required encryption algorithm (i.e., the target encryption algorithm) from the server EDS through the client EDS, and determine whether the target encryption algorithm is included in the encryption algorithm list supported by the server EDS. If the target encryption algorithm is included in the encryption algorithm list, determine the type of the target encryption algorithm.

[0211] When the type of the target encryption algorithm is symmetric encryption, the shared key (i.e., the public key) is directly used; when the type of the target encryption algorithm is asymmetric encryption, the server generates an asymmetric key pair and returns the public key (i.e., the corresponding shared public key in symmetric encryption).

[0212] It can be understood that the embodiments of the present application support a dynamic negotiation encryption algorithm and a symmetric and asymmetric encryption automatic switching mechanism. Thus, the client and the server can determine the mutually supported encryption algorithm through negotiation, improving the system compatibility and flexibility, and can dynamically select the encryption method according to the data sensitivity or the server capability, enhancing the compatibility balance between security and performance. In addition, the embodiments of the present application also support a front-end friendly interaction design, such as real-time algorithm visual selection, error feedback display, status visual tracking, etc., to enhance the system operability.

[0213] In step S1503, obtain the plaintext sensitive data input by the client user, and use the target encryption algorithm through the encryption and decryption system of the target client to encrypt the plaintext sensitive data to obtain the corresponding sensitive encrypted data, and perform data integrity verification on the sensitive encrypted data to obtain the sensitive encrypted data that passes the data integrity verification.

[0214] Further, the embodiments of the present application also need to obtain encryption algorithm confirmation at the client EDS, so as to send the imported file and the sensitive data to the client EDS together through the client application; the client EDS can use the target encryption algorithm to encrypt the sensitive data in the imported configuration file to obtain the corresponding sensitive encrypted data; then, the embodiments of the present application can perform data integrity verification on the sensitive encrypted data, thereby obtaining the sensitive encrypted data that passes the data integrity verification.

[0215] Optionally, in an embodiment of the present application, performing data integrity verification on the sensitive encrypted data to obtain the sensitive encrypted data that passes the data integrity verification includes: based on a preset hash algorithm, calculating the sender hash value and the receiver hash value corresponding to the sensitive encrypted data at the sender and receiver ends of the sensitive encrypted data respectively; determining whether the sender hash value and the receiver hash value meet the preset data matching requirements; if the sender hash value and the receiver hash value meet the preset data matching requirements, determining that the sensitive encrypted data passes the data integrity verification; if the sender hash value and the receiver hash value do not meet the preset data matching requirements, performing corresponding data exception alarm operations and recording the corresponding data exception information.

[0216] As a realizable manner, when performing data integrity verification on the sensitive encrypted data, the embodiments of the present application can first use the hash algorithm to calculate the sender hash value and the receiver hash value corresponding to the sensitive encrypted data at the sender and receiver ends (i.e., the client and the server) of the sensitive encrypted data respectively.

[0217] Secondly, the embodiment of the present application can determine whether the sender hash value and the receiver hash value meet the data matching requirements, such as whether the sender hash value and the receiver hash value are the same. If the sender hash value and the receiver hash value meet the data matching requirements, it is determined that the sensitive encrypted data passes the data integrity verification; otherwise, corresponding data exception alarm operations are performed, and the corresponding data exception information is recorded.

[0218] Thus, the embodiment of the present application realizes the data integrity verification of sensitive encrypted data by introducing a hash verification mechanism and comparing and verifying the hash values of the imported data, which effectively guarantees the reliability and integrity of the encrypted content.

[0219] In step S1504, the sensitive encrypted data is decrypted by using a key in the encryption and decryption system of the target server to obtain the corresponding sensitive decrypted data, and the data integrity verification is performed on the sensitive decrypted data, and the sensitive decrypted data that passes the data integrity verification is imported into the baseboard management controller of the target server.

[0220] After that, the embodiment of the present application can decrypt the sensitive encrypted data by using a key. If the decryption fails, the import failure status is immediately returned; if the decryption is successful, a decrypted configuration file, that is, sensitive decrypted data, is generated.

[0221] Furthermore, the embodiment of the present application can perform data integrity verification on the sensitive decrypted data, so as to import the sensitive decrypted data that passes the data integrity verification into the baseboard management controller of the server.

[0222] Thus, the embodiment of the present application enables the sensitive data in the configuration import and export process to be always in an encrypted state, and performs full-life-cycle encryption protection on it, thereby effectively preventing leakage in the intermediate links.

[0223] Optionally, in an embodiment of the present application, performing data integrity verification on the sensitive decrypted data includes: generating a digest corresponding to the sensitive decrypted data, signing the digest by using the private key of the sender, and sending the signed digest and the sensitive decrypted data to the receiver; judging whether the digest meets the preset signature legality requirement by using the public key of the receiver; if the digest meets the signature legality requirement, it is determined that the sensitive decrypted data passes the data integrity verification; if the digest does not meet the signature legality requirement, corresponding data exception alarm operations are performed, and the corresponding data exception information is recorded.

[0224] It should be noted that the process of performing data integrity verification on the sensitive decrypted data in the embodiment of the present application is as follows: 1. Generate a digest corresponding to the sensitive decrypted data, and sign the digest by using the private key of the sender; 2. Send the signed abstract and sensitive decrypted data to the receiving end; 3. Determine whether the abstract meets the signature legality requirements through the public key of the receiving end; 4. If the abstract meets the signature legality requirements, it is determined that the sensitive decrypted data passes the data integrity verification; otherwise, perform corresponding data exception alarm operations and record the corresponding data exception information.

[0225] Thus, the embodiments of the present application verify the data integrity of the sensitive decrypted data, thereby verifying whether the received data has been tampered with, and ensuring the data integrity and security of the sensitive data during the import process.

[0226] Optionally, in an embodiment of the present application, in the encryption and decryption system of the target server, use the key to decrypt the sensitive encrypted data to obtain the corresponding sensitive decrypted data, perform data integrity verification on the sensitive decrypted data, and import the sensitive decrypted data that passes the data integrity verification into the baseboard management controller of the target server, including: parsing the ciphertext structure corresponding to the sensitive encrypted data through the encryption and decryption system of the target server to obtain the parsed data corresponding to the sensitive encrypted data; obtaining the shared key or private key corresponding to the sensitive encrypted data, and decrypting the parsed data through the shared key or private key, and determining whether the sensitive encrypted data is successfully decrypted; if the sensitive encrypted data is successfully decrypted, generate the corresponding sensitive decrypted data, otherwise return the import failure status information; construct a configuration file corresponding to the sensitive decrypted data through the target client application and send the configuration file to the target server application, so that the target server application performs the import operation of the sensitive encrypted data according to the configuration file, and determines whether the sensitive encrypted data is successfully imported; if the sensitive encrypted data is successfully imported, return the import success status information, otherwise return the import failure status information.

[0227] In the actual execution process, the embodiments of the present application can first parse the ciphertext structure corresponding to the sensitive encrypted data through the server EDS to obtain the corresponding parsed data; secondly, the embodiments of the present application can decrypt the parsed data through the shared key or private key, and determine whether the sensitive encrypted data is successfully decrypted. If the decryption is successful, generate the corresponding sensitive decrypted data, otherwise return the import failure status information.

[0228] Thirdly, the embodiments of the present application can send the assembled configuration file to the server application through the client application, so that the server application performs the import operation and determines whether the import is successful; if the import is successful, return the import success status, otherwise return the import failure status, so that after the client receives the execution status of the import operation, the entire import operation process is completed.

[0229] Thus, the embodiments of the present application can ensure the efficiency and reliability of data decryption by parsing and decrypting the corresponding encryption algorithms.

[0230] As shown in Figure 17 the figure, it is a flowchart of a method for importing and exporting sensitive data based on a baseboard management controller during the sensitive data export phase of an embodiment of the present application. The method for importing and exporting sensitive data based on a baseboard management controller includes the following steps: In step S1701, a configuration export request is sent to the encryption and decryption system of the target client through the target client application, so that the encryption and decryption system of the target client obtains the list of encryption algorithms supported by the encryption and decryption system of the target server according to the configuration export request.

[0231] In step S1702, based on the list of encryption algorithms, an encryption algorithm negotiation operation is performed between the encryption and decryption system of the target server and the encryption and decryption system of the target client, so as to determine the corresponding target encryption algorithm and the key corresponding to the target encryption algorithm on the target server.

[0232] In step S1703, a sensitive data request is sent to the baseboard management controller of the target server through the target client application, so that the baseboard management controller obtains the corresponding exported sensitive data, and sends the exported sensitive data to the encryption and decryption system of the target server, so as to encrypt the exported sensitive data using the target encryption algorithm in the encryption and decryption system of the target server, and send the encrypted exported sensitive data to the encryption and decryption system of the target client.

[0233] In step S1704, the encrypted sensitive data and the preset configuration data are combined in the encryption and decryption system of the target client to obtain the corresponding target configuration information, and the target configuration information is exported to the target client application.

[0234] During the sensitive data export phase, that is, when the BMC exports the sensitive information configuration file, the operation timing is as Figure 18 shown, and the specific process is as follows: 1. Start the export request: (1) The client application initiates a configuration export request; (2) After the client EDS receives the request, it requests the list of encryption algorithms supported by the server EDS.

[0235] 2. Algorithm negotiation: (1) The server EDS returns the list of encryption algorithms it supports; (2) The client displays an algorithm selection interface, and the user selects a target encryption algorithm; (3) The client EDS sends the selected target encryption algorithm to the server EDS for confirmation.

[0236] 3. Server algorithm confirmation and key preparation: (1) The server EDS checks whether it contains the target encryption algorithm; (2) If the target encryption algorithm is not supported, a request to reselect the algorithm is returned, and the client needs to reselect; (3) If it is supported, it is further determined whether the target encryption algorithm is symmetric encryption; (4) If it is symmetric encryption, the shared key is used. If it is asymmetric encryption, the server generates a key pair (public key, private key) and returns the public key to the client.

[0237] 4. Sensitive data encryption process: (1) After receiving the confirmation, the client EDS takes the selected target encryption algorithm as the final confirmation; (2) The client application initiates a request for sensitive data; (3) The server application (such as BMC) obtains the sensitive data from the storage and passes it to the server EDS; (4) After encrypting the sensitive data, the server EDS returns it to the client EDS; (5) The client EDS combines the encrypted sensitive data with the configuration data; (6) Finally, the complete configuration content containing the sensitive encrypted data is returned.

[0238] 5. Output result: The exported data finally obtained by the client is the configuration data and the encrypted sensitive fields (i.e., sensitive encrypted data, and the target encryption algorithm and key mechanism are determined by the encryption algorithm and key negotiation).

[0239] It can be understood that the embodiments of the present application can support the encrypted export and secure recombination import of sensitive configuration items to locally encrypt the sensitive fields in the exported configuration data and recombine them into the complete configuration during import; in addition, the embodiments of the present application also support the configuration migration and encryption protection mechanism across environments, enabling the configuration data to be securely migrated between different servers or systems and supporting the import and export of heterogeneous environment configurations.

[0240] Optionally, in an embodiment of the present application, it further includes: before sending a configuration import request or a configuration export request to the encryption and decryption system of the target client through the target client application, obtaining the identity information, token or certificate corresponding to the client user or entity; authenticating the client user or entity through the identity information, token or certificate to obtain the corresponding identity authentication result; mapping the corresponding role according to the identity authentication result, and based on the role and the preset permission rules, determining whether to allow the role to perform the corresponding import or export operation; if allowing the role to perform the import or export operation, performing the corresponding sensitive data export or sensitive data export operation, otherwise returning the corresponding authentication failure information.

[0241] It should be noted that before sending a configuration import request or a configuration export request from the client application to the client EDS, the embodiments of the present application also need to obtain the identity information, token, or certificate corresponding to the client user or entity to authenticate the client user or entity, map the corresponding role, and based on the role and the corresponding permission rules, determine whether to allow the role to perform the corresponding import or export operation; If the role is allowed to perform the import or export operation, the corresponding sensitive data export or sensitive data import operation is executed, otherwise the corresponding authentication failure information is returned.

[0242] Thus, the embodiments of the present application can complete authentication and permission verification before importing and exporting sensitive data, thereby preventing security issues such as unauthorized access, spoofing attacks, and permission overstep operations.

[0243] The embodiments of the present application also provide an electronic device, including a memory and a processor. A computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any of the above embodiments of the sensitive data import and export method based on the baseboard management controller.

[0244] The embodiments of the present application also provide a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps in any of the above embodiments of the sensitive data import and export method based on the baseboard management controller when running.

[0245] In an exemplary embodiment, the above computer-readable storage medium may include, but is not limited to: USB flash drive, read-only memory (ROM for short), random access memory (RAM for short), mobile hard disk, magnetic disk, or optical disc and other various media that can store computer programs.

[0246] The embodiments of the present application also provide a computer program product. The above computer program product includes a computer program, and when the computer program is executed by a processor, it implements the steps in any of the above embodiments of the sensitive data import and export method based on the baseboard management controller.

[0247] The embodiments of the present application also provide another computer program product, including a non-volatile computer-readable storage medium. The non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the steps in any of the above embodiments of the sensitive data import and export method based on the baseboard management controller.

[0248] Those skilled in the art may further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0249] The above has introduced in detail a method, device, equipment, and medium for importing and exporting sensitive data based on a baseboard management controller provided by this application. Specific examples have been used in this article to elaborate on the principle and implementation manner of this application. The description of the above embodiments is only used to help understand the method and its core idea of this application. It should be noted that for those of ordinary skill in the art of this technology, without departing from the principle of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A sensitive data import and export system based on a baseboard management controller, characterized in that Including: An encryption algorithm selection module, which is used to collect corresponding context information through a target client and a target server respectively, generate a list of encryption algorithms supported by the target client and the target server according to the context information, score the list of encryption algorithms, and perform negotiation and optimal selection operations on the scored list of encryption algorithms to obtain a corresponding target encryption algorithm and determine the key corresponding to the target encryption algorithm; An encryption module, which is used to obtain the original plaintext sensitive data input by the client user during the sensitive data import stage, or obtain the corresponding exported sensitive data from the baseboard management controller of the target server during the sensitive data export stage, and encrypt the original plaintext sensitive data or the exported sensitive data by using the target encryption algorithm and the key to obtain corresponding sensitive encrypted data; A decryption module, which is used to decrypt the sensitive encrypted data by using the key through the encryption and decryption system of the target server during the sensitive data import stage to obtain sensitive decrypted data; A communication module, which is used to export the sensitive encrypted data that has passed the preset data integrity verification operation to the target client application during the sensitive data export stage, or import the sensitive decrypted data that has passed the preset data integrity verification operation to the baseboard management controller of the target server during the sensitive data import stage; A zero-trust adaptation module, which is used to perform dynamic identity authentication, real-time policy engine decision-making, session duration verification, and context verification operations based on a preset zero-trust policy during the sensitive data export stage and the sensitive data import stage to dynamically adjust the import and export operation permissions.

2. The sensitive data import / export system based on the baseboard management controller according to claim 1, wherein It also includes: An authentication and authorization module, which is used to perform authentication and authorization operations on the client user or entity accessing the system before importing or exporting sensitive data, so that the client user or the entity only performs authorized operations; A key management module, which is used to generate, store, and distribute the key corresponding to the target encryption algorithm; A data integrity verification module, which is used to generate an integrity verification value corresponding to the sensitive encrypted data or the sensitive decrypted data, and perform data integrity verification on the sensitive encrypted data or the sensitive decrypted data according to the integrity verification value. When the sensitive encrypted data or the sensitive decrypted data passes the data integrity verification, the corresponding sensitive encrypted data or sensitive decrypted data is output, otherwise, data exception information corresponding to the sensitive encrypted data or the sensitive decrypted data is generated and recorded; A plug-in module, which is used to load the encryption algorithm selection module, the encryption module, the decryption module, the authentication and authorization module, the data integrity verification module, and the key management module in the form of plug-ins, run in a preset isolation sandbox, and support hot loading or unloading of algorithm plug-ins during the running process.

3. The sensitive data import / export system based on a baseboard management controller according to claim 1, wherein The encryption algorithm selection module includes: A policy management unit, which is used to dynamically adjust the security level of each encryption algorithm in the list of encryption algorithms based on a preset current security policy, and configure the enabling or disabling of the algorithm list; An algorithm capability recognition unit, configured to obtain the list of encryption algorithms supported by the target server and query the enabled or disabled algorithm list to obtain a corresponding algorithm query result; A negotiation processing unit, configured to send the list of encryption algorithms to the target client, and when the target client selects an encryption algorithm from the list of encryption algorithms, and based on the algorithm query result and the security level, perform encryption algorithm negotiation on the encryption algorithm to generate the target encryption algorithm; An interface service unit, configured to output the target encryption algorithm to the encryption module and provide an interface for the encryption algorithm selection module, so that the key management module and the communication module can call the encryption algorithm selection module.

4. The sensitive data import / export system based on a baseboard management controller according to claim 3, wherein The negotiation processing unit is specifically configured to: Obtain the target encryption algorithm selected by the client user through the front-end interface of the target client application, and send the target encryption algorithm to the encryption and decryption system of the target client; Send the target encryption algorithm to the encryption and decryption system of the target server through the encryption and decryption system of the target client, so as to determine whether the target server supports the target encryption algorithm through the encryption and decryption system of the target server; If the target server does not support the target encryption algorithm, re-select a new target encryption algorithm from the target encryption algorithm list through the target client; If the target server supports the target encryption algorithm, determine the type of the target encryption algorithm; When the type of the target encryption algorithm is symmetric encryption, obtain the shared key corresponding to the symmetric encryption through the key management module and generate a confirmation message supporting the target encryption algorithm; When the type of the target encryption algorithm is asymmetric encryption, call the key management module through the encryption and decryption system of the target server to generate a key pair corresponding to the target encryption algorithm, return the public key in the key pair, and generate a confirmation message supporting the target encryption algorithm.

5. The sensitive data import / export system based on a baseboard management controller according to claim 2, wherein The key management module includes: A key generator, configured to determine the symmetric key or asymmetric key corresponding to the target encryption algorithm according to the type of the target encryption algorithm, and automatically generate a key pair corresponding to the symmetric key or asymmetric key; A key memory, configured to store the key pair based on a preset key security access policy; A key negotiator, configured to perform key negotiation operations between the target client and the target server to generate a corresponding shared key; A key rotator, configured to switch the key pair based on a preset rotation period; An access controller, configured to manage the usage rights of the key pair; An audit recorder, configured to record the operation data corresponding to all operation behaviors corresponding to the key pair; A key destroyer, configured to destroy the key pair, generate a corresponding destruction record, and save the destruction record in the audit recorder.

6. The sensitive data import / export system based on a baseboard management controller according to claim 1, wherein The encryption module includes: An encryption parameter management unit, configured to call the key pair generated by the key management module and manage the algorithm parameters corresponding to the target encryption algorithm; An encryption algorithm execution unit, configured to obtain the original plaintext sensitive data in the sensitive data import phase, or the exported sensitive data in the sensitive data export phase, and encrypt the sensitive fields in the original plaintext sensitive data or the exported sensitive data by using the target encryption algorithm and the key to obtain corresponding sensitive encrypted data; An encrypted data packaging unit, configured to encapsulate the sensitive encrypted data into a unified format structure; A security interface unit, configured to provide a standard call interface for the encryption algorithm selection module and the communication module to call the encryption module.

7. The sensitive data import / export system based on a baseboard management controller according to claim 2, wherein The data integrity verification module includes: A hash generation unit, configured to calculate a sender hash value and a receiver hash value corresponding to the sensitive encrypted data at the sender and receiver ends of the sensitive encrypted data respectively based on a preset hash algorithm, and determine whether the sender hash value and the receiver hash value meet a preset data matching requirement. When the sender hash value and the receiver hash value meet the preset data matching requirement, it is determined that the sensitive encrypted data passes the data integrity verification; A digest comparison unit, configured to generate a digest corresponding to the sensitive decrypted data, sign the digest by using the private key of the sender, and send the signed digest and the sensitive decrypted data to the receiver to determine whether the digest meets a preset signature legality requirement by using the public key of the receiver. When the digest meets the signature legality requirement, it is determined that the sensitive decrypted data passes the data integrity verification; An exception alarm unit, configured to perform corresponding data exception alarm operations and record corresponding data exception information when the sender hash value and the receiver hash value do not meet the preset data matching requirement, or the digest does not meet the signature legality requirement; A log recording unit, configured to record the data integrity verification information of the sensitive encrypted data.

8. The sensitive data import and export system based on a baseboard management controller according to claim 1, wherein The communication module includes: An interface call unit, configured to provide corresponding call interfaces to the target client application or the baseboard management controller of the target server to receive corresponding import configuration requests or export configuration requests; An encapsulation and de-encapsulation unit, configured to provide an encapsulated data packet structure to perform encapsulation or de-encapsulation operations on the sensitive encrypted data through the encapsulated data packet structure; A secure communication management unit, configured to establish a secure channel with the encryption and decryption system of the target client or the encryption and decryption system of the target server; A protocol negotiation unit, configured to perform corresponding encryption algorithm negotiation operations in combination with the encryption algorithm selection module to obtain a corresponding target encryption algorithm.

9. The sensitive data import and export system based on a baseboard management controller according to claim 2, wherein The plug-in module includes: A plug-in management unit, configured to provide a plug-in loading interface and a plug-in unloading interface, and register to the encryption algorithm selection module through the plug-in loading interface, so that the encryption algorithm selection module calls the plug-in loading interface to perform encryption and decryption operations; A hot loading unit, configured to configure a file or an interface dynamic update policy.

10. The sensitive data import / export system based on a baseboard management controller according to claim 2, wherein The authentication and authorization module includes: An identity authentication unit, configured to obtain identity information, a token, or a certificate corresponding to the client user or the entity, and perform identity authentication on the client user or the entity through the identity information, the token, or the certificate, so as to obtain a corresponding identity authentication result; A permission discrimination unit, configured to map a corresponding role according to the identity authentication result, query a preset permission rule, and determine whether to allow the role to perform an import or export operation. If the role is allowed to perform an import or export operation, perform a corresponding sensitive data export or sensitive data import operation; otherwise, return a corresponding authentication failure message; A session management unit, configured to generate a corresponding session token when allowing the role to perform an import or export operation, and perform corresponding session management operations based on the session token; A security audit unit, configured to record the authentication failure message in a preset security audit log, and send the security audit log to a target email box.

11. A method for importing and exporting sensitive data based on a baseboard management controller, which is applied in the sensitive data import stage, is characterized in that The method includes the following steps: Sending a configuration import request to the encryption and decryption system of the target client through a target client application, so that the encryption and decryption system of the target client obtains a list of encryption algorithms supported by the target server according to the configuration import request; Based on the list of encryption algorithms, performing an encryption algorithm negotiation operation between the encryption and decryption system of the target server and the encryption and decryption system of the target client, so as to determine a corresponding target encryption algorithm and a key corresponding to the target encryption algorithm on the target server; Obtaining plaintext sensitive data input by a client user, and encrypting the plaintext sensitive data by using the target encryption algorithm through the encryption and decryption system of the target client to obtain corresponding sensitive encrypted data, and performing data integrity verification on the sensitive encrypted data to obtain sensitive encrypted data that passes the data integrity verification; Decrypting the sensitive encrypted data by using the key in the encryption and decryption system of the target server to obtain corresponding sensitive decrypted data, performing data integrity verification on the sensitive decrypted data, and importing the sensitive decrypted data that passes the data integrity verification into the baseboard management controller of the target server.

12. The method for importing and exporting sensitive data based on a baseboard management controller according to claim 11, wherein The performing an encryption algorithm negotiation operation between the encryption and decryption system of the target server and the encryption and decryption system of the target client based on the list of encryption algorithms, so as to determine a corresponding target encryption algorithm and a key corresponding to the target encryption algorithm on the target server includes: Obtaining the target encryption algorithm selected by the client user from the list of encryption algorithms through the front-end interface of the target client application, and sending the target encryption algorithm to the encryption and decryption system of the target client; Sending the target encryption algorithm to the encryption and decryption system of the target server through the encryption and decryption system of the target client, so as to determine whether the target server supports the target encryption algorithm through the encryption and decryption system of the target server; If the target server does not support the target encryption algorithm, reselecting a new target encryption algorithm from the list of encryption algorithms through the target client; If the target server supports the target encryption algorithm, determine the type of the target encryption algorithm; When the type of the target encryption algorithm is symmetric encryption, obtain the shared key corresponding to the symmetric encryption, and generate confirmation information that supports the target encryption algorithm; When the type of the target encryption algorithm is asymmetric encryption, generate a key pair corresponding to the target encryption algorithm through the encryption and decryption system of the target server, return the public key in the key pair, and generate confirmation information that supports the target encryption algorithm.

13. The method for importing and exporting sensitive data based on a baseboard management controller according to claim 11, wherein The data integrity verification of the sensitive encrypted data to obtain the sensitive encrypted data that passes the data integrity verification includes: Based on a preset hash algorithm, calculate the sender hash value and the receiver hash value corresponding to the sensitive encrypted data at the sender and receiver ends of the sensitive encrypted data respectively; Determine whether the sender hash value and the receiver hash value meet the preset data matching requirements; If the sender hash value and the receiver hash value meet the preset data matching requirements, determine that the sensitive encrypted data passes the data integrity verification; If the sender hash value and the receiver hash value do not meet the preset data matching requirements, perform corresponding data exception alarm operations and record the corresponding data exception information.

14. The method for importing and exporting sensitive data based on a baseboard management controller according to claim 11, wherein The data integrity verification of the sensitive decrypted data includes: Generate a digest corresponding to the sensitive decrypted data, sign the digest with the private key of the sender, and send the signed digest and the sensitive decrypted data to the receiver; Judge whether the digest meets the preset signature legality requirements through the public key of the receiver; If the digest meets the signature legality requirements, determine that the sensitive decrypted data passes the data integrity verification; If the digest does not meet the signature legality requirements, perform corresponding data exception alarm operations and record the corresponding data exception information.

15. The method for importing and exporting sensitive data based on a baseboard management controller according to claim 11, wherein The sensitive encrypted data is decrypted using the key in the encryption and decryption system of the target server to obtain the corresponding sensitive decrypted data, and the data integrity verification is performed on the sensitive decrypted data, and the sensitive decrypted data that passes the data integrity verification is imported into the baseboard management controller of the target server, including: Through the encryption and decryption system of the target server, analyze the ciphertext structure corresponding to the sensitive encrypted data to obtain the analysis data corresponding to the sensitive encrypted data; Obtain the shared key or private key corresponding to the sensitive encrypted data, decrypt the analysis data with the shared key or the private key, and determine whether the sensitive encrypted data is successfully decrypted; If the sensitive encrypted data is successfully decrypted, generate the corresponding sensitive decrypted data, otherwise return the import failure status information; Construct a configuration file corresponding to the sensitive decrypted data through the target client application, and send the configuration file to the target server application, so that the target server application performs the import operation of the sensitive encrypted data according to the configuration file, and determine whether the sensitive encrypted data is successfully imported; If the import of the sensitive encrypted data is successful, return the import success status information; otherwise, return the import failure status information.

16. A method for importing and exporting sensitive data based on a baseboard management controller. In the sensitive data export phase, it is characterized in that, It includes the following steps: Send a configuration export request to the encryption / decryption system of the target client through the target client application, so that the encryption / decryption system of the target client obtains the list of encryption algorithms supported by the encryption / decryption system of the target server according to the configuration export request; Based on the list of encryption algorithms, perform an encryption algorithm negotiation operation between the encryption / decryption system of the target server and the encryption / decryption system of the target client, so as to determine the corresponding target encryption algorithm and the key corresponding to the target encryption algorithm on the target server; Send a sensitive data request to the baseboard management controller of the target server through the target client application, so that the baseboard management controller obtains the corresponding exported sensitive data and sends the exported sensitive data to the encryption / decryption system of the target server, so as to encrypt the exported sensitive data using the target encryption algorithm in the encryption / decryption system of the target server, and send the encrypted exported sensitive data to the encryption / decryption system of the target client; Combine the encrypted sensitive data and the preset configuration data in the encryption / decryption system of the target client to obtain the corresponding target configuration information, and export the target configuration information to the target client application.

17. The method for importing and exporting sensitive data based on a baseboard management controller according to claim 11 or 16, characterized in that, It also includes: Before sending the configuration import request or the configuration export request to the encryption / decryption system of the target client through the target client application, obtain the identity information, token or certificate corresponding to the client user or entity; Authenticate the client user or the entity through the identity information, the token or the certificate to obtain the corresponding identity authentication result; Map the corresponding role according to the identity authentication result, and based on the role and the preset permission rules, determine whether to allow the role to perform the corresponding import or export operation; If the role is allowed to perform the import or export operation, perform the corresponding sensitive data export or sensitive data import operation; otherwise, return the corresponding authentication failure information.

18. An electronic device, characterized in that, It includes: A memory for storing a computer program; A processor for implementing the steps of the method for importing and exporting sensitive data based on a baseboard management controller according to any one of claims 11 to 17 when executing the computer program.

19. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, wherein the computer program implements the steps of the method for importing and exporting sensitive data based on a baseboard management controller according to any one of claims 11 to 17 when executed by a processor.

20. A computer program product comprising a computer program, characterized in that, The computer program implements the steps of the method for importing and exporting sensitive data based on a baseboard management controller according to any one of claims 11 to 17 when executed by a processor.

Images